WorkTalora

Privacy Notice

Last updated: September 16, 2026

This Privacy Notice explains how Summit App Company LLC("Summit App Company", "we", "us", or "our"), operating the WorkTalora service (the "Service"), collects, uses, and shares personal data. Summit App Company LLC acts as the data controller for personal data collected through the Service.

1. Personal Data We Collect

  • Account data: name, email address, login credentials, role (owner, manager, or employee), and company affiliation.
  • Workforce data: schedules and shift assignments, shift notes and comments, time entries with clock-in and clock-out timestamps, breaks, time-off requests, availability preferences, positions, departments, locations, hourly rates, overtime settings, and payroll snapshots generated from those records.
  • Time-clock PINs: if your company uses the shared Time Clock Mode station, each employee has a short PIN. PINs are stored in hashed form and are not readable by us or by other employees.
  • Support communications: your name, email address, optional phone number, request type, subject, and message when you use the in-app support form, plus any follow-up correspondence.
  • Usage and device data: IP address, device identifiers, browser type, operating system, timestamps, and interaction telemetry needed to operate, secure, and troubleshoot the Service.
  • Push token data: device push notification tokens, if you opt in to notifications.
  • Advertising measurement data: if advertising measurement is active for your visit (see section 9), a limited signal that a page view or a sign-up occurred after an ad click, together with the identifiers the advertising platform sets in your browser.

Billing card details are collected directly by our payment provider and are never received or stored by us.

2. How We Use Personal Data

  • Provide, maintain, and improve the Service, including scheduling, time tracking, overtime calculation, and payroll snapshots.
  • Create and manage accounts, company memberships, invitations, and join requests.
  • Send transactional communications (for example invitations, email confirmations, password resets, and shift or time-entry notifications).
  • Respond to support requests you submit.
  • Administer subscriptions, trials, plan limits, and billing status.
  • Measure the performance of our advertising, where permitted (section 9).
  • Prevent fraud, abuse, and security incidents.
  • Comply with legal obligations and enforce our Terms.

3. Legal Bases

Where GDPR, UK GDPR, or similar laws apply, we rely on the following legal bases:

  • Contract: to provide the Service you or your employer subscribed to.
  • Legitimate interests: to secure the Service, prevent abuse, and improve our product.
  • Consent: for push notifications, advertising cookies and advertising measurement, and any other optional feature you opt into.
  • Legal obligation: to comply with applicable law, including tax and accounting rules.

4. What Other People in Your Company Can See

  • Managers and admins in your company can see schedules, shift assignments and notes, time entries, time-off requests, payroll snapshots, hourly rates, and employee availability for the company they manage.
  • Employees can see their own schedule, their own time entries and time-off requests, and their own availability. Employees cannot read other employees' availability, hourly rates, or PINs.
  • Whoever created the company (the owner) can request an export of the company's data and can delete the company.

5. Sharing Personal Data

We share personal data with the following categories of recipients:

  • Merchant of Record: Paddle.com handles the sale of subscriptions, payments, billing, subscription management, sales tax and VAT compliance, and invoicing. Payment data is collected directly by Paddle under their own privacy notice.
  • Hosting, database, and application platform providers: operate the Service infrastructure and store your data on our behalf.
  • Email delivery provider: sends transactional and support emails.
  • Push notification provider: delivers notifications to devices that have opted in.
  • Advertising platform: OpenAI Ads receives advertising measurement signals where permitted (section 9). We do not upload customer lists or contact details to any advertising platform.
  • Your company: as described in section 4.
  • Professional advisers: legal, accounting, and compliance advisers, under confidentiality.
  • Authorities: when required by law, valid legal process, or to protect rights and safety.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Notice.

We do not sell personal data for money.

6. International Transfers

Personal data may be processed in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions.

7. Data Retention

We retain personal data for as long as your account or company remains active, and for a reasonable period afterward to meet legal, accounting, or reporting obligations. Removed employees are marked inactive so historical schedules, time entries, and payroll records stay accurate. When data is no longer needed, it is deleted or anonymized. Company owners can delete their company from the Service, or contact support to request an export or deletion.

8. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, encryption at rest, automated backups managed by our hosting provider, hashed passwords and time-clock PINs, row-level security in our database so each company can only reach its own records, access controls, and least-privilege access for our team.

9. Cookies, Tracking, and Advertising

We use two categories of technologies in your browser:

  • Strictly necessary: authentication and session storage that keep you signed in, plus local storage of your cookie choice. These cannot be turned off without breaking the Service.
  • Advertising measurement (optional): we run an OpenAI Ads measurement pixel on our public pages. It records that a page view or a completed sign-up followed an ad, so we can tell which ads work. It is used for measurement and ad optimization, not to build profiles for other companies, and we do not share your workforce data, schedules, or time records with any advertising platform.

Your choice. If you are in the EU, EEA, or UK, the advertising pixel does not load until you accept it in our cookie banner, and declining keeps it off. Elsewhere, advertising measurement is active by default and you can turn it off at any time. You can change or withdraw your choice whenever you like using (also linked in the footer of our home page). Withdrawing takes effect immediately; we cannot undo measurement that already happened before you withdrew. Your browser's own cookie controls and any "Global Privacy Control" signal it sends are also respected.

We keep a record of the choice you made, when you made it, and the version of this Notice that was in effect at the time.

10. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent at any time. Users in the UK/EEA also have the right to lodge a complaint with a supervisory authority. We aim to respond to verified requests within one month. If you are an employee of a company using WorkTalora, we may refer your request to your employer, who controls your workforce records.

11. US State Privacy Rights

If you live in California, Colorado, Connecticut, Virginia, Texas, or another state with a comprehensive privacy law, you may have the right to:

  • Know and access the personal data we hold about you, and how we use and share it.
  • Correct inaccurate personal data.
  • Delete personal data, subject to legal and recordkeeping exceptions.
  • Obtain a portable copy of your personal data.
  • Opt out of targeted advertising. We do not sell personal data for money and we do not engage in profiling that produces legal or similarly significant effects. Our advertising pixel may qualify as "sharing" for targeted advertising under some of these laws.
  • Not be discriminated against for exercising these rights.

To opt out of targeted advertising, use and decline advertising cookies, or send a Global Privacy Control signal from your browser. To exercise any other right, or to submit a request through an authorized agent, use the in-app support form. We will verify your request against your account details before acting on it, and we do not charge for these requests. If we deny a request, you may appeal by replying to our response; where required, you may also contact your state attorney general.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them.

13. Changes

We may update this Privacy Notice from time to time. Material changes will be communicated through the Service or by email, and where required we will ask for your consent again.

14. Contact

Summit App Company LLC. Privacy inquiries, including access, deletion, and opt-out requests, can be submitted through the in-app support channel.