1. Introduction

Scribta, Inc. ("Scribta," "we," "us," or "our") respects privacy and is committed to protecting personal information processed through our website and cloud-based workforce management platform (collectively, the "Services").

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when the Services are used by Customers and their Authorized Users, as defined in our Terms of Service.

2. Roles and Responsibilities

For purposes of data protection laws:

Customers (employers or organizations) are the Data Controllers of personal information submitted to the Services.
Scribta acts as a Data Processor, processing personal information solely on the Customer's behalf and in accordance with the Customer's instructions.
Authorized Users (employees, contractors, viewers) are data subjects, not customers of Scribta.

Questions regarding how employee data is collected, used, or retained should be directed to the Customer (employer).

3. Information We Collect

3.1 Information Provided by Customers or Authorized Users

Account Information: Name, email address, phone number, company name, role
Employee Data: Names, work hours, job assignments, labor rates, time-off requests
Payment Information: Billing details processed by Stripe (Scribta does not store card numbers)
Communications: Support requests, feedback, and correspondence

3.2 Information Collected Automatically

Device Information: IP address, browser type, operating system
Usage Data: Pages viewed, features used, session activity
Log Data: Authentication logs, error logs, access timestamps
Approximate Location: Derived from IP address

3.3 Cookies and Tracking Technologies

We use cookies and similar technologies for:

Authentication and session management
Security and fraud prevention
Analytics and performance optimization

Cookies may be essential, functional, or analytical. Disabling cookies may affect functionality.

3.4 Product Analytics via PostHog

We use PostHog, a product analytics platform, to understand how users interact with our Services. PostHog helps us track:

Page views and navigation patterns
Feature usage and adoption
User journeys and conversion funnels
Technical performance and errors

PostHog Cookies: PostHog uses cookies and local storage to track sessions and user behavior. PostHog processes data anonymously where possible and does not use personal data for third-party advertising.

Opt-Out: You can opt out of PostHog analytics by:

Using your browser's "Do Not Track" setting
Declining analytics consent when prompted on our website
Visiting PostHog's privacy controls at posthog.com/privacy

4. How We Use Information

We process personal information to:

Provide, operate, and maintain the Services
Authenticate users and manage access
Process payments and subscriptions
Provide customer support
Monitor usage and system performance
Detect and prevent fraud or abuse
Comply with legal obligations

5. How We Share Information

We do not sell personal information.

5.1 Service Providers (Subprocessors)

We may share information with trusted subprocessors, including:

Google Cloud Platform / Firebase – hosting and authentication
Stripe, Inc. – payment processing
Postmark – transactional email delivery
Infobip – SMS notifications and delivery
Analytics providers – anonymized usage analytics

5.2 Legal Obligations

Information may be disclosed if required by law, subpoena, court order, or governmental request.

5.3 Business Transfers

In the event of a merger, acquisition, or asset sale, information may be transferred as part of the transaction.

6. Data Retention

We retain information only as long as necessary for legitimate business and legal purposes.

Typical retention periods include:

Account Data: Until account deletion + 30 days
Timesheet and Payroll Records: Up to 7 years (legal/tax requirements)
Payment Records: Up to 7 years
Log Data: Up to 90 days
Analytics Data: Up to 26 months (aggregated or anonymized)

7. Data Security

We implement reasonable technical and organizational safeguards, including:

Encryption in transit and at rest
Access controls and role-based permissions
Secure authentication mechanisms
Infrastructure security policies

We maintain internal policies and procedures designed to support the confidentiality, integrity, and availability of the Services.

No system is completely secure. We cannot guarantee absolute security.

8. International Data Transfers

Information may be processed in the United States or other jurisdictions where Scribta or its subprocessors operate.

For transfers from the EEA, UK, or Switzerland, we rely on:

Standard Contractual Clauses (SCCs)
Approved compliance frameworks of subprocessors

9. Communications and SMS Notifications

9.1 Communication Types

We communicate with Customers and Authorized Users through:

Transactional emails: password resets, account confirmations
SMS notifications: timesheet reminders, job alerts, approvals
Email notifications: account updates, support responses

9.2 SMS Service

Scribta uses SMS to send work-related notifications including timesheet reminders, job alerts, and approval updates. SMS is sent via Infobip.

9.3 SMS Consent

Users must provide explicit consent to receive SMS notifications. Consent is obtained via an opt-in checkbox during profile completion. Users are not automatically enrolled in SMS; they must affirmatively consent.

9.4 Message Frequency and Costs

Message frequency varies based on work activity. Standard message and data rates may apply. Users are responsible for any charges from their mobile carrier.

9.5 SMS Opt-Out

Users may opt out of SMS notifications at any time by:

Texting STOP to the SMS sender number
Disabling SMS in account settings
Contacting their account administrator

We will honor opt-out requests within 1 business day.

9.6 SMS Data

SMS phone numbers and consent records are processed and retained in accordance with Section 6 (Data Retention) of this Privacy Policy. SMS messages may be logged for delivery confirmation and compliance.

10. Privacy Rights

10.1 Authorized Users (Employees)

Authorized Users should direct privacy requests (access, correction, deletion) to their employer. Scribta will assist the Customer in fulfilling such requests as required by law.

10.2 Customers (Account Owners)

Customers may request:

Access to personal information
Correction or deletion of data
Export of account data
Restriction of processing

10.3 EEA Residents (GDPR)

Where applicable, data subjects have rights under GDPR. Requests should be submitted through the Customer or directed to Scribta where legally required.

10.4 California and U.S. State Privacy Rights

We do not sell personal information. California and other U.S. residents may exercise applicable rights by visiting our Contact page.

11. Children's Privacy

The Services are not intended for individuals under 16 years of age (or under 13 in the United States). We do not knowingly collect personal information from children.

12. Third-Party Links

The Services may link to third-party websites. Scribta is not responsible for their privacy practices.

13. Do Not Track Signals

The Services do not respond to browser "Do Not Track" signals.

14. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated through the Services or via email.

15. Aggregated and Anonymized Data

We may create aggregated or anonymized data that does not identify individuals. This data may be used for analytics, benchmarking, security, and product improvement.

16. Contact Information

For privacy inquiries, support requests, or to exercise your rights, please visit our Contact page.

We respond to requests within legally required timeframes.