Privacy Policy

Your employer (the contractor organization that issued your badge) is the data controller for the information described below — they decide to deploy the Service and configure jobsites, schedules, and workers. ZeroBadge acts as their data processor: we store and process this data on the Customer's behalf and only as instructed by them. Questions about how a specific Customer uses your data should go to your employer first; we're happy to assist them in responding.

Account & profile data. Name, email, phone number, job title, employee ID, and role, provided when an account is created or a worker profile is set up.

Location data. While a badge is powered on, it reports GPS coordinates, timestamp, and cellular signal strength to determine whether the wearer is inside an assigned jobsite geofence during scheduled work hours. This is the core function of the Service — automatic, badge-based clock-in and clock-out.

Motion data. Accelerometer readings used solely to detect fall events and trigger a safety alert. Motion data is not used for any other purpose.

Device data. Badge battery level, connectivity status, and serial number.

Timesheet & attendance data. Clock-in/clock-out events, computed hours, and any correction requests or edits made to that history.

Usage & technical data. IP address, browser type, and pages visited within the web dashboard, collected for security (audit logging, rate limiting) and troubleshooting.

• Automatically record clock-in and clock-out based on geofence entry/exit.
• Detect falls and notify the Customer's designated contact.
• Generate timesheets, daily reports, and payroll-ready exports.
• Provide the live map and worker-status views to authorized Customer admins.
• Secure accounts (rate limiting, audit logs, fraud/abuse prevention).
• Bill Customers for their subscription and badge usage.

We do not sell location or any other personal data, and we do not use it for advertising.

If you are issued a badge by your employer, your GPS location is tracked continuously while the badge is powered on, primarily during scheduled work hours at assigned jobsites. Some states and jurisdictions require employers to give specific notice before monitoring employee location — that notice is your employer's responsibility as the data controller, and this policy is not a substitute for it.

You can view your own timesheet, schedule, device status, and activity history at any time by logging into your worker portal, and you can submit a request to correct a timesheet entry there as well.

We share data only with service providers necessary to operate the Service, under contracts that limit their use of it to providing that service to us:

• Supabase — database, authentication, and file storage.
• Mapbox — map rendering and geocoding for jobsite drawing and the live map.
• AWS IoT Core — badge device connectivity.
• Twilio — SMS delivery for fall-detection alerts.
• Stripe — subscription billing (Stripe never receives location or timesheet data).
• Sentry — error monitoring for the web application.

We may also disclose data if required by law, or to investigate fraud, security incidents, or violations of our terms.

We retain timesheet and location data for as long as the Customer account is active, plus a reasonable period after to support payroll disputes, audits, and legal obligations. A Customer can request deletion of their organization's data by contacting us; some records may be retained where required by law or for legitimate business records (e.g., billing history).

Data is encrypted in transit (TLS) and at rest. Access is enforced at the database level (row-level security) so a Customer can only ever see their own organization's data, and a worker can only see their own records. Every read of location and timesheet data is logged. Each physical badge authenticates with a unique certificate.

Depending on where you live, you may have rights to access, correct, or request deletion of your personal data. Workers should start with their employer (the data controller); ZeroBadge will assist Customers in fulfilling verified requests. You can reach us directly at the contact below for any data protection question.

The Service is intended for use by employers and their adult workforce. It is not directed at, and we do not knowingly collect data from, children.

We may update this policy as the Service changes. Material changes will be reflected by updating the "Last updated" date above.

Questions about this policy or how your data is handled: reach out through our contact page.