Privacy Notice

This Privacy Notice for StrataCM LLC, doing business as StrataCM (“StrataCM,” “we,” “us,” or “our”), explains how we collect, use, disclose, retain, and protect personal information when you use our website at https://www.stratacm.com, the StrataCM mobile application, the StrataCM web application, and related products and services that link to this Privacy Notice (collectively, the “Services”).

StrataCM is a construction workforce and project-management software platform. The Services may be used by businesses and other organizations to manage workers, timekeeping, attendance, projects, communications, documents, payroll preparation, jobsite activity, and related workflows.

This Privacy Notice should be read together with our Terms of Service and any additional agreement between StrataCM and an organization using the Services.

If you have questions about this Privacy Notice or our privacy practices, contact us at info@stratacm.com.

Definitions

“Account Holder” means the person or legal entity that purchases, registers for, or controls an organization account for the Services.

“Authorized User” means any employee, worker, contractor, supervisor, administrator, representative, or other individual whom an Account Holder permits to access or use the Services.

“Customer Data” means information, records, files, and content submitted to, uploaded to, collected through, or generated through an Account Holder's use of the Services, including time records, location records, shift routes, schedules, payroll-related records, project records, daily logs, notes, photographs, videos, messages, incident reports, forms, signatures, worker information, certifications, receipts, contracts, and related organizational data.

1. What Information Do We Collect?

We collect information in several ways: directly from you, from Account Holders and other Authorized Users, automatically through the Services and your device, from service providers and integrations, and from other sources as described below.

A. Information You Provide Directly

Depending on how you use the Services, we may collect:

• name;
• email address;
• phone number;
• job title, role, company, or organization;
• username and authentication information;
• profile information and profile photographs;
• account preferences;
• support requests and communications with us;
• information submitted through forms, questionnaires, notes, daily logs, incident reports, project records, or messages;
• photographs, videos, receipts, certifications, licenses, contracts, project documents, safety records, and other uploaded files;
• signatures or acknowledgments;
• billing and subscription information; and
• any other information you choose to provide through the Services.

B. Information Provided by an Account Holder or Other Authorized Users

If your employer, contractor, organization, administrator, supervisor, or another Authorized User creates or manages your account or submits information about you, we may receive information such as:

• your name and contact information;
• employment or contractor status;
• job title, role, permissions, crew, department, or supervisor;
• project and jobsite assignments;
• work schedules;
• time, attendance, clock-in, clock-out, break, and timesheet information;
• cost codes and work classifications;
• payroll-related information used for payroll preparation or export;
• notes, reports, communications, incident information, and project activity;
• uploaded certifications, licenses, documents, receipts, or photographs; and
• other Customer Data submitted or generated through the Account Holder's use of the Services.

An Account Holder may determine which information its Authorized Users are required or permitted to provide through the Services.

C. Geolocation, Jobsite, and Shift-Route Information

The Services may collect precise or approximate geolocation information when location-enabled features are used. Depending on the Account Holder's configuration, device permissions, operating-system settings, and the feature being used, this may include:

• GPS coordinates;
• location timestamps;
• jobsite locations and addresses;
• geofence entry and exit events;
• location points collected during an authorized work period;
• shift-route or shift-replay information;
• distance or mileage information generated from location records;
• location accuracy information; and
• related device, network, and system information used to determine or validate location.

Certain location features may operate in the background while an Authorized User is clocked in, performing an authorized work activity, or otherwise using a location-enabled feature configured by the Account Holder.

Location collection depends on device permissions and operating-system controls. If location permissions are disabled or restricted, certain features may not operate, or records may be incomplete or inaccurate.

Precise geolocation may be considered sensitive personal information or sensitive data under applicable privacy laws.

StrataCM does not sell raw worker location histories or shift-route data to data brokers.

D. Timekeeping, Attendance, Payroll-Related, and Workforce Information

The Services may collect or generate information relating to:

• clock-in and clock-out events;
• work hours and timesheets;
• breaks;
• attendance;
• schedules;
• project assignments;
• cost codes;
• questionnaires associated with work or clock events;
• approvals, corrections, rejections, and audit history;
• payroll-export records;
• work-related notes and reports; and
• related workforce-management information.

StrataCM provides tools that help Account Holders manage this information. The Account Holder determines how it uses workforce records for employment, payroll, scheduling, disciplinary, safety, project, or other business purposes, subject to applicable law.

E. Device, Usage, and Technical Information

When you use the Services, we may automatically collect information such as:

• device identifier;
• device model and manufacturer;
• operating system and version;
• application version;
• IP address;
• browser type;
• language and time-zone settings;
• application permissions;
• push-notification status;
• crash, diagnostic, and performance data;
• security and authentication events;
• pages, screens, and features accessed;
• timestamps and activity logs; and
• other technical information reasonably necessary to operate, secure, diagnose, and improve the Services.

F. Camera, Photos, Files, and Device Features

With device permission where required, the Services may access or allow you to use device features such as:

• camera;
• photo library;
• files or document storage;
• notifications;
• microphone or speech input, if an enabled feature requires it; and
• location services.

You may change device permissions through your device settings, although doing so may limit certain functionality.

G. Communications and Notifications

We may process:

• in-app messages and communications;
• notifications sent through the Services;
• email communications;
• support communications;
• administrative communications;
• project or workforce communications; and
• related delivery, status, and recipient information.

H. Artificial Intelligence and Assistant Features

If you use an artificial-intelligence or assistant feature, we may process information you submit to that feature, such as:

• prompts;
• typed or spoken requests;
• transcribed speech, where applicable;
• conversation context necessary to respond to a request;
• requested workflow actions;
• assistant responses; and
• audit information relating to assistant actions.

Information submitted to AI features may be processed by service providers that help us provide AI functionality. StrataCM may apply technical and organizational safeguards intended to limit AI features to authorized data and actions.

AI features may produce incorrect or incomplete information. Account Holders and Authorized Users remain responsible for reviewing information and actions before relying on them for payroll, employment, safety, legal, financial, or other consequential decisions.

I. Authentication and Device Biometrics

The Services may allow you to use biometric authentication features provided by your device or operating system, such as Face ID, Touch ID, fingerprint authentication, or similar device-local authentication.

Where device-local biometric authentication is used, StrataCM does not receive or store the underlying facial geometry, fingerprint template, or other biometric template used by the device operating system to authenticate you. We may receive only the result of the authentication attempt or related security status necessary to allow or deny access.

J. Payment Information

If you purchase a subscription or other paid service, payment processing may be handled by a third-party payment processor such as Stripe. StrataCM may receive billing status, transaction identifiers, subscription information, limited payment-method information, and other information necessary to manage your account.

StrataCM does not intentionally store full payment card numbers or card security codes.

K. Information from Integrations and Third-Party Services

If an Account Holder connects the Services with another platform or service, we may receive information authorized through that integration. The type of information depends on the integration and the permissions granted.

Our use of information received through Google APIs, where applicable, will comply with the Google API Services User Data Policy, including applicable Limited Use requirements.

L. Information from Other Sources

We may receive business contact or account-related information from public sources, referrals, business partners, data providers, marketing partners, or other lawful sources. This may include names, job titles, business email addresses, company information, telephone numbers, and similar business contact information.

2. Account Holders, Authorized Users, and Workplace Data

StrataCM is generally a technology provider to the Account Holder. Account Holders decide whether and how to deploy many workforce features, including timekeeping, location tracking, schedules, permissions, projects, reports, payroll preparation, and employee or contractor records.

When StrataCM processes Customer Data on behalf of an Account Holder, the Account Holder may determine the purposes for which that Customer Data is collected and used, subject to the Account Holder's agreements with StrataCM and applicable law.

Account Holders are responsible for providing legally required notices, obtaining legally required permissions or consents, establishing lawful business purposes, appropriately configuring the Services, limiting access to authorized personnel, and complying with employment, labor, wage-and-hour, privacy, workplace-monitoring, recordkeeping, and other laws applicable to their use of the Services.

If you are an Authorized User and have questions about why your employer or organization collects or uses particular workforce information, you should contact the Account Holder or your organization's administrator. Depending on the applicable law and the nature of the request, StrataCM may refer a privacy request concerning Customer Data to the relevant Account Holder.

3. How Do We Use Personal Information?

We may use personal information to:

• create, authenticate, secure, and administer accounts;
• provide, operate, maintain, and improve the Services;
• provide timekeeping, attendance, scheduling, location, jobsite, project-management, payroll-preparation, communication, document, and related features;
• process and display Customer Data according to Account Holder instructions and configuration;
• calculate or display route, distance, mileage, geofence, and jobsite information where enabled;
• send transactional, administrative, account, security, and service communications;
• deliver push notifications;
• provide customer support and troubleshoot problems;
• process subscriptions, billing, and payments;
• maintain security, detect fraud, prevent abuse, and investigate suspicious activity;
• diagnose errors, crashes, and performance issues;
• maintain audit records and activity histories;
• respond to legal requests and comply with applicable law;
• enforce our agreements and protect our rights, users, Services, and property;
• support business continuity, backups, and disaster recovery;
• analyze usage and improve features, reliability, security, and user experience;
• create aggregated or de-identified information for analytics, security, product development, benchmarking, and improvement, where permitted by law;
• provide AI or assistant functionality where enabled; and
• carry out other purposes disclosed at the time information is collected or with appropriate authorization.

We do not use private workforce Customer Data, such as workers' raw location histories, payroll-related records, or private organizational messages, for unrelated third-party advertising.

4. When and With Whom Do We Disclose Personal Information?

We may disclose personal information in the circumstances below.

A. Account Holders and Authorized Users

Information generated through an organization account may be available to the Account Holder and to Authorized Users based on their roles and permissions.

For example, authorized administrators or supervisors may be able to access worker profiles, time records, schedules, assigned projects, jobsite information, reports, messages, uploaded files, location information, or shift-route records where the Account Holder has enabled that access.

StrataCM does not control how an Account Holder independently uses information after the Account Holder accesses or exports it from the Services.

B. Service Providers and Contractors

We may provide information to vendors, service providers, contractors, and subprocessors that help us provide or support the Services. Categories may include:

• cloud hosting and data storage;
• database and backend infrastructure;
• authentication and account-management services;
• push-notification providers;
• email and communication providers;
• payment processors;
• mapping, geocoding, and location services;
• analytics, diagnostics, and error-monitoring providers;
• artificial-intelligence service providers;
• security and fraud-prevention providers;
• website hosting;
• customer-support tools; and
• professional advisors.

These providers may process information only as permitted by their agreements with us and applicable law.

C. Mapping and Location Services

When location-enabled features are used, mapping or location-service providers may process location-related information necessary to provide maps, addresses, routing, geocoding, or other location functionality.

D. Legal, Safety, and Security Disclosures

We may disclose information if we reasonably believe disclosure is necessary to:

• comply with a subpoena, court order, legal process, or applicable law;
• respond to lawful requests from government or regulatory authorities;
• enforce our agreements;
• investigate fraud, abuse, security threats, or violations;
• protect the rights, property, or safety of StrataCM, our users, an Account Holder, or others; or
• establish, exercise, or defend legal claims.

E. Business Transfers

We may disclose or transfer information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable law and appropriate confidentiality protections.

F. With Your Direction or Authorization

We may disclose information when you or the applicable Account Holder directs us to do so, enables an integration, requests an export, or otherwise authorizes the disclosure.

5. Do We Sell or Share Personal Information?

StrataCM does not sell raw workforce Customer Data, raw worker location histories, payroll-related Customer Data, private project records, or private organizational messages to data brokers.

We may use analytics, advertising, or similar technologies on our public-facing website. Depending on the technology used and applicable law, certain disclosures involving cookies, device identifiers, or online activity may be considered a “sale,” “sharing,” or use for targeted advertising even when no money changes hands.

Where applicable law provides a right to opt out of such processing, we will provide a method to exercise that right and will honor legally required opt-out preference signals, such as Global Privacy Control, where required. You can manage applicable website preferences through Cookie Preferences.

We do not use precise worker geolocation collected through workforce features for cross-context behavioral advertising.

6. Cookies and Other Tracking Technologies

We may use cookies, software development kits, pixels, local storage, and similar technologies to:

• keep users signed in;
• remember preferences;
• maintain security;
• prevent fraud;
• understand website and application usage;
• diagnose technical problems;
• measure performance; and
• support analytics or marketing on public-facing portions of our Services.

You may be able to control cookies through browser or device settings. Disabling certain technologies may affect functionality.

Where required, we will provide additional choices regarding advertising or analytics technologies. See Cookie Preferences on this website.

7. How Long Do We Keep Personal Information?

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Notice, to provide the Services, to comply with Account Holder instructions, to satisfy legal, tax, accounting, payroll, employment, safety, recordkeeping, or contractual obligations, to resolve disputes, to enforce agreements, and to maintain security and business records.

Retention periods vary based on the type of information and the context in which it is processed.

For Customer Data, retention may depend on:

• the Account Holder's subscription status and retention settings;
• the nature of the record;
• the Account Holder's legal and business requirements;
• backup and disaster-recovery schedules;
• pending disputes, investigations, or legal holds; and
• applicable laws requiring or permitting retention.

Removing or deactivating an Authorized User does not automatically delete records previously created by or about that person. Time records, payroll-related records, project records, audit logs, location records, communications, incident records, and other Customer Data may remain associated with the Account Holder as required by the Account Holder's settings, contractual obligations, legitimate business needs, or applicable law.

When we no longer have a lawful or legitimate reason to retain personal information, we may delete, de-identify, aggregate, or securely isolate it, subject to technical and legal limitations.

8. How Do We Protect Personal Information?

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, alteration, disclosure, destruction, loss, or misuse.

Safeguards may include access controls, authentication, authorization, logging, encryption or protected transmission where appropriate, security monitoring, role-based permissions, backups, and other measures appropriate to the nature of the information and Services.

No electronic system, network, storage technology, or transmission method can be guaranteed to be completely secure. You are responsible for protecting your login credentials, devices, and account access and for promptly notifying us or your Account Holder of suspected unauthorized access.

9. Children and Minors

The Services are intended for users who are at least 18 years old. We do not knowingly offer the Services directly to children under 18.

If an Account Holder believes that applicable law permits or requires an individual under 18 to use the Services, the Account Holder must contact StrataCM before enabling such use and is responsible for satisfying all applicable legal requirements.

If we learn that we have collected personal information from a child in circumstances where collection was not permitted, we will take reasonable steps to address the information in accordance with applicable law.

If you believe a minor has provided information to us improperly, contact info@stratacm.com.

10. Your Privacy Rights and Choices

Depending on where you live and the law that applies, you may have rights concerning your personal information, such as the right to:

• confirm whether personal information about you is being processed;
• access personal information;
• request correction of inaccurate personal information;
• request deletion of certain personal information;
• obtain a portable copy of certain personal information;
• opt out of certain sales, sharing, targeted advertising, or profiling;
• limit certain uses or disclosures of sensitive personal information;
• withdraw consent where processing is based on consent;
• appeal certain decisions concerning a privacy request; and
• exercise privacy rights without unlawful discrimination or retaliation.

These rights are not absolute. Applicable law may allow or require us or an Account Holder to retain certain information or decline a request in particular circumstances.

A. Requests Concerning Account Holder Customer Data

If you are an Authorized User and your request concerns information maintained by your employer or another Account Holder through StrataCM, the Account Holder may be the appropriate party to handle your request.

You may contact your employer or organization directly. You may also contact us at info@stratacm.com, and where appropriate we may forward or refer the request to the relevant Account Holder or assist the Account Holder in responding.

B. Direct Requests to StrataCM

To submit a request relating to information for which StrataCM is responsible, contact us at:

• Email: info@stratacm.com
• Website: https://www.stratacm.com/contact

We may need to verify your identity or authority before completing a request. We will use information provided for verification only for verification, security, fraud prevention, and fulfillment of the request.

Where permitted, an authorized agent may submit a request on your behalf, subject to verification requirements.

C. Appeals

Where applicable law provides a right to appeal a privacy-request decision, you may appeal by emailing info@stratacm.com and identifying the request you wish to appeal.

D. Location Permissions

You may control device location permissions through your device settings. Restricting or disabling location access may cause location-enabled, geofence, mileage, attendance, or timekeeping features to stop working or to produce incomplete records.

Changing device permissions does not necessarily delete location information previously collected.

E. Push Notifications

You may disable push notifications in your device settings. Certain essential notices may still be delivered through other channels where permitted.

F. Marketing Communications

You may opt out of marketing email by using the unsubscribe method included in the communication or by contacting us. Even if you opt out of marketing, we may continue sending transactional, security, billing, support, legal, or other non-marketing communications.

G. Global Privacy Control

Where required by applicable law, we recognize qualifying Global Privacy Control or other legally recognized opt-out preference signals for browser-based sale or sharing and targeted-advertising choices. For more information, visit globalprivacycontrol.org. You can also review website preferences via Cookie Preferences.

11. United States State Privacy Disclosures

Depending on where you reside, state privacy laws may provide additional rights or impose additional requirements.

The categories below describe personal information we may collect through the Services. Whether a particular category applies to you depends on how you and the applicable Account Holder use the Services.

We use sensitive information only for purposes reasonably related to providing, securing, supporting, and administering the Services, complying with law, or as otherwise permitted or directed by the applicable Account Holder and applicable law.

California

If the California Consumer Privacy Act (“CCPA”) applies, California residents may have rights to know, access, correct, delete, and obtain information about our processing of personal information, and rights concerning the sale or sharing of personal information and certain uses or disclosures of sensitive personal information.

California employment-related personal information may be covered by the CCPA where the statutory requirements apply.

We do not use precise worker geolocation collected through workforce-management features for cross-context behavioral advertising.

California “Shine the Light”

California Civil Code Section 1798.83 may provide certain California residents with rights concerning disclosure of personal information to third parties for their direct-marketing purposes. Requests may be submitted using the contact information in this Privacy Notice.

Other U.S. States

Residents of other states with applicable comprehensive privacy laws may have rights including access, correction, deletion, portability, opt-out rights, rights concerning sensitive data, and appeal rights, subject to each law's scope, exemptions, and requirements.

We will process qualifying requests in accordance with the law that applies to the request.

12. Sensitive Personal Information and Precise Geolocation

Certain privacy laws classify precise geolocation as sensitive personal information or sensitive data.

Where required by applicable law, we will process precise geolocation in accordance with applicable notice, consent, contractual, security, purpose-limitation, and rights requirements.

StrataCM uses location information for workforce and product functionality such as jobsite tracking, geofencing, shift records, attendance, shift replay, mileage or distance features, safety or operational workflows, and related Services configured by the Account Holder.

StrataCM does not sell raw worker precise-geolocation histories to data brokers and does not use precise workforce location data for unrelated cross-context behavioral advertising.

Account Holders are responsible for determining whether they are legally permitted to require or enable location tracking for their workforce, providing required workplace notices, and obtaining any legally required authorization.

13. Data Security Incidents

If we become aware of a security incident involving personal information, we may investigate, contain, remediate, document, and provide notifications as required by applicable law and our contractual obligations.

Account Holders are responsible for promptly notifying StrataCM of suspected unauthorized use of their accounts or credentials and for maintaining appropriate internal access controls for their Authorized Users.

14. International Data Transfers

The Services are operated from and primarily hosted in the United States.

If you access the Services from another country, your information may be transferred to, stored in, and processed in the United States or other countries where StrataCM or its service providers operate.

Where applicable law requires a specific transfer mechanism or contractual protection, we will use appropriate measures as required by that law.

15. Third-Party Websites, Services, and Integrations

The Services may link to or integrate with third-party websites, applications, or services.

This Privacy Notice does not govern the independent privacy practices of third parties. Account Holders and Authorized Users should review applicable third-party privacy notices before enabling or using an integration.

16. Do-Not-Track Signals

Some browsers and devices offer “Do Not Track” settings. Because there is no single universally adopted standard governing traditional Do-Not-Track signals, we do not treat a generic DNT signal as a universal privacy request unless required by applicable law.

This is separate from legally recognized opt-out preference signals such as Global Privacy Control, which we honor where required by applicable law.

17. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our Services, practices, technology, legal obligations, or other circumstances.

The revised Privacy Notice will display an updated “Last Updated” date. If required by law, we will provide additional notice of material changes through the Services, email, or another appropriate method before the changes become effective.

18. Contact Us

If you have questions, concerns, or privacy requests relating to this Privacy Notice, contact:

19. Reviewing, Correcting, or Deleting Information

Depending on applicable law, you may request to review, correct, obtain, or delete personal information by contacting info@stratacm.com or using https://www.stratacm.com/contact.

If the information is Customer Data controlled by an Account Holder, we may direct the request to that Account Holder or process the request according to the Account Holder's lawful instructions.

Deletion requests may be limited where information must be retained for payroll, employment, tax, accounting, security, fraud prevention, legal claims, regulatory compliance, recordkeeping, contractual obligations, backup integrity, or other legally permitted purposes.

Deactivation or deletion of a user account does not necessarily delete records that form part of an Account Holder's business records.