Privacy Policy

This Privacy Policy describes how Susy LLC ("Susy," "we," "us," or "our") collects, uses, and shares information when you use the Susy mobile application (the "App"), our website at susy.com (the "Site"), and related services (together, the "Service"). The Susy App is published in the Apple App Store and on Google Play by Susy LLC, as it appears in the store listings.

Who this Policy covers. This Policy applies to owners and managers who set up a Susy workspace for a restaurant or other business (a "Customer"); workers who join a Customer's workspace (a "Staff User"); and visitors to the Site. We refer to Customers' managers and Staff Users together as "Users."

Your employer's role. Much of the information in Susy is entered and controlled by your employer. Your employer decides who is on the roster, what the schedule is, and who can see it. We process that information on your employer's behalf in order to provide the Service, and your employer is responsible for its own use of your information and for any notices or consents the law requires it to give or obtain. If you have questions about how your employer uses your information or want to see or correct schedule records your employer keeps, contact your employer. This Policy does not describe your employer's own privacy practices.

Relationship to our Terms. Use of the Service is also governed by our Terms of Service at susy.com/terms.

Information you provide to us:

• Account and profile information: your name, phone number, email address, password or other sign-in credentials, job role (for example, front of house, kitchen, or bar), and an optional profile photo.
• Business information (managers): the business name, location address, time zone, and workspace settings.
• Scheduling activity: your availability, time-off requests, responses to shifts (accept, decline, swap, or drop), tasks and checklists you complete, and notes or messages you send within the App.
• Support and other communications: information you include when you contact us or respond to a survey.

Information your employer or manager provides about you:

• When a manager invites you to a workspace, the manager enters your name, phone number, email address, and role so that we can send you an invitation and set up your profile. Managers also enter your scheduled shifts, assignments, and tasks.

Information we collect automatically when you use the Service:

• Device and app information: device type and model, operating system and version, app version, language, time zone, and device identifiers such as a push notification token and an app instance identifier.
• Usage and log information: the actions you take in the App, screens viewed, features used, timestamps, and your IP address, from which we may derive an approximate (city-level) location.
• Diagnostic information: crash reports and performance data.
• Website information: the Site may use cookies or similar technologies for basic operation and to measure traffic. You can control cookies through your browser settings.

What we do not collect. We do not collect precise GPS location, your contacts, your photos, biometric information, financial account information, Social Security numbers, or government identification numbers. If we add a feature that requires new types of information, we will update this Policy and request any permission the law or the app stores require before collecting it.

We use the information described above to:

• Provide and operate the Service: create and manage accounts and workspaces, build and display schedules, deliver shifts and tasks, enable shift responses and swaps, and sync information across devices.
• Communicate with you about the Service: send workspace invitations, shift and schedule notifications, reminders, and service announcements by text message, email, push notification, and in-app message.
• Provide support: respond to your questions and troubleshoot problems.
• Keep the Service safe and secure: authenticate Users, detect and prevent fraud, abuse, and security incidents, enforce our Terms of Service, and protect the rights and safety of Susy, our Users, and others.
• Improve and develop the Service: understand how the Service is used, fix bugs, measure performance, and build new features. We use aggregated or de-identified information for these purposes where practical.
• Comply with law: meet legal obligations, respond to lawful requests from public authorities, and establish, exercise, or defend legal claims.
• Other purposes with your consent: any other purpose we describe to you at the time we collect the information.

We do not use your personal information for targeted advertising, and we do not use information collected for one purpose for an unrelated purpose without first telling you and, where required, obtaining your consent.

Push notifications. You control push notifications in your device settings and can turn them off at any time. Push notifications are not required to use the Service. We will not send promotional push notifications unless you opt in, and you can opt out in the App or in your device settings.

Email. We send account, security, and service emails that are necessary to operate the Service. If we send marketing emails, each one will include an unsubscribe link, and opting out of marketing emails will not stop account or service emails.

We share personal information only as described below.

• With your employer and coworkers. Your employer's managers can see your name, phone number, email address, role, availability, shift responses, and task activity. Coworkers in the same workspace can see your name, role, profile photo (if you add one), and scheduled shifts so the team can coordinate coverage.
• With service providers. We share information with companies that help us operate the Service and that are contractually required to use it only to provide services to us and to protect it in a manner consistent with this Policy: cloud hosting and data storage, text message delivery, email delivery, push notification delivery (through Apple and Google), crash reporting and performance analytics, and customer support tools. We require each of these providers to provide at least the same level of protection for your information as this Policy describes.
• With affiliates. We may share information with companies under common ownership or control with Susy, which must treat it in accordance with this Policy.
• For legal reasons and safety. We may share information to comply with law, regulation, legal process, or a governmental request; to enforce our Terms of Service; or to protect the rights, property, or safety of Susy, our Users, or the public.
• In a business transfer. If Susy is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its business, your information may be transferred as part of that transaction, subject to this Policy, and we will give notice as required by law.
• With your consent or at your direction.
• Aggregated or de-identified information that cannot reasonably be used to identify you.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral or targeted advertising. We do not include third-party advertising networks in the App. We do not share your personal information with third-party artificial intelligence services. If that changes, we will update this Policy and ask for your permission where required.

We keep personal information for as long as your account is active and as needed to provide the Service to you and your employer. After you delete your account, we delete or de-identify the personal information associated with it within 30 days, subject to the following exceptions:

• Backups. Information may remain in encrypted backups for up to 90 additional days before it is overwritten and is not used for any other purpose in the meantime.
• Your employer's business records. Schedules and shift histories are your employer's business records. When you delete your account, your name may remain on historical schedules in your employer's workspace for the period your employer retains them.
• Legal and safety retention. We may retain information where required by law, to resolve disputes, to enforce our agreements, or to prevent fraud and abuse. We keep records of your text-message opt-in and opt-out choices so that we can honor them.
• Aggregated or de-identified information may be retained indefinitely.

When a Customer deletes its workspace, we delete the workspace and its contents on the same schedule.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption of information in transit (HTTPS/TLS), encryption of stored information, access controls that limit who at Susy and its service providers can reach your information, and logging of access. No system is completely secure, and we cannot guarantee that your information will never be accessed, disclosed, altered, or destroyed without authorization. Keep your password confidential and contact us at support@susy.com immediately if you believe your account has been compromised.

• Access and correction. You can view and edit your profile information in the App at any time. Schedule and shift information controlled by your employer should be corrected through your employer.
• Deletion. You can delete your account as described in Section 9.
• Communication preferences. Reply STOP to opt out of text messages, adjust push notifications in your device settings, and use the unsubscribe link in any marketing email. We may still send you account, security, and legal notices.
• Device permissions. You can revoke permissions the App has requested (for example, notifications, or camera access for a profile photo) in your device settings. Some features will not work without the permissions they need.
• Withdrawing consent. You may withdraw your consent to our collection and use of your information at any time by revoking device permissions, opting out of communications, or deleting your account. Withdrawal does not affect processing that occurred before it.

To exercise any of these choices, use the App or contact us at support@susy.com. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law. If we decline a request, you may ask us to reconsider by replying to our response, and we will tell you how to escalate if you remain dissatisfied.

You can delete your Susy account at any time:

• In the App: go to Settings > Edit Profile, scroll to the bottom, and tap Delete Account, then confirm.

When you delete your account, we delete the account and the personal information associated with it, subject only to the retention exceptions in Section 6. We do not merely deactivate or freeze your account. A Customer's manager can also delete the Customer's entire workspace, which deletes the workspace and its contents. Deleting the App from your device does not delete your account.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Users must be at least 16 years old. Users under 18 may use the Service only in connection with lawful employment with a Customer and with the consent of a parent or guardian. If you believe a child under 13 has provided us personal information, contact support@susy.com and we will delete it. Where an app store provides us with an age category or parental consent signal for a User, we use that signal only to comply with applicable law and do not retain it for any other purpose.

Depending on where you live, state privacy laws (including laws in California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states) may give you rights to access, correct, delete, or obtain a portable copy of your personal information, to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling, to limit the use of sensitive personal information, and to appeal a denied request. We honor these requests from all U.S. Users, regardless of state, as described in Section 8.

Our practices in brief:

• We do not sell personal information, do not share it for targeted or cross-context behavioral advertising, and do not engage in profiling that produces legal or similarly significant effects.
• Categories of personal information we have collected in the past 12 months: identifiers (name, phone number, email address, account and device identifiers); professional or employment-related information (role, availability, and shift activity); internet or other electronic activity (usage and log information); approximate geolocation derived from IP address; and the contents of messages and notes you submit. Sources: you, your employer, and your device. Purposes: Section 3. Disclosures for a business purpose: Section 5.
• We will not discriminate against you for exercising your rights.
• You may use an authorized agent to submit a request if the agent provides proof of authorization and we can verify your identity.

Your employer's role under state law. Where we process personal information on behalf of your employer, your employer is the "business" or "controller" and Susy is its "service provider" or "processor." We will refer requests about that information to your employer or act on your employer's instructions, as the law provides.

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

The Service is designed for use in the United States, and we store and process information in the United States, where privacy laws may differ from those in your location. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.

We may update this Policy from time to time. We will post the updated Policy on the Site and in the App with a new "Last Updated" date. If the changes are material, we will also notify you in the App or by email before they take effect and, where the law requires, ask for your consent. Your continued use of the Service after the effective date means you accept the updated Policy.

If you have questions, requests, or complaints about this Policy or our privacy practices, contact us:

Email: support@susy.com