Privacy Policy

1. Our two roles

For information we collect to run our own business, such as website visits, contact form messages, account registration, billing, and support, Scaled decides how the information is used and is responsible for it under this policy.

For information a Customer and its Users put into their workspace ("Customer Data"), such as staff schedules, time clock records, pay rates, orders, client details, and recipes, Scaled acts as a service provider to the Customer. We process Customer Data only to provide the Service to that Customer, on its instructions and under our Terms of Service. If you work for, or are a client of, a business that uses Scaled, please direct privacy questions and requests about that data to the business. We will help the business respond.

2. Information we collect

Depending on how the Service is used, we collect the following categories of information.

• Account and profile information: name, email address, phone number, password (stored only as a one-way hash), profile photo, preferred language, timezone, notification preferences, and the roles, permissions, and locations assigned to each User.
• Company information: company and location names, the workspace subdomain, addresses, logo, and brand colors.
• Workforce information entered by a Customer: shifts and schedules, availability, time-off requests, shift swaps and pickups, clock-in and clock-out times and breaks, roles and hourly pay rates, tips, reimbursements and deductions, and payroll runs.
• Operations information entered by a Customer: orders and order notes, the Customer's catering clients and their contact details, delivery addresses and allergy notes, menu items, recipes, ingredients, prep lists, grocery lists, equipment, labels, and uploaded images and files.
• Billing information: subscription plan, billing period, invoices, and payment history. Card details are entered directly with our payment processor, Stripe. We receive only limited details such as the card brand, last four digits, and expiry date, and we never see or store full card numbers.
• Communications: messages sent through our contact form (with the sender's IP address and browser details), support tickets, and our replies.
• Payroll connection information: when a Customer connects QuickBooks or Square, the access credentials those services issue (stored encrypted), the account and location identifiers needed to send hours and pay data to them, and the names, email addresses, and identifiers of the employees or team members listed in the connected service, which we read so they can be matched to Users.
• Technical and security information: IP address, browser and device type, sign-in times, a device identifier used to recognize known devices, and an activity log that records sign-in attempts (including the email address entered, IP address, and device details) and changes made in a workspace, collected automatically when the Service is used.

3. How we use information

• To provide the Service: running each workspace, showing information to the Users the Customer has given access to, sending the notifications Users rely on, and exporting hours and pay data to payroll services the Customer connects.
• To create and secure accounts: verifying email addresses, resetting passwords, alerting Users to sign-ins from new devices, and detecting and preventing fraud, abuse, and security incidents.
• To process subscriptions and payments, and to send billing notices such as trial reminders, receipts, and failed-payment alerts.
• To respond to questions, contact form messages, and support requests.
• To maintain and improve the Service, including diagnosing errors from our server and activity logs.
• To comply with law, enforce our Terms of Service, and protect the rights, safety, and property of Scaled, our Customers, and others.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use Customer Data to build advertising profiles.

4. Text messages (SMS)

Scaled runs one text message program, "Scaled work notifications". It sends work-related messages to Users on behalf of the Customer they work for, and works as follows.

• Messages: shift reminders, clock-in and clock-out reminders, links to the time clock, schedule published and schedule changed notices, shift coverage, give-up, and pick-up requests and their outcomes, assignments to orders and events and changes or cancellations of them, day-before event briefings, staffing alerts to managers, time-off updates, and replies to support tickets. We do not send marketing or promotional text messages.
• Sender: every message begins with "Scaled".
• How Users opt in: a User's mobile number is added to the Service by the User or by their employer. Under our Terms of Service, an employer who adds a number confirms that the User has agreed to receive these work notifications by text. Agreeing to receive text messages is not a condition of purchasing or using the Service.
• Frequency: varies with the User's schedule and activity.
• Cost: message and data rates may apply, according to the User's mobile plan.
• Opting out: reply STOP to any message to stop all text messages from Scaled, including clock-in and clock-out reminders. Reply START to receive them again. Users can also choose in their notification settings which messages they receive and whether by text or email. Clock-in and clock-out reminders are sent even when a User turns other notifications off in the app, because a missed punch affects pay, but replying STOP still stops them by text.
• Help: reply HELP, or email contact@scaledprep.com. Carriers are not liable for delayed or undelivered messages.

Mobile phone numbers, text messaging opt-in data, and consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes. To deliver the messages described above, phone numbers are sent to our messaging provider, Twilio. Otherwise they are handled like other personal information, as described in "How we share information".

5. Email

The Service sends account, security, billing, and operational emails, such as invitations, password resets, schedules, order confirmations to a Customer's clients, and shared recipes. These are part of the Service. We do not currently send marketing emails. If we do in future, each will include a way to unsubscribe, and unsubscribing will not stop the operational emails the Service depends on.

6. Automated recipe parsing

When a User imports or types a recipe, the Service can send the recipe's ingredient text to OpenAI to separate it into quantities, units, and ingredients. Only the recipe text needed for this is sent, not names, contact details, or workforce information. The result is shown to the User to review and correct before it is saved. OpenAI processes this text as our service provider under its API terms.

7. Categories of personal information

For California residents and residents of other states with similar laws: in the past 12 months we have collected the categories of personal information below. We collect them from the people who use the Service, from the Customer they work for, from the devices and browsers used to access the Service, and from payment and payroll services a Customer connects. We use each category for the purposes in "How we use information", disclose it only to the recipients in "How we share information", and keep it as described in "Data retention".

• Identifiers: name, email address, phone number, IP address, device identifier, and account username.
• Customer records: contact details, addresses, and limited payment details such as card brand and last four digits.
• Commercial information: subscription plan, invoices, and payment history.
• Internet and network activity: sign-in times, device and browser type, and actions recorded in the activity log.
• Professional or employment-related information: roles, locations, schedules, time clock records, pay rates, tips, reimbursements, deductions, and payroll runs.
• Sensitive personal information: account sign-in credentials (email address and password). We use these only to authenticate Users and keep accounts secure, never to infer characteristics about anyone.
• Other information Users choose to provide, such as profile photos, order notes, client allergy notes, and support messages.

We do not sell any of these categories or share them for cross-context behavioral advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Where we hold information in de-identified form, we keep it in that form, do not try to re-identify it, and require anyone we share it with to do the same.

8. How we share information

We share personal information only as follows.

• Within the Customer's workspace: Users see information according to the roles and permissions the Customer sets. For example, managers can see the schedules and time records of staff at their locations.
• Through links that work without signing in: a recipe a User chooses to share publicly, and the time clock link sent to a User by text or email. Anyone who has such a link can open it. A clock link shows the User's name, role, photo, company, location, and shift, and lets the holder clock that User in or out until the link expires 48 hours after it is sent. A shared recipe link shows the recipe until the User stops sharing it.
• With Scaled personnel, who can see account, user list, subscription, billing, and support ticket information as needed to run and support the Service. They do not sign in to workspaces as Users.
• With service providers that operate the Service for us, under contracts that limit their use of the information to providing services to us: Amazon Web Services (hosting, storage, and email delivery), Stripe (payments, including fraud prevention on the billing page), Twilio (text messages), and OpenAI (recipe parsing).
• With Google, when the platform loads its fonts from Google Fonts. Google receives the browser's IP address and basic browser details under its own privacy policy. See "Cookies and similar technologies".
• With services a Customer chooses to connect, such as QuickBooks (Intuit) or Square for payroll. Information sent to them is governed by their own terms and privacy policies. A Customer can disconnect them at any time.
• For legal reasons: when we believe in good faith that disclosure is required by law, subpoena, or other legal process, or is necessary to protect the rights, safety, or property of Scaled, our Customers, or others.
• In a business transfer: if Scaled is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With consent or at the direction of the Customer.

9. Cookies and similar technologies

We use the cookies and browser storage needed for the Service to work: a cookie that keeps a User signed in, a cookie that recognizes a device that has signed in before (used to alert Users to new-device sign-ins), and browser storage that remembers preferences such as language. On the billing page where a payment card is added, the platform loads Stripe's payment form, which sets its own cookies and collects device and browser information for fraud prevention and payment security, under Stripe's privacy policy. Apart from this, neither the website nor the platform uses analytics, advertising, or third-party tracking cookies. The marketing website serves its fonts from our own servers. The platform loads its typefaces, including the fonts offered for printed labels, from Google Fonts, so Google receives the browser's IP address and basic browser details when those fonts load.

Browsers can be set to block cookies, but signing in to the Service will not work without them. Because we do not sell or share personal information for advertising, there is nothing for a Global Privacy Control or "Do Not Track" signal to opt out of. If that changes, we will honor those signals and update this policy first.

10. Data retention

We keep each kind of information only as long as it is needed for the purposes in this policy, using these criteria:

• Account, profile, and Customer Data: for as long as the Customer's account exists, or until the Customer asks us to delete it as described below.
• Billing records such as invoices and payment history: for as long as tax and accounting laws require, even after an account is deleted.
• Contact form messages and support tickets: for as long as needed to respond and keep a record of the conversation.
• Security and technical logs: for as long as needed to secure the Service and investigate incidents.
• Backups: our database backups are kept for 14 days and then deleted automatically.

If a subscription is canceled, the company is deactivated, or a trial ends without a subscription, the workspace is locked but its data is kept, so the Customer can reactivate without losing its records. A Customer's owner can ask us at any time to permanently delete the company and its records by contacting us. Deletion removes the company's records from the live Service and disconnects any payroll connections. Uploaded files, such as logos and images, are no longer available through the Service but may remain in our storage for a time. Copies of database records in backups are removed when those backups expire, within 14 days. Billing records held by our payment processor, and messages sent to us through the contact form, are kept as described above.

When a Customer removes a User, that person can no longer sign in, but records they are part of, such as past shifts, time records, and payroll, remain in the Customer's workspace because the Customer needs them for its own business and legal records. We may also keep limited information, such as invoices and payment records, for as long as needed to meet tax, accounting, and legal obligations, resolve disputes, and enforce our agreements.

11. Security

We use administrative, technical, and organizational measures designed to protect personal information. These include encryption of data in transit, encryption of payroll connection credentials, one-way hashing of passwords, role-based access controls, audit logs of changes, and hosting on Amazon Web Services. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we learn of a security breach affecting personal information, we will notify affected Customers and individuals as required by law.

Images and files uploaded to the Service, such as profile photos, logos, label and email images, and support ticket attachments, are stored at web addresses that are hard to guess but do not require signing in. Anyone who has the address can open the file, so files containing sensitive information should not be uploaded.

12. Privacy rights

Depending on the state you live in, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with consumer privacy laws, you may have the right to:

• know what personal information we collect, use, and disclose, and receive a copy of it in a portable format;
• correct inaccurate personal information;
• delete personal information, subject to legal exceptions;
• opt out of the sale or sharing of personal information, targeted advertising, and profiling (we do none of these);
• limit the use of sensitive personal information (we use it only to provide the Service); and
• not be discriminated against for exercising any of these rights.

To make a request, email contact@scaledprep.com. We will verify the request by confirming it with the email address on the account, or by matching details provided with the request to our records, respond within 45 days (or the period your state requires), and explain any part we cannot fulfill. An authorized agent may make a request on your behalf with your signed permission. If we decline a request, we will explain why and how to appeal. To appeal, reply to our decision. We will respond in writing within 60 days with the reasons for our decision, and if the appeal is denied you may contact your state attorney general.

If your information is Customer Data, for example as an employee or catering client of a business that uses Scaled, please send your request to that business. If you contact us directly, we will forward it to the business or refer you to it.

California residents may also ask, once a year, whether we disclosed personal information to third parties for their direct marketing purposes. We do not.

13. Children

The Service is designed for businesses and is not directed to children. We do not knowingly collect personal information from children under 13. Company accounts may be created only by adults with authority to act for the business. Where a Customer employs minors as the law allows, the Customer is responsible for any notices and consents the law requires for them. If we learn that we have collected personal information from a child under 13, we will delete it.

14. Where information is stored

Scaled is based in the United States, and the Service is hosted in the United States. If the Service is used from outside the United States, information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in the user's country.

15. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page shows when it was last changed. If we make material changes, we will notify Customers by email or in the Service before the changes take effect.

16. Contact us

Questions about this Privacy Policy or our privacy practices can be sent to contact@scaledprep.com.