Privacy policy

HoursAI LLC, a Colorado limited liability company ("Company," "we," "us," or "our"), operates the Hours AI workforce scheduling platform ("Service"). This Privacy Policy describes how we collect, use, share, and protect information when you use the Service.

Most information in the Service is about employees and is provided by their employer. For that information the employer is the data controller and HoursAI LLC acts as a processor, handling it only on the employer's documented instructions. Where we decide how and why information is used — for example account and billing records for the person who signs up — we act as the controller.

1. Information We Collect

• Account information. Name, email address, phone number, company name, and password (stored hashed).
• Employee data you upload. Information about employees you add to your organization, including names, contact details, role, pay rate, availability, preferences, and time-off requests.
• Scheduling data. Schedules, shifts, swaps, attendance records, location, and timestamps created by use of the Service.
• Billing information. Subscription and payment metadata. Card details are collected directly by our payment processor and are not stored on our servers.
• Usage and device data. Log data such as IP address, browser/device type, pages visited, and interactions, used to operate and secure the Service.
• Mobile data. If you use the mobile app, we may collect device identifiers, push notification tokens, and (with your permission) approximate location for clock-in geofencing.

2. How We Use Information

• Provide, operate, secure, and improve the Service.
• Generate AI-assisted schedules and other automated recommendations based on the data you provide.
• Send transactional communications (account, billing, and Service-related notices).
• Process payments and manage subscriptions.
• Respond to support requests and feedback.
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms.
• Comply with legal obligations and enforce our agreements.

3. Data Sharing and Subprocessors

We do not sell personal information. We share information only as needed to operate the Service, with the following subprocessors:

• Supabase — application database, file storage, and authentication.
• Stripe — payment processing and subscription billing.
• OpenAI — large language model inference used to generate scheduling recommendations and assistant responses. Inputs are not used to train provider models.
• Resend — transactional email delivery.
• Twilio— SMS delivery, where a customer has SMS notifications enabled. SMS is disabled by default and no message data is sent to Twilio unless it is turned on.
• Expo — push notification delivery for the mobile app.
• Vercel — application hosting.
• Sentry— crash and error reporting.
• Upstash— rate limiting. Stores short-lived request counters keyed to an account or network address to protect the Service from abuse.

We may also disclose information when required by law, in response to lawful requests by public authorities, to protect our rights or those of users, or in connection with a merger, acquisition, or sale of assets.

4. Third-Party Systems You Connect

You may choose to connect the Service to a point-of-sale or payroll system you already use. Connecting is always initiated by you, and the connection can be removed at any time from your integration settings. We request the narrowest access each provider offers for the features described below.

• Point-of-sale systems (for example Clover or Square). We read completed order and payment totals with their timestamps, your business name, address and time zone, and your employee list and their clock-in and clock-out times. We use this to show labor cost against actual sales, to forecast staffing demand, and to reconcile scheduled hours against hours worked. We do not read or store guest details, card numbers, or individual line items from orders.
• Payroll systems (for example Gusto). We read your employee list, job assignments, pay rates and pay periods, and we write the hours and tips you have already approved into a payroll draft that you review and submit yourself. We never submit or run payroll.

Access credentials for connected systems are encrypted before storage. When you disconnect a system, its credentials are deleted and no further data is retrieved. Records already used to produce your historical reporting are retained under Section 5 below unless you ask us to delete them.

5. Data Retention

We retain personal information for the duration of your account and for a reasonable period thereafter to allow export, billing reconciliation, and dispute resolution. We may retain certain records for longer as required by law (for example, tax and payroll-adjacent records). Aggregated or de-identified data may be retained indefinitely.

6. Your Rights

Depending on where you live, you may have rights under laws such as the California Consumer Privacy Act (CCPA) and the European Union General Data Protection Regulation (GDPR), including:

• Access to the personal information we hold about you.
• Correction of inaccurate or incomplete information.
• Deletion of personal information, subject to exceptions.
• Portability — receive a copy of your data in a structured, machine-readable format.
• Objection to or restriction of certain processing activities.
• Withdrawal of consent where processing is based on consent.
• The right to lodge a complaint with a supervisory authority.

Where Hours AI processes personal information on behalf of an employer (for example, employee scheduling data uploaded by a manager), employees should direct requests to their employer first; we will assist the employer in responding.

To exercise your rights, contact support@hours-ai.com.

7. Cookies and Similar Technologies

We use cookies and similar local-storage technologies that are strictly necessary to operate the Service (for example, authentication session cookies) and functional cookies that remember your preferences (for example, your selected location). We do not use third-party advertising or cross-site tracking cookies. You may control cookies through your browser settings; doing so may affect Service functionality.

8. Security

We use commercially reasonable administrative, technical, and organizational safeguards to protect personal information. These include encryption in transit using TLS, encryption of the database at rest, additional AES-256-GCM encryption of the access credentials for any third-party system you connect, row-level security policies that isolate each organization's data, least-privilege access controls, and multi-factor authentication on the systems we use to administer the Service. No system is perfectly secure, and we cannot guarantee absolute security.

9. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal information directly from anyone under 13. If you believe a child has provided personal information, please contact us so we can investigate and delete the information as appropriate.

Employers in shift-based industries may employ minors. Where an employer adds an employee under 18 to their account, that information is provided by the employer in its role as controller, and the employer is responsible for any consent or notice required by applicable employment and privacy law.

10. International Transfers

The Service is operated from the United States. If you access it from outside the United States, your information will be transferred to and processed in the United States and other countries where our subprocessors operate. We rely on recognized transfer mechanisms (such as Standard Contractual Clauses) where required by applicable law.

11. Updates to this Policy

We may update this Privacy Policy from time to time. If we make a material change, we will provide notice through the Service or by email. The "Last updated" date at the top of this page reflects the most recent version.

12. Contact

Questions about this Privacy Policy can be sent to support@hours-ai.com.