Privacy Policy

Who We Are

The CDO platform, including its web portals and field application, is owned and operated by Innovative Platform Solutions, Inc. ("IPS", "we", "us", "our"), a Nevada corporation, Nevada Business Identification No. NV20253289204. This policy explains how we collect, use, disclose and retain personal information through the CDO platform and our website, and the rights you have over it.

Who is responsible for your information depends on your relationship with the platform:

• Workforce information. When a company uses CDO to manage its workforce ("your employer"), your employer is the business responsible for the employment information in the platform. We process that information as your employer's service provider, on its instructions and under a written contract that includes the terms required by the California Consumer Privacy Act ("CCPA") (see the Data Processing section of our Terms of Service). We use it only to provide, support, secure and improve the platform for your employer, as the law permits.
• Customer information. When a company that uses CDO stores information about its own customers, that company is the business responsible for it, and we process it as its service provider. See Customers of Companies That Use CDO.
• Website and business information. For information collected through our website, demo requests and our own business communications, IPS is the business responsible.

Information We Collect

Depending on how you use CDO, we collect the following categories of personal information:

• Identifiers and contact information: name, employee identification number, email address, phone number, postal address, date of birth, and the name and phone number of an emergency contact.
• Employment information: job title, crew assignment, work schedule, hire date, certifications and training records.
• Compensation information: pay rate, hours worked, overtime and premium calculations, and payroll records.
• Time and attendance records: clock-in and clock-out times, meal and rest breaks, shift duration and the location of each punch.
• Precise geolocation: the location of your device. See Location Data.
• Photographs and voice recordings of you: see Photographs and Voice Recordings.
• Signatures and signed documents: signatures you provide on policies, timecards, forms and other documents, together with a record of the document signed and when it was signed.
• Photographs, video and documents you submit: job-site photographs, forms, inspections and safety documentation, including the time and place they were taken where your device records them.
• Work indicators: information the platform derives about attendance, breaks, timecard exceptions and production. See Automated Decision Support.
• Health and safety records: workplace injury reports and the related recordkeeping entries, which may include medical information.
• Government identifiers and financial information: when you complete your employer's onboarding forms, your Social Security number, work authorization information and direct-deposit bank details. This information is stored encrypted, displayed in masked form, and access to it is restricted and logged.
• Communications: text messages and other messages sent or received through CDO, and your conversations with the CDO Assistant.
• Device and usage information: device type and identifiers, operating system, app version, browser, the token used to send notifications to your device, and records of how the platform is used.

Sensitive personal information. Of the categories above, precise geolocation, government identifiers, financial account information, health information, and photographs and voice recordings of you are sensitive personal information under California law. We use sensitive personal information only to provide the services described in this policy and for other purposes the law permits, and we do not use it to infer characteristics about you.

If you are a customer of a company that uses CDO, see Customers of Companies That Use CDO. If you only visit our website or request a demo, see Website Visitors.

Where the Information Comes From

We collect personal information from the following categories of sources:

• You, through the field app and the web portals: punches, notes, form answers, signatures, dictation and messages.
• Your device, with your permission: location, camera, microphone and device information.
• Your employer: your personnel record, such as your name, contact details, hire date, job title, crew, pay rate and certifications.
• Business systems your employer connects to CDO, such as accounting, field-service, time-tracking and document-storage services.
• Your coworkers and supervisors: crew assignments, schedules, daily reports, incident reports and messages.

We do not buy personal information, and we do not collect it from data brokers.

How We Use Information

We use personal information for the following business purposes:

• Providing the platform: scheduling, crew assignment, job management and communications.
• Time, attendance and payroll: recording hours worked, preparing payroll inputs and supporting compliance with wage-and-hour law.
• Safety and compliance: certifications, training, incident records and regulatory recordkeeping.
• Notifications: operational messages by app notification, email and text message.
• Decision support: identifying possible exceptions for a person to review. See Automated Decision Support.
• Security and integrity: protecting accounts and preventing fraud, misuse and unauthorized access.
• Operating and improving the platform: diagnosing errors, measuring reliability and the quality of features, and producing de-identified statistics.
• Legal obligations: complying with law, responding to lawful requests, and establishing or defending legal claims.

We do not use workforce information for advertising, to build marketing profiles, or to provide services to any other company.

Location Data

With your permission, the CDO field app collects the location of your device in the following circumstances:

• When you clock in and out: with each punch, to verify presence at the assigned job site.
• While you are clocked in, including during meal breaks: at regular intervals, including while the app runs in the background if you allow it, to confirm arrival at and departure from the job site and to support meal- and rest-break compliance.
• Shortly before and after a shift: for a limited period before you clock in and after you clock out, to establish when you arrived at and left the job site. Location collected before you clock in remains on your device and is sent to us only if you clock in.
• Before a scheduled shift: for a limited period before the start of a shift your employer has scheduled for you, until you clock in.
• When you arrive at an assigned job site without clocking in: for a limited period, or until you clock in.
• During an early-morning period on Android devices: each day, including days on which you are not scheduled to work, while you are signed in to the app.
• During your commute, only if you have signed a take-home vehicle agreement: to measure travel time that is compensable under that agreement.

Before a scheduled shift, during the early-morning period and on arrival at a job site, your device displays a notification while location is being collected. Outside the circumstances above, the app does not collect your location.

How we use it. We use location only for the workforce purposes described above: verifying time records, establishing arrival and departure times, supporting meal- and rest-break compliance and measuring compensable travel. We do not sell location information, use it for advertising, or use it to monitor you outside work.

Your choices. Location permission is controlled in your device settings and can be withdrawn at any time, including background permission separately from foreground permission. If you withdraw it, the app may be unable to verify a punch at the job site, and your employer may ask you to confirm your time another way. Signing out of the app ends the early-morning collection.

Photographs and Voice Recordings

Clock-in photographs. The field app may take a photograph of you at some clock-ins, including on your first shift, when you clock in away from the assigned job site, and at random, so that your employer can confirm that the person clocking in is the person assigned to the shift. The photograph is attached to that time record.

Voice recordings. If you use dictation or the voice assistant, your speech is recorded and converted to text by a speech-recognition service, which may be your device's own or one of our service providers. The text is kept with the record you were creating.

What we do not do. We do not use face recognition or voiceprint identification, and we do not create face geometry, voiceprints or other biometric identifiers from these photographs or recordings. We do not use them to identify you against any database or to infer your characteristics.

Storage and access. Clock-in photographs are kept in private storage and are accessible only to authorized users.

Your choices. Camera and microphone permissions are controlled in your device settings and can be withdrawn at any time. You may ask us to delete a photograph or recording, subject to the exceptions described in Your Rights.

SMS Communications

Your employer may use CDO to send you text messages about your work, such as schedule changes, job assignments, time-clock reminders and safety or operational alerts. Messages are sent on your employer's behalf from a number operated for the CDO platform. Message frequency varies with your work schedule. Message and data rates may apply. The SMS Program Terms apply to these messages.

Opting out does not affect your employment, pay, schedule or access to CDO. You will continue to see notices in the field app and the web portal.

We do not use phone numbers for marketing, and we do not sell or rent them. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

Text messages to customers of companies that use CDO are described in Customers of Companies That Use CDO.

Data Sharing

We disclose personal information only to the following categories of recipients:

• Your employer, or for customer information the company you do business with. Each company sees only its own organization's information.
• Service providers that process information on our behalf to operate the platform, each limited to the information its function requires:
  • cloud hosting, database and file storage;
  • website and application hosting and delivery;
  • AI model providers and the services that route requests to them;
  • maps, geocoding and route calculation;
  • push notifications and application updates;
  • speech recognition and voice services;
  • email delivery and text messaging;
  • payment processing, for customers who pay invoices online;
  • error monitoring and quality measurement of AI features.
• Business systems your employer connects, such as accounting, field-service, time-tracking and document-storage services, which exchange information with CDO at your employer's direction.
• Legal and safety recipients, when required by law, regulation or legal process; to protect the rights, property or safety of any person; and government agencies at your employer's direction, for example for a workplace injury report.
• A successor, if IPS is involved in a merger, acquisition or sale of assets, subject to this policy.

In the past twelve months we have disclosed each category of personal information listed in Information We Collect to the recipients above, only as needed for the purposes described in this policy. Some service providers may process information outside the United States. We give our customers at least thirty days' notice before adding a service provider that will receive workforce information.

AI Assistant

What it does. The CDO Assistant answers questions about your own schedule, hours, pay summaries, training records, company policies and requests. For managers and administrators, it can also provide operational and compliance information within the limits of their role.

What it cannot do. The assistant does not make decisions. It cannot hire, discipline, dismiss, approve pay or make any other employment decision, and it does not provide legal, medical, tax or immigration advice.

AI providers. Messages and documents submitted to AI features are processed by third-party AI model providers under commercial terms that do not allow them to use your content to train their models.

Sensitive information. Please do not enter Social Security numbers, bank account numbers or medical details into the assistant. It does not need them, and its access to records is limited by your role.

Conversations. We keep assistant conversations for up to two years. Authorized personnel at your employer may review them for quality, audit and compliance purposes. You may ask us to delete your conversations at any time (see Your Rights).

Section 7 notice. You retain your federal right to discuss wages, working conditions and union matters with your coworkers. Conversation records are kept for the business purposes above and are not used to monitor or penalize protected concerted activity.

Consent. Before you use the assistant for the first time, you are asked to confirm that you understand you are interacting with an AI and that your conversations may be reviewed as described above. You may decline and continue to use the rest of the platform.

Automated Decision Support

Some platform features compute indicators about work and show them to the people who manage it, such as possible missed or late meal and rest breaks, timecard exceptions, attendance patterns and production figures by crew or job. Some of these use AI models; most are fixed rules.

• They are advisory. An indicator prompts a person to review the record. The platform does not hire, discipline, dismiss, set pay or change a schedule on its own, and a premium for a missed break is paid only when a person at your employer decides it is owed.
• A person decides. Any action taken on an indicator is taken by someone with authority to review the evidence and change the outcome. Our contract with your employer requires that no worker is disciplined or dismissed solely on the basis of an automated output.
• You can ask. You may ask your employer, or us, which indicators were used in a decision about you, what information they relied on, and for a person to review the decision (see Your Rights).
• Protected characteristics. These features are not designed to use race, sex, religion, national origin, age, disability, medical condition or any other characteristic protected by law, or information used as a substitute for one.

Customers of Companies That Use CDO

Companies that use CDO may use it to manage their relationships with their own customers. If you are one of those customers, the company you do business with is responsible for your information, and we process it on that company's behalf.

• What is processed: your name and contact details, service and billing addresses, the jobs, appointments, estimates, invoices and payments associated with you, and messages exchanged with you by email and text message.
• Electronic signatures: when you approve an estimate electronically, we record the name you enter, the date and time, and the network address of the device used, together with the document you approved.
• Payments: online payments are handled by a payment processor. We do not store full card or bank account numbers.
• Text messages: the company may send you text messages about your jobs, appointments, estimates, invoices and payments at the number you provided to it. Message frequency varies. Message and data rates may apply. Reply STOP to stop receiving them and HELP for help. We do not use your number for marketing.
• Your requests: to access, correct or delete your information, contact the company you do business with. You may also contact us, and we will forward your request to that company.

Website Visitors

For information collected through www.cdohr.ai, IPS is the business responsible.

• Information your browser sends: your IP address, browser type, the pages you request and the page that referred you. Our hosting provider processes this information to deliver and secure the site. We may measure aggregate page views without using cookies.
• Content from third-party services: some pages load fonts, software libraries and maps from third-party services. Your browser requests these files directly from those services, which therefore receive your IP address and browser information.
• Browser storage: we store your language and display preferences in your browser and, if you sign in to CDO, your session. We do not use advertising or analytics cookies, tracking pixels or session-replay tools.
• Demo requests: if you request a demo, we receive the information you enter in the form, such as your name, company, email address, phone number, crew size, trade and message, and use it only to respond to you.
• Privacy signals: because we do not sell or share personal information, we treat a Global Privacy Control signal as confirming that choice, and no further action is needed. We do not respond to "Do Not Track" signals, because we do not track visitors across third-party websites.

How Long We Keep Information

We keep personal information only for as long as is reasonably necessary for the purposes described in this policy. To decide how long, we consider how long the information is needed to provide the service, how long the law requires it to be kept, and whether it is needed to resolve a dispute or legal claim.

When a customer's account ends, we delete or de-identify its information as provided in our contract with that customer (see Terms of Service), except where the law requires us to keep it longer. Where more than one period applies, the longer one applies.

Data Security

We maintain reasonable administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, and logging of access to sensitive records. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we confirm a security breach affecting workforce or customer information, we notify the affected company within 72 hours so that it can meet its own obligations. Where IPS is the business responsible for the information, we notify affected individuals as required by law.

Your Rights

If you are a California resident, including as an employee, applicant or contractor, the CCPA gives you the following rights:

• Right to know and access: to request the categories of personal information we have collected about you, its sources, the purposes for which we use it and the categories of recipients, and a copy of the specific pieces of personal information in a portable format.
• Right to delete: to request deletion of your personal information, except information we must keep by law or for another purpose the law permits. If we keep any information, we will tell you which and why.
• Right to correct: to request correction of inaccurate personal information.
• Sensitive personal information: we use sensitive personal information only for purposes the law permits without offering a right to limit, so no separate request is needed.
• Sale and sharing: we do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past twelve months.
• Automated decision support: to ask which indicators were used in a decision about you and to request review by a person (see Automated Decision Support).
• Non-retaliation: we will not discriminate or retaliate against you for exercising these rights, and your employer may not retaliate against you for doing so.

If you live outside California, you may have similar rights under the law of your state. We handle requests in the same way wherever you live.

How to make a request

• In the CDO worker portal, send a request through the assistant or the Requests page;
• by email to team@cdohr.ai, with "Privacy request" in the subject line;
• by mail to the address in Contact Us; or
• through your employer, which may forward your request to us.

We confirm receipt within 10 business days and respond within 45 calendar days. If we need more time, we will tell you before that deadline and take no more than a further 45 days. Requests are free of charge.

Verification. Before we act on a request, we verify your identity by matching information we already hold, such as your employee identification number and contact details. We will not ask for your Social Security number, bank account information or a copy of an identity document to verify a privacy request.

Authorized agents. An authorized agent may submit a request on your behalf with your written permission. We may confirm the request directly with you.

Employment records. Because your employer is responsible for the employment information in CDO, we may forward a request about that information to your employer. If we do, we will tell you, and we will work with your employer so that the request is answered within the timeframes above.

Nothing in this policy limits your right to discuss wages and working conditions with coworkers, your rights to inspect your personnel file and payroll records under California Labor Code sections 1198.5 and 226(b), or your right to file a complaint with the California Privacy Protection Agency or the California Attorney General.

Children

CDO is offered to businesses for their workforce, and our website is intended for businesses. Neither is directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe that a child's information has been provided to us, contact team@cdohr.ai and we will delete it.

Changes to This Policy

We may update this policy from time to time. If we make a material change, we will provide notice through the platform or by other appropriate means before it takes effect. The date at the top of this page shows when the current version took effect. We review this policy at least once every twelve months.

Changes in this version (October 27, 2026). We reorganized this policy and simplified its language; described service providers by category; added a section for customers of companies that use CDO; described the criteria we use to determine retention; and clarified when location is collected outside a clocked-in shift and how to opt out of text messages.

Contact Us

If you have questions about this policy or our data practices, please contact us:

If your question concerns your own employment records, such as hours, pay, schedule or certifications, your employer holds those records and directs how they are handled; we recommend contacting your employer first.

Language. This policy is also available in Spanish. If the two versions conflict, the English version controls, except where applicable law requires otherwise. If you need this policy in another format, contact us.