Privacy Policy

Effective Date: [DATE]
Last Updated: [DATE]

Working draft only: The legal operator, production providers, actual processing practices, retention and backup periods, security controls, processing locations, and contact details have not been finalized. The descriptions below are proposed policy language and do not confirm that any proposed service, provider, or feature is deployed. This draft has not received final counsel approval and must not be treated as the Company's final privacy notice.

[LEGAL COMPANY NAME] (“Company,” “we,” “us,” or “our”) provides Strike Timesheet, a software platform for timekeeping, labor management, government-contract administration, compliance support, reporting, and related services.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when individuals:

• visit our websites;
• create or use an account;
• use our applications, APIs, or integrations;
• interact with customer support;
• receive communications from us; or
• otherwise interact with our services.

Our websites, applications, APIs, integrations, and related services are collectively referred to as the “Service.”

This Privacy Policy should be read together with our Terms of Use and any applicable customer agreement, Data Processing Addendum, or other written agreement.

1. Our Role With Respect to Personal Information

The role we play depends on how information is provided to us.

Information we collect for our own purposes

For information concerning:

• account creation;
• website visitors;
• prospective customers;
• administrators;
• billing contacts;
• communications with us;
• product analytics; and
• security and operational information,

we generally determine why and how that information is processed.

In privacy-law terminology, we may act as a controller, business, or similar responsible party for that information.

Information processed on behalf of customers

When a customer organization uses the Service to manage:

• employees;
• contractors;
• time records;
• labor assignments;
• approvals;
• projects;
• contracts;
• charge codes;
• payroll-related information; or
• other workforce information,

we generally process that information on the customer's behalf and according to the customer's instructions.

In those circumstances, the customer generally determines why that information is collected and used, and we act as the customer's processor, service provider, or equivalent.

If you are an employee, contractor, or other user whose account is provided by your employer or another organization, questions regarding your organization's use of your personal information should generally be directed to that organization.

2. Information We Collect

Depending on how the Service is used, we may collect the following categories of information.

A. Account and identity information

We may collect:

• first and last name;
• work email address;
• username;
• authentication-provider information;
• profile photograph;
• job title;
• employer;
• organizational role;
• administrative permissions; and
• account identifiers.

The Service may offer sign-in through third-party identity providers. If an identity provider is enabled, we may receive information it makes available according to your settings and the permissions granted. The providers and sign-in options, if any, have not been finalized for production. We do not receive your identity-provider password.

3. Company and Professional Information

We may collect or obtain information about the organization with which you are associated, including:

• company name;
• legal business name;
• domain;
• website;
• business address;
• business telephone number;
• company logo;
• industry;
• approximate company size;
• professional profile information;
• business social-media profiles;
• job title;
• role; and
• other publicly available professional information.

Some of this information may be provided directly by you or your organization.

Other information may be obtained from public sources or commercial business-information providers.

4. Enrichment Information

To reduce manual data entry, we may use professional or business-data services to supplement information provided during onboarding.

For example, we may use a verified work email address or company domain to identify likely:

• name;
• employer;
• title;
• company website;
• company location;
• professional profile;
• company logo;
• business description; or
• related business information.

Enrichment information is not treated as inherently accurate.

Where appropriate, we ask users to review or confirm material information before relying upon it.

We may retain information about:

• the source of enriched information;
• when it was obtained;
• our confidence in the match; and
• whether the user confirmed or corrected it.

Information corrected by a user may take precedence over subsequently retrieved enrichment information.

5. Government and Public-Record Information

The Service may retrieve or process information from publicly available government sources, including sources relating to:

• federal contractors;
• government entities;
• Unique Entity Identifiers;
• CAGE codes;
• SAM registrations;
• federal awards;
• contracts;
• agencies;
• contract values;
• periods of performance;
• NAICS codes; and
• related government information.

Sources may include services such as SAM.gov, USAspending.gov, and other government databases.

Public-record information may be associated with an organization or, in some cases, with individual business representatives.

We may combine public information with information provided by customers to identify likely company, legal-entity, and award relationships.

6. Workforce and Timekeeping Information

When customers use the Service for workforce or labor management, we may process information such as:

• employee or contractor names;
• work email addresses;
• employee identifiers;
• employment status;
• supervisor or manager relationships;
• work schedules;
• timesheet entries;
• hours worked;
• charge codes;
• projects;
• contracts;
• CLINs;
• labor categories;
• certifications;
• approvals;
• corrections;
• leave or absence information;
• timestamps;
• audit records; and
• related labor-management information.

Customers control which workforce information they submit and how their workforce uses the Service.

7. Payroll and Financial-System Information

If a customer enables an integration with payroll, accounting, ERP, or similar systems, we may process information such as:

• payroll identifiers;
• employee mappings;
• approved hours;
• pay-period information;
• labor distributions;
• accounting codes;
• project codes;
• cost-center information;
• general-ledger mappings; and
• reconciliation information.

Unless expressly stated otherwise, we do not need or intend to collect employee banking credentials, credit-card numbers, or unrelated consumer financial information.

8. Contract and Business Records

Customers may submit business records, which may include:

• contracts;
• subcontracts;
• task orders;
• statements of work;
• modifications;
• project records;
• invoices;
• accounting records;
• policies;
• procedures;
• compliance documentation; and
• related materials.

These documents may incidentally contain personal information.

Customers are responsible for determining whether they have authority to provide those materials to us.

9. Information We Do Not Permit or Intend to Collect

The Service is not authorized to receive or process classified information. Do not submit classified information, including:

• Sensitive Compartmented Information;
• Special Access Program information;
• Controlled Unclassified Information (CUI);
• other restricted government information; or
• export-controlled technical information.

CUI, restricted government information, or export-controlled technical information may be submitted only if a future written agreement expressly authorizes the specific information and the Service has been configured to support it. Unless and until both conditions are met, do not submit it.

The Service is also not intended to receive or process:

• Social Security numbers;
• government security credentials;
• medical information subject to HIPAA;
• consumer payment-card information; or
• other highly sensitive information not necessary to use the Service.

Users should not submit such information unless Company has expressly authorized the relevant data type in writing.

10. Device and Usage Information

When individuals use the Service, we may automatically collect technical information such as:

• IP address;
• device type;
• browser type;
• operating system;
• session identifiers;
• login timestamps;
• authentication events;
• pages or features accessed;
• actions taken within the Service;
• referring URLs;
• application errors;
• performance information; and
• security events.

We use this information to operate, secure, diagnose, and improve the Service.

11. Audit and Security Logs

Because the Service includes timekeeping, approvals, and compliance-related functionality, we may maintain detailed records of actions taken within the Service.

These records may include:

• user identity;
• login activity;
• time of action;
• IP address;
• record created or modified;
• original value;
• changed value;
• approval or certification action;
• administrative activity; and
• related metadata.

These records may be retained longer than ordinary application telemetry where necessary to maintain audit history or satisfy customer obligations.

12. Communications

We may collect information contained in communications with us, including:

• customer-support requests;
• emails;
• chat messages;
• sales inquiries;
• product feedback;
• security reports; and
• other correspondence.

13. How We Use Personal Information

We may use personal information to:

Provide the Service

Including to:

• authenticate users;
• create accounts;
• establish organizations;
• manage permissions;
• record time;
• administer projects and charge codes;
• process approvals;
• maintain audit history;
• provide reports;
• support integrations; and
• provide compliance-supporting functionality.

Perform onboarding and entity resolution

Including to:

• identify likely employers;
• enrich company information;
• identify government legal entities;
• locate federal awards;
• reduce manual setup; and
• pre-populate customer records.

Operate and secure the Service

Including to:

• prevent unauthorized access;
• detect suspicious activity;
• monitor reliability;
• investigate security events;
• prevent fraud or abuse; and
• maintain logs.

Provide support

Including to:

• troubleshoot problems;
• respond to questions;
• investigate reported issues; and
• communicate about account activity.

Improve the Service

Including to:

• understand feature usage;
• improve workflows;
• measure onboarding performance;
• identify errors;
• improve reliability; and
• develop new functionality.

Communicate with users

Including to send:

• account notices;
• security alerts;
• product changes;
• service notifications;
• administrative communications; and
• where permitted, marketing communications.

Meet legal obligations

Including to:

• comply with applicable law;
• respond to lawful governmental requests;
• enforce contractual rights;
• investigate suspected unlawful activity; and
• establish or defend legal claims.

14. Artificial Intelligence and Automated Processing

The Service may use artificial intelligence, machine learning, language models, rules engines, or related technologies to assist with functions such as:

• contract-document extraction;
• data classification;
• entity matching;
• government-record matching;
• charge-code recommendations;
• anomaly detection;
• reconciliation;
• compliance analysis; and
• summarization.

Automated outputs may be inaccurate.

Where appropriate, material information is presented for human review or confirmation.

We do not represent that automated outputs constitute legal, accounting, audit, contractual, or governmental determinations.

15. AI Model Training

Intended policy, pending technical, contractual, and legal confirmation: We intend not to use private customer data, employee timesheets, uploaded contracts, or confidential customer documents to train generally available artificial-intelligence models without the customer's express authorization.

This intended restriction has not yet been confirmed against the production AI architecture or provider terms. It is not a confirmed technical or contractual commitment and must not be treated as a guarantee or published as final language until verified and approved by counsel.

Whether aggregated or de-identified information may be used for model training or other improvement purposes has also not been finalized. Add any permitted uses only after the production architecture and provider terms have been confirmed.

16. Third-Party AI Providers

We may use third-party artificial-intelligence providers to process information for specific Service functionality.

Where we do so, we seek to configure such providers consistent with our contractual and security obligations.

Information sent to an AI provider should be limited to what is reasonably necessary for the requested function.

A current list of material subprocessors may be maintained at:

[SUBPROCESSOR URL]

17. How We Disclose Personal Information

We do not sell personal information in the traditional sense of exchanging personal information for money.

We may disclose information in the following circumstances.

Service providers and subprocessors

We may disclose information to providers that help us operate the Service, including:

• cloud-hosting providers;
• database providers;
• authentication providers;
• email providers;
• analytics providers;
• monitoring providers;
• business-information providers;
• AI providers;
• customer-support platforms; and
• security providers.

These providers may process information only for permitted purposes and subject to applicable contractual restrictions.

18. Customer Organizations

If your account is associated with an organization, information concerning your use of the Service may be accessible to authorized administrators of that organization.

This may include:

• profile information;
• time records;
• audit activity;
• approval records;
• account activity; and
• other information associated with the organization's use of the Service.

Users should not expect information submitted through an employer-managed workspace to be private from authorized organizational administrators.

19. Integrations

If a customer enables an integration, we may transmit information to or receive information from the selected third-party service.

Examples may include:

• payroll providers;
• accounting systems;
• ERP platforms;
• identity providers;
• project-management systems; and
• other business applications.

Use of information by the third party is governed by its own privacy practices.

20. Legal Requirements

We may disclose information when we reasonably believe disclosure is necessary to:

• comply with applicable law;
• respond to a subpoena, court order, warrant, or other valid legal process;
• protect our rights;
• protect users;
• investigate fraud;
• investigate security threats; or
• prevent harm.

Where legally permitted and appropriate, we may notify affected customers before disclosing their information.

21. Corporate Transactions

If Company is involved in:

• a merger;
• acquisition;
• financing;
• reorganization;
• bankruptcy;
• sale of assets; or
• similar corporate transaction,

information may be transferred as part of that transaction.

Any successor will remain subject to applicable legal obligations regarding personal information.

22. Business-Information Providers

We may receive professional or business-related information from third-party data providers.

We do not control the original collection practices of those providers.

Where required, individuals may exercise applicable privacy rights concerning information we maintain by contacting us as described below.

23. Cookies and Similar Technologies

Our website or Service may use:

• cookies;
• local storage;
• session storage;
• tracking pixels;
• analytics technologies; and
• similar mechanisms.

These technologies may be used for:

• authentication;
• security;
• user preferences;
• session continuity;
• performance measurement;
• analytics; and
• product improvement.

We will describe material non-essential tracking practices in any applicable cookie notice or consent mechanism.

24. Analytics

We may use analytics services to understand how the Service is used.

Where practical, we seek to minimize unnecessary collection of personal information.

We may collect aggregated metrics such as:

• onboarding completion;
• feature usage;
• session duration;
• error rates;
• conversion events; and
• interface interactions.

25. Marketing Communications

We may send marketing communications to business users as permitted by applicable law.

Recipients may unsubscribe from marketing communications using the unsubscribe link or by contacting us.

Users may continue to receive transactional or administrative messages even after opting out of marketing.

26. Information Security

We use administrative, technical, and organizational safeguards designed to protect information appropriate to the nature of the Service.

Safeguards may include:

• encryption in transit;
• encryption at rest;
• access controls;
• authentication;
• logging;
• monitoring;
• least-privilege access;
• backups;
• vulnerability management; and
• security review.

No information system can be guaranteed to be completely secure.

Accordingly, we cannot guarantee absolute security.

Our security measures do not constitute government authorization, certification, or accreditation unless expressly stated in writing.

27. Security Incidents

If we become aware of a security incident involving personal information, we will investigate and take appropriate action.

Where applicable law or contract requires notification, we will provide notice in accordance with those obligations.

Security incidents may be reported to:

[SECURITY EMAIL]

28. Data Retention

We retain personal information for as long as reasonably necessary to:

• provide the Service;
• maintain customer accounts;
• maintain timekeeping or audit records;
• comply with customer instructions;
• satisfy contractual requirements;
• meet legal obligations;
• resolve disputes; and
• enforce agreements.

Different categories of information may have different retention periods.

Timekeeping, approval, and audit records may be retained for longer periods because government contractors may have regulatory or contractual record-retention obligations.

Customers are responsible for determining their required record-retention periods.

29. Account Termination

Following account termination, we may retain information for a limited period to:

• permit data export;
• maintain backups;
• comply with legal obligations;
• preserve security records; or
• resolve disputes.

Information may remain in backups until those backups expire according to our normal backup lifecycle.

30. Customer Data Export and Deletion

Authorized customers may be able to export information from the Service.

Requests concerning organizational records should generally be made by an authorized customer administrator.

We may decline or limit a deletion request where retention is required by:

• law;
• contract;
• audit requirements;
• legitimate security needs; or
• the rights of another party.

31. Privacy Rights

Depending on where you live, applicable law may provide rights concerning your personal information.

These may include the right to:

• know whether we process your information;
• access personal information;
• correct inaccurate information;
• request deletion;
• obtain a portable copy;
• restrict certain processing;
• object to certain processing;
• opt out of certain targeted advertising;
• opt out of certain uses considered “sale” or “sharing” under applicable law; and
• appeal certain privacy decisions.

Rights vary by jurisdiction and are subject to exceptions.

Requests may be submitted to:

[PRIVACY EMAIL]

We may need to verify your identity before fulfilling a request.

32. Employee and Contractor Requests

If we process your information solely on behalf of your employer or another customer organization, that organization may control the relevant personal information.

In that case, we may direct your request to the customer organization or assist the customer in responding.

For example, if you ask us to delete a government-contractor timesheet, we generally cannot independently delete it if your employer is legally required to retain that record.

33. U.S. State Privacy Rights

Residents of certain U.S. states may have additional rights under applicable state privacy laws.

Where applicable, those rights may include rights to:

• access;
• correction;
• deletion;
• portability;
• opt out of certain sales;
• opt out of certain sharing;
• opt out of targeted advertising; and
• limit certain uses of sensitive personal information.

We will not discriminate against an individual for exercising applicable privacy rights.

34. California Privacy Information

If applicable, California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Depending on our legal obligations and the nature of the information, California residents may have rights to:

• know categories of personal information collected;
• know sources of personal information;
• know purposes of collection;
• know categories of third parties receiving information;
• access specific information;
• correct inaccurate information;
• request deletion; and
• opt out of certain sales or sharing.

We do not sell personal information for monetary consideration.

If we engage in activity considered “sharing” or “sale” under California law, we will provide the required opt-out mechanisms.

Employee information processed on behalf of customer organizations may be subject to different obligations depending on our role.

35. Sensitive Personal Information

The Service is not intended to require highly sensitive personal information such as:

• Social Security numbers;
• biometric identifiers used for identification;
• precise geolocation;
• health information;
• personal financial-account credentials; or
• government security credentials.

Users should not submit sensitive information that is not necessary for the Service.

If sensitive information is required for future functionality, this Privacy Policy and associated controls will be updated as appropriate.

36. International Users

The Service may be operated from the United States.

If individuals access the Service from outside the United States, their information may be transferred to and processed in the United States or other jurisdictions where our providers operate.

Where required, we will use appropriate mechanisms for international data transfers.

37. European Economic Area, United Kingdom, and Switzerland

If applicable, individuals in the European Economic Area, United Kingdom, or Switzerland may have rights under applicable data-protection laws.

Depending on the circumstances, our legal bases for processing may include:

• performance of a contract;
• legitimate interests;
• compliance with legal obligations; and
• consent.

Individuals may have rights to:

• access;
• correction;
• deletion;
• restriction;
• portability;
• objection; and
• withdrawal of consent.

They may also have the right to lodge a complaint with an applicable supervisory authority.

For employee information processed on behalf of a customer, the customer may be the relevant controller.

38. Children's Privacy

The Service is intended for business and professional use.

It is not directed to children under 16.

We do not knowingly collect personal information directly from children for independent consumer purposes.

If we learn that personal information from a child has been collected inappropriately, we will take appropriate steps.

39. Do Not Track

Some browsers provide “Do Not Track” signals.

Because there is no universally accepted standard governing such signals, our response may vary.

Where applicable law requires recognition of browser-based privacy preference signals, we will comply with those requirements.

40. Automated Decision-Making

The Service may use automated systems to:

• suggest company matches;
• suggest government-entity matches;
• identify possible awards;
• classify records;
• identify anomalies; and
• generate recommendations.

We do not intend automated systems by themselves to make employment decisions, determine eligibility for government awards, determine employee compensation, or make legally binding decisions about individuals.

Customers are responsible for reviewing automated recommendations before taking material action.

41. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we make material changes, we may provide notice through:

• the Service;
• email;
• our website; or
• another appropriate method.

The “Last Updated” date above indicates when this Privacy Policy was most recently revised.

42. Contact Us

Privacy questions or requests may be directed to:

[LEGAL COMPANY NAME]
[ADDRESS]

Privacy: [PRIVACY EMAIL]
Security: [SECURITY EMAIL]
General support: [SUPPORT EMAIL]