Privacy Policy

SANDOVAL STONEWORK & MASONRY — PRIVACY POLICY Effective date: August 1, 2026 This Privacy Policy explains what information the Sandoval Stonework & Masonry platform (the "Service") collects, how it is used, and the choices you have. It covers customers and portal users, workers and staff, and job applicants in the United States. 1. INFORMATION WE COLLECT (a) Account information: name, email address, password (stored only as a cryptographic hash), and optional phone number and profile photo. (b) Customer records: contact details, service addresses, quotes, invoices, payments, and messages you exchange with us. (c) Payment information: processed by Stripe, Inc. WE NEVER RECEIVE OR STORE FULL CARD NUMBERS, CVC CODES, OR ONLINE BANKING CREDENTIALS. We retain only the amount, date, status, and a processor reference for each payment. (d) Worker employment data: role, hourly rate, timesheets, payout records, training records, and — for direct-deposit setup — bank routing and account numbers, which are ENCRYPTED AT REST (AES-256-GCM) and viewable in full only by authorized payroll managers after step-up authentication; screens otherwise show only the last four digits. (e) Worker location data: clock-in/clock-out coordinates and periodic on-shift geofence checks while the worker app is open, used to verify presence at the assigned worksite. Location is not collected off the clock. (f) Applicant data: application answers, resume and cover letter, and voluntary EEO demographic disclosures, which are stored separately from hiring screens and used only as permitted by law. (g) Technical data: IP address, timestamps, and security logs (sign-ins, permission changes, and administrative actions are recorded in an audit trail). 2. HOW WE USE INFORMATION To provide the Service: scheduling, quoting, invoicing, messaging, payroll, and hiring. To secure the Service: authentication (including multi-factor), fraud and abuse prevention, and audit logging. To communicate: transactional emails such as quote and invoice notifications, application updates, and time-clock alerts. To comply with legal obligations, including tax, employment, and equal-opportunity reporting. We do NOT sell personal information, and we do not use it for third-party advertising. 3. HOW INFORMATION IS SHARED (a) Service providers (processors) who host and operate the platform: cloud infrastructure (Microsoft Azure), payment processing (Stripe), and email delivery. They may use your information only to provide their services to us. (b) Within your organization: information is visible according to role-based permissions (for example, payroll managers can see timesheets; workers see their own records). (c) Legal: we may disclose information to comply with law, enforce our terms, or protect rights, safety, and property. (d) Business transfers: if the business is sold or reorganized, records may transfer as part of that transaction under this policy's protections. 4. SECURITY We use industry-standard safeguards: encrypted connections (HTTPS/TLS), encrypted storage of secrets and bank details, hashed passwords, role-based access control on every query, organization-level data isolation, rate limiting, session expiry with idle timeout, optional multi-factor authentication (required for sensitive payroll operations), and an append-only audit log of administrative actions. No system is perfectly secure; we will notify affected users of a data breach as required by applicable state breach-notification laws, including Conn. Gen. Stat. § 36a-701b. 5. RETENTION We keep records only as long as needed for the purposes above and to meet legal obligations: employment and payroll records per federal and state recordkeeping requirements; invoices and payment records per tax law; application records for the period required by equal-opportunity regulations. When no longer required, records are deleted or de-identified. 6. YOUR CHOICES AND RIGHTS You may review and update your account information in the app. You may request a copy of, or the deletion of, your personal information, subject to records we must keep by law (for example, payroll and tax records). Workers may view their own timesheets and payout history at any time. Applicants may withdraw an application at any time. Depending on your state of residence, you may have additional rights (such as access, correction, deletion, and portability) under state privacy laws, including the Connecticut Data Privacy Act; we honor such requests as required. To exercise any right, contact us through the portal or your manager; we will verify your identity before acting and respond within the time required by law. We do not discriminate against anyone for exercising privacy rights. 7. LOCATION DATA CONSENT (WORKERS) Worker location collection happens only: (a) at the moment of clock-in and clock-out, and (b) periodically during an active shift while the worker app is open, to confirm presence within the assigned worksite geofence. The app's copy states this at the point of collection, and the device's operating system separately asks for location permission. Declining location prevents clock-in but has no other effect on your account. 8. CHILDREN The Service is for business use and is not directed to children under 16. We do not knowingly collect information from children. 9. CHANGES TO THIS POLICY We may update this policy; the current version and effective date are always available at /privacy in the app. Material changes will be announced in the Service, and workers may be asked to acknowledge the updated version. 10. CONTACT Privacy questions or requests: contact Sandoval Stonework & Masonry through your portal, your manager, or the contact information on our website.