Privacy Policy.

Who We Are

The CDO workforce management platform is owned and operated by Innovative Platform Solutions, Inc. ("IPS", "we", "us", "our") — a Nevada corporation, Nevada Business Identification # NV20253289204. CDO is a product of IPS.

Two different roles apply depending on whose information is involved, and they carry different responsibilities:

• Workforce information. When a company licenses CDO for its crews, that employer is the business responsible for the employment information it puts into the platform — time records, schedules, payroll inputs, certifications and clock-event location. IPS handles that information as a service provider acting on the employer's instructions: we do not sell it and we do not use it for our own purposes. If you are a worker and want to access, correct or delete your employment records, start with your employer, who directs us.
• Visitor and prospect information. When you browse our website, request a demo or contact us directly, IPS is the responsible business for that information.

Companies that license CDO are our customers, not operators of the platform.

Information We Collect

When you use the CDO workforce management platform operated by Innovative Platform Solutions, Inc., we collect the following categories of information. This list is generated from the platform's actual database columns, not from a template — if a category is not listed here, we do not hold it.

• Identity & contact information: Full name, employee identification number, email address, phone number, home address, and date of birth.
• Emergency contact: The name and phone number of the person you ask us to call.
• Employment information: Job title, crew assignment, work schedule, hire date, certifications, and training records.
• Compensation information: Your hourly rate or weekly salary, hours worked, overtime and premium calculations, and payroll export lines.
• Time & attendance data: Clock-in and clock-out timestamps, break records, shift duration, and the street address resolved for each punch.
• Photographs taken at the time clock: The field app photographs you at some clock-ins — always on your first shift and when you punch from outside the job site, and otherwise as an occasional spot check. See Biometric Information, which states the rule exactly.
• Voice recordings: If you use a voice feature (dictation or the voice assistant), your recorded speech is captured and transcribed. See Biometric Information.
• Location data: GPS coordinates. Read Location Data in full — collection is not limited to the moment you punch.
• Signatures: Handwritten signatures you draw on-screen to acknowledge policies, timecards, estimates and other documents, together with a record of what you were shown when you signed.
• Health & safety records: Workplace injury reports, injury descriptions, dates of injury, medical-treatment determinations, and OSHA recordkeeping entries. Some of this is medical information and is treated as sensitive.
• Tax identifiers: Where your employer's accounting system supplies it, the last four digits of your Social Security Number. We do not store the full number.
• Assistant conversations: The messages you exchange with the CDO Assistant. See AI Assistant.
• Device information: Device type, operating system, app version, browser, and the push-notification token used to reach your device.

If you are a customer or contact of a company that uses CDO (rather than an employee), we hold your name, business and billing addresses, phone numbers, email addresses, the jobs and estimates associated with you, and the messages exchanged with you.

Where the Information Comes From

California law requires us to name the categories of sources we collect from, not only what we collect. There are five:

• You. What you type or record in the field app or the web portal — punches, notes, form answers, signatures, dictation, messages to the assistant.
• Your device. GPS coordinates, the camera when a clock-in photograph is taken, the microphone when you use a voice feature, device type, app version, and the push token used to reach you.
• Your employer. Your personnel record: name, contact details, hire date, job title, crew, pay rate, certifications, emergency contact.
• Your employer's other systems. Where your employer used another product before CDO or alongside it, we import from it — Connecteam (time records), Housecall Pro (customers and jobs), QuickBooks via Conductor (employee and payroll records), and Google Drive or Microsoft 365 (documents your employer shares with us).
• Your coworkers and supervisors. Crew assignments, schedules, daily reports, incident reports naming you, and messages sent to you.

We do not buy personal information, and we do not collect it from data brokers, public records, or social media.

How We Use Your Information

We use the information we collect for the following purposes:

• Workforce Management: Scheduling jobs, assigning crews, and managing daily operations
• SMS Notifications: Sending schedule updates, time clock reminders, job assignments, and operational alerts
• Time & Attendance: Recording work hours, managing pay-to-the-minute calculations, and ensuring California labor law compliance
• Safety & Compliance: Tracking certifications, training completion, and regulatory compliance
• Platform Improvement: Analyzing usage patterns to improve the platform experience

SMS Communications

The CDO platform sends SMS messages to employees for operational purposes, including schedule changes, time clock reminders, job assignments, and important alerts. Message frequency varies based on your work schedule and operational needs.

Opting out costs you nothing. It does not affect your employment, your pay, your schedule, or your access to the CDO web portal and field app — where you will still see the same schedule updates and alerts. It only stops the text messages.

Getting them back. Reply START (or ALTA) at any time, or ask your supervisor.

We do not use your phone number for marketing purposes, and we do not sell or rent it. SMS messages are limited to operational workforce communications directly related to your employment. Message and data rates may apply; message frequency varies with your schedule.

Location Data

The CDO field application collects GPS location in six distinct ways. The first three run while you are working. The last three are the exceptions, and each one has a boundary we describe exactly.

• At clock-in and clock-out. A single coordinate is captured with each punch and stored on the time record, to verify presence at the assigned job site.
• Periodically while you are on the clock. Once you clock in, the app runs a location service that reports your position at intervals for the duration of your shift. These points are stored as a location trail and are used to confirm site arrival and departure, to detect a departure from a job-site geofence, and to support California meal- and rest-break compliance.
• Where your device permits background location. If you grant background-location permission, the reporting above can continue while the app is not open on screen — still only while you are clocked in.
• In the hour before you clock in — kept on your phone, and sent only if you actually punch. The app holds a rolling one-hour buffer of positions, refreshed every fifteen minutes, in storage on the device itself. Nothing in it reaches us unless and until you clock in; at that moment it is attached to the shift that just opened, so that if you later ask to correct your start time there is evidence you were on site earlier. If you never clock in — a day off, a sick day, a shift you decide not to start — the buffer simply rolls forward and every point falls off the end. It is never uploaded, and it is cleared when you sign out.
• For up to an hour after you clock out. Positions recorded in the hour following a clock-out are attached to the shift that just closed, for the same reason in reverse: to establish when you actually left the site. These do reach us as they are recorded. After that hour, reporting stops.
• Your commute, and only if you signed a vehicle election. If you signed the take-home vehicle agreement (form D-19), the app records the drive between the moment you press ON MY WAY and the moment you clock in, and again from your clock-out until the return leg ends. This exists in order to pay you for that drive — it is the measurement behind a line on your paycheck, and without it the drive cannot be priced. It runs for nobody who has not signed that form, it records nothing once the leg closes, and it never runs on a day you do not work. Your signed election is the legal basis for it, and you may revoke that election at any time.

When it stops. Outside the six cases above, we do not record your location. Not on days you do not work, not between shifts beyond the windows described here, and never once a shift or a commute leg has closed. The two windows either side of a shift are one hour each, and the pre-shift one never leaves your phone unless you punch.

Precise geolocation is sensitive personal information under the California Consumer Privacy Act. We use it only for the workforce purposes described above. We do not sell it, we do not use it to build a profile of your movements outside work, and we do not use it for advertising.

You can refuse. Location permission is granted on your own device and can be withdrawn there at any time, including background permission separately from foreground permission. Withdrawing it may prevent the app from verifying a job-site punch, which your employer may ask you to resolve another way — but the choice is made on your phone, by you.

The device timestamp remains authoritative for all time records.

Biometric Information

Clock-in photographs. The field app photographs you when you clock in. It does not do this on every punch, and the rule is not a secret: it photographs you always on your first-ever shift, always when you punch from outside the job-site geofence, and otherwise as a random spot check on roughly one clock-in in five. The photograph is attached to that time record and is used for one purpose: letting your employer confirm that the person who punched is the person assigned to the shift, when a timecard is disputed.

Voice recordings. If you dictate a note or use the voice assistant, your speech is recorded and converted to text by a third-party speech provider (see Data Sharing). The transcript is kept with the record you were creating.

What we do not do with them. We do not run face recognition, face matching, or voiceprint identification. We do not use these images or recordings to identify you against any database, to estimate your age, mood, or state of mind, or to monitor productivity. They are evidence attached to a specific record, not an identification system. We never sell them, and we do not share them with anyone outside the recipients named in Data Sharing.

Storage. Clock-in photographs are held in private storage. They are not reachable by a public link; access requires an authenticated, time-limited URL issued to an authorized user of your employer's organization.

Retention. Photographs and recordings are retained with the record they document, for as long as that employment record must be kept (see Your Rights), and are deleted with it.

Your choices. Camera and microphone permissions are granted on your own device and can be withdrawn there at any time. If you want a clock-in photograph or a voice recording already collected to be deleted, you may request it — see Your Rights.

Data Sharing

We may share your information only in the circumstances below. Rather than describe our vendors generically, we name them — a category like “trusted service providers” tells you nothing about who actually holds your data. This list is maintained against the platform's own source code.

Service providers. Each receives only what its function requires:

• Supabase — database, authentication and file storage. Holds essentially all platform data. United States.
• Vercel — web hosting and delivery for the browser portals.
• Google Maps Platform (Maps, Geocoding, Routes) — receives job-site addresses and GPS coordinates to draw maps, convert addresses to coordinates and calculate driving routes.
• OpenStreetMap / Nominatim — receives a job-site address as a fallback when Google geocoding is unavailable.
• Google Firebase Cloud Messaging — receives your device's push token and the contents of push notifications.
• ElevenLabs — receives voice audio for transcription and for the voice assistant. See Biometric Information.
• Conductor — the bridge to your employer's QuickBooks. Carries employee, payroll, customer and invoice records.
• Intuit QuickBooks — your employer's accounting system, reached through Conductor.
• Housecall Pro — where your employer used it previously, we import historical customer, job and invoice records.
• Connecteam — where your employer used it previously, we import time-and-attendance records.
• Stripe — processes customer invoice payments. Handles customer billing data, not employee data.
• Google Workspace (Drive, Docs, Sheets) — where your employer connects its own Drive, we read the documents it shares with us and write back only files it asks for.
• Microsoft 365 (Graph) — the equivalent connection for employers using Microsoft instead of Google.
• Migadu — outbound email delivery, and the mailbox that receives replies, for mail sent from an aitimecard.com address.
• Google Workspace (Gmail) — outbound email delivery, and the mailbox that receives replies, for mail sent from a cdohr.ai address. Which of the two carries a given message is decided by the address it is sent from, so only one of them ever sees it.
• Langfuse — our AI observability tool. It receives the content of prompts and responses from certain AI features so we can diagnose failures and measure quality.

AI model providers. When you use the CDO Assistant, or a feature that reads a document, form or photograph, that content is sent to a large-language-model provider through OpenRouter, which routes the request. We currently route to:

• Google (Gemini) — the primary model for nearly every assistant surface.
• Anthropic (Claude) — a small set of measured tasks, and as a fallback.
• OpenAI (GPT) — as a fallback when a primary model fails.

Under each provider's commercial API terms, your content is not used to train their models and is retained only for the limited period required to generate a response and to run abuse and safety review. Where your employer runs an autonomous work session, that session uses your employer's own Anthropic account under its own agreement. This list is regenerated whenever the platform's model registry changes, and providers we no longer route to are removed — an earlier version of this policy named a provider we had stopped using and omitted one we had added.

Other recipients:

• Your employer — the company that licenses CDO and for which you work — for workforce management and payroll processing. Your employer sees only its own organization's data; CDO isolates each customer's records from every other customer's.
• Legal requirements — when required by law, regulation, subpoena or legal process, and to establish or defend legal claims.
• Government agencies, at your employer's direction — for example a Cal/OSHA report or a workers' compensation claim following a workplace injury.
• A successor — if IPS is acquired or merges, platform data may transfer as part of that transaction, subject to this policy.

AI Assistant

What the assistant does. The CDO Assistant answers questions about your own schedule, hours, pay summaries, training records, company policies, and time-off or document requests. For managers and administrators, it can also surface operational analytics and compliance data scoped to their role.

What the assistant cannot do. The assistant is an advisor, not an actor — it cannot hire, fire, discipline, approve final pay, or make any binding employment decision on your behalf. It is not a lawyer, doctor, accountant, or licensed professional, and it will not provide legal, medical, tax, or immigration advice (California AB 489).

Third-party AI providers. Messages are sent to the providers listed in the Data Sharing section above. Under those providers' commercial terms, your data is not used to train their models and is retained only as needed to produce a response and maintain service abuse controls.

How we limit sensitive data around the assistant — stated precisely. We want to be exact here, because a previous version of this policy described this protection working in the opposite direction to how it is actually built:

• What the assistant can reach. The strongest control is not filtering, it is scope: the assistant's tools are gated by your role, and it has no tool that returns Social Security Numbers or bank account details to anyone. Access is enforced on our server, not by asking the model to behave.
• On the way out. Responses are filtered before they reach your screen, so that patterns resembling a Social Security Number or a payment card are removed even if they somehow appeared in the model's output.
• Submitted forms. Forms are scanned for sensitive identifiers when they are processed, and flagged for your employer's review.
• What we do not claim. We do not claim that everything you type is scrubbed before it leaves for a provider. If you type a Social Security Number, a bank account number, or medical details into a message, that text is sent to the model provider as written. Please do not type them. The assistant never needs them, and no CDO workflow asks you for them in chat.

Conversation logging and review. We store your CDO Assistant conversations in our own database (hosted on Supabase in the United States) for up to two (2) years, matching California employment-record retention requirements. Authorized company personnel (HR and office management) may review conversations for quality, training, audit, and compliance purposes. Chat content is never sold.

Section 7 (NLRA) notice. You retain your federal right to discuss wages, working conditions, unionization, and group complaints with your coworkers. Logging of chat content is for the business purposes described above and is not a tool to monitor or penalize protected concerted activity. If you wish to have a fully private conversation about these topics, use a channel outside of this platform.

Your right to delete AI chat history (CCPA / CPRA). You can request that we delete your CDO Assistant conversations, API-usage logs, and consent records associated with your account. Send a written request to the contact address below; we will acknowledge within 10 business days and complete deletion within 45 calendar days (extendable by 45 days with written notice), consistent with the California Consumer Privacy Act (CPRA, Cal. Civ. Code §1798.100 et seq.). Certain records may be retained where required by law (for example, payroll wage statements under Labor Code §226). Deletion is free of charge.

Consent to interact. Before using the CDO Assistant for the first time, you will be asked to confirm that you understand you are interacting with an AI and that your conversations may be reviewed by management for the purposes above. You can decline and continue using the rest of the platform without AI chat.

How Long We Keep It

California law requires us to state how long we keep each category of personal information, or the criteria we use to decide. Most of these periods are legal minimums we are not free to shorten — an employer must be able to produce these records years later, and CDO is where they live.

Where two periods apply, the longer one wins — a clock-in photograph attached to a timecard that is part of an open wage claim is kept until that claim is resolved, whatever the table says.

Being honest about how deletion happens. Some of this is enforced by an automated sweep and some is done by hand on review. A deletion you request is not on either schedule — it is handled within the timeframe in Your Rights, and only records we are legally required to keep are held back.

Data Security

We implement reasonable technical and organizational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security monitoring and auditing
• Row-level security policies in our database

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

Your Rights

If you are a California resident — and since 1 January 2023 this includes employees, applicants and contractors, not only consumers — the California Consumer Privacy Act as amended by the CPRA gives you the following rights.

• Know. Ask what categories of personal information we have collected about you, where it came from, why we collected it, and who received it — or ask for the specific pieces themselves.
• Access a copy. Receive a copy in a portable, readily usable format.
• Correct. Have inaccurate information fixed. Your employer holds most of it, so a correction usually starts with them — but tell us either way and we will make sure it lands.
• Delete. Have your personal information deleted, except what we are legally required to keep (see How Long We Keep It). We will tell you which categories we held back and why, rather than refusing the whole request.
• Limit how we use sensitive information (Civ. Code §1798.121). Two categories we collect are sensitive personal information: precise geolocation and biometric information — your face in a clock-in photograph and your voice. You may direct us to use them only for the purposes this policy describes.
  In practice we already limit them to exactly that: verifying a job-site punch, settling a disputed timecard, and transcribing what you dictated. We do not use them to infer characteristics about you, to profile you, or for advertising, and we never sell them. You can also withdraw location, camera and microphone permission on your own device at any time.
• Opt out of sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioural advertising — not for money, not for anything else. We have never done so, including in the twelve months before this policy's date. There is therefore nothing to opt out of, and no “Do Not Sell or Share My Personal Information” link, because a link that does nothing is worse than an honest sentence.
• Not be retaliated against. Exercising any of these rights will not cost you your job, your hours, your pay, your schedule, or your access to CDO. Your employer is separately prohibited from retaliating against you for it. If anyone suggests otherwise, that is itself a violation — tell us.
• Opt out of text messages. Reply STOP (or PARE) to any message, email us, or tell your supervisor. See SMS Communications.

How to make a request

If you use CDO, the surest route is inside it. Open the assistant and pick “Ask for a copy of my personal data”, or use Paperwork ▸ Requests. That lane writes a dated request your employer and we can both see, so nothing depends on somebody noticing an email. You can watch its status on the same screen.

You can also email team@cdohr.ai with the word Privacy in the subject, write to the postal address at the bottom of this page, or tell your employer's office manager, who can pass it to us. All of them reach us; only the first one leaves you a receipt.

• We acknowledge within 10 business days and respond within 45 calendar days. If we need longer we will tell you before that deadline and take at most a further 45 days.
• It is free. We do not charge for a request and will not ask you to create an account to make one.
• Verification. We have to be sure a request is really yours before we hand over or delete anything — otherwise the right becomes a way to attack you. We verify against information we already hold, such as your employee ID and the contact details on your record. We will never ask for a Social Security number, a bank account or a photograph of your ID to verify a privacy request, and any message that does is not from us.
• Someone can act for you. An authorized agent may submit a request with your written permission; we will confirm directly with you before acting.
• If we say no, we will tell you which right, which records, and on what legal basis — never a bare refusal.

You also retain rights that do not come from privacy law and that nothing here limits: your federal §7 right to discuss wages and working conditions with coworkers, your right to inspect your own personnel file and payroll records under Labor Code §§1198.5 and 226(b), and your right to complain to the California Privacy Protection Agency or the Attorney General.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will notify you through the platform or via SMS. The updated policy will be effective as of the date posted on this page.

What changed on September 5, 2026

We re-ran the August audit against the code as it stands today. The platform had gained two location features in the three weeks after that audit, and the policy had not moved with them — so a sentence that was accurate when written had quietly become false. That is the failure mode this section exists to catch:

• Location, again. The August version said we never record your location before you clock in or after you clock out. Since then the app gained a one-hour buffer either side of a shift, and a commute recorder for workers who signed the take-home vehicle election (form D-19). Location Data now describes six mechanisms instead of three, states the boundary on each, and says plainly which ones leave your phone.
• Clock-in photographs. The policy implied the photograph was governed by a setting your employer turns on. It is not: the app decides, and the rule is now written out — always on a first shift, always outside the geofence, otherwise roughly one clock-in in five. You are entitled to know when a camera fires.
• How to make a request. The policy named an email address and a 10-business-day promise. We checked whether anything watches that mailbox and found that nothing does automatically, so the first route we now give you is the one inside CDO, which writes a dated request you and your employer can both see. The email address still works and still reaches us — it just is not the only thing standing between you and an answer.
• Commute location retention. Added to How Long We Keep It. It is the evidence behind a paid line on a wage statement, so it follows pay-record retention rather than location-trail retention. Saying nothing would have left it silently governed by the shorter row.
• Who carries our email. The platform gained a second mail carrier the same day — Google Workspace, alongside Migadu — and which one carries a message is decided by the address it is sent from. Who We Share It With now names both. This one is a change to the platform, not a correction to the document, and it is disclosed in the release that shipped it rather than in the one after.

Every other edit above moved the document toward the system, not the other way round.

What changed on August 13, 2026

We audited this policy line by line against what the platform's code actually does, rather than against what we remembered building. Several statements were wrong, and we would rather say so than quietly reword them:

• Location. The previous version said location was collected only at clock-in and clock-out and was “not tracked continuously.” That was incorrect: the field app reports location periodically for the duration of an open shift. Location Data now describes this accurately.
• Biometric information. Clock-in photographs and voice recordings were not disclosed at all. They now have their own section.
• Sensitive identifiers and the AI assistant. The previous version stated that we strip Social Security and bank numbers before sending data to an AI provider. The actual protection works differently — scope limits on what the assistant can reach, and filtering on the way out. That section now describes the real mechanism and tells you plainly not to type such numbers into chat.
• Third parties. “Trusted service providers” has been replaced with the actual list of companies that receive data, and what each one receives.
• AI providers. The list named a provider we had stopped using and omitted one we had added. It is now generated from the platform's model registry.
• Categories collected. Date of birth, home address, emergency contacts, pay rate, signatures, injury and safety records, and the last four digits of a Social Security Number were all held but not listed. They are listed now.
• Storage. During this audit we found that clock-in photographs were stored in a file bucket readable without authentication. That was closed the same day, and the storage is now private.
• Retention. The policy described retention in passing and never said how long each category is kept. How Long We Keep It is new, and states a period and a legal basis for every category.
• Sources. We never said where the information comes from. That section is new.
• Your rights. The list was four lines and missing three rights California gives you — to limit the use of sensitive information, to opt out of sale or sharing, and to be free from retaliation for asking. It also never explained how to make a request, how we verify it, or how long we take. All of that is now stated.

Nothing in this update changed what the platform does. Every one of these edits made the document describe the system more accurately — which is the only direction a privacy policy should ever move on its own.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

If you are a worker and your question is about your own employment records — hours, pay, schedule or certifications — your employer holds those records and directs how they are handled. Contact your employer first; we support them in responding.