Privacy Policy

This policy explains how Vantage Enterprises, LLC (“Vantage,” “we”) handles personal information in Vantage Workforce: on our website at vantagewfm.com, in the app at app.vantagewfm.com, and in our phone apps when they are released.

We play two roles, and they matter for who you ask about your data:

• For workspace data, we act for your employer. Most people use Vantage Workforce because their employer set up a workspace and invited them. The employer decides what is collected there and why, and we process it on the employer’s behalf (as a “processor” or “service provider”) under our Data Processing Agreement. Questions about workspace data are best sent to your employer first; see our Notice for Employees.
• For our own purposes, we decide. We are responsible (the “controller”) for account sign-in details, billing contacts, messages you send us, visits to our website, and the records we keep to secure and run the Service.

• Account details. Your name, email address, and password. Passwords are stored by our sign-in provider in a protected form that we cannot read.
• Profile and job details. Job title, department, sites, manager, start date, employee ID, phone, address, emergency contact, birthday (month and day only), certifications, skills, languages, and any custom fields your employer adds.
• Pay and payroll details. Pay rates, and, where your employer uses onboarding to collect them, bank details for direct deposit and tax forms. These are visible only to you and your employer’s admins.
• Payroll records. Payroll is not available yet. When your employer turns it on, also your Social Security number, date of birth, home address, tax withholding choices, and the pay stubs and year-end tax forms that payroll produces. See Section 7 for who receives them.
• Work records. Shifts, availability, time entries and breaks, timesheets, time off requests and the reasons or files you attach (such as a doctor’s note), tasks, form and checklist submissions with photos and signatures, training progress and quiz results, documents you sign or upload, recognitions, and reward balances.
• Messages and files. Chat messages, announcements, comments, support requests, documents and workbooks, and the files and photos you attach.
• What you ask AI features. Questions to Company Bot and the tasks you confirm there, requests to Ask AI and the photos or PDFs you attach, and the text you give the AI tools. See Section 6.
• Your employer’s customers. If your employer uses the Email tool, it keeps a list of its own customers (names, email addresses, phone numbers, visits, and the consent each gave). If it uses Recruiting, applicants’ details come from Vantage Recruiter. We hold these for your employer.
• Billing. For paid workspaces, the billing contact, plan, and invoices. Card numbers are collected and stored by our payment processor, not by us.
• Messages to us. When you fill in our contact form or write to us, your name, email, company, team size, and what you wrote.

• Location at a punch. See Section 4.
• Presence. Whether you are online, away, or on shift, so coworkers can see it in chat and the Directory. This status is cleared when you go offline or clock out.
• Device details. If you turn on notifications, a push address for each device and a device name, up to ten devices.
• Logs. Our hosting provider records requests to our servers, including the IP address, browser, time, and page, which we use to run and secure the Service. Changes in the app keep who made them and when, so a workspace has a record of who changed what.
• Browser storage. One session cookie and a small set of keys in your browser, listed in our Cookie Policy. We use no analytics, advertising, or tracking cookies.

When you clock in, clock out, or transfer between sites in Time Clock, the app asks your device for its location and saves it with that punch, with how accurate the device says it is. While the clock screen is open, the app reads your location so it can show whether you are at your site, but it saves it only with a punch. A form or task can also ask for a location stamp when you submit it.

We do not track your location between punches or in the background, and we do not collect location on the website. Your device asks for your permission first, and you can turn it off in your device settings; your employer decides whether a punch without a location is allowed.

We use personal information to:

• Provide the Service, as each workspace sets it up and as members use it.
• Send notices you need, such as a new shift, a request to approve, or a security alert, in the app and as push notifications if you turn them on.
• Keep the Service secure, prevent abuse and fraud, and investigate problems.
• Answer messages and support requests, and bill paid workspaces.
• Improve the Service, using how features are used, not the content of workspaces.
• Meet legal obligations and enforce our Terms.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use workspace content to train AI models.

Where the GDPR or a similar law applies, our legal bases are: performing our contract with the customer; our legitimate interests in securing and improving the Service; your consent where we ask for it (such as push notifications and device location); and our legal obligations.

When you use an AI feature, what you typed, and the workspace information that feature needs, is sent to Google’s Gemini models through Google Cloud’s Vertex AI, processed in the United States. Under Google Cloud’s terms, Google does not use that information to train its models. AI features only see what the person asking is allowed to see.

• Company Bot does not keep your questions or its answers. When it cannot answer, it saves the question so the workspace’s managers can add the missing article.
• When you confirm a task in Company Bot, such as a time off request, it keeps a record of what it did for you, visible to you and your managers.
• Chat translation: when someone in a chat has picked a language, the text of each message there is sent to be translated, and the translations are kept with the message.
• Ask AI keeps each request, the plan, and what each step did, so you and your managers have a record of what it did for you. A person approves what Ask AI does.
• AI Automations run steps on their own once your employer publishes them, such as messaging or emailing someone, assigning training, or asking teammates to cover a shift. Your employer can also have an automation send workspace information to another system it chooses (a webhook); that system is your employer’s, under its own terms. Each run keeps a record of every step, visible to the workspace’s managers.

Our AI Transparency page explains each feature in detail.

Inside your workspace, what people see follows their role. Coworkers see your name, title, and the profile fields your employer makes visible. Your manager and your employer’s admins see more, such as your hours and requests. Pay and bank details are for you and admins only.

We share personal information outside your workspace only:

• With our subprocessors, the companies that host and run the Service for us, under contracts that protect it. They are listed on our Subprocessors page.
• With services your workspace connects, such as a calendar, a social network, DocuSign, or Vantage Recruiter, and only what that connection needs. You or your employer choose to connect them.
• With our payroll provider, when your employer turns on Payroll. Payroll is not available yet. When it is on, the information needed to run payroll is shared with Check Technologies, Inc. (“Check”): your name, home address, Social Security number, date of birth, bank details for direct deposit, pay and hours, tax withholding choices, and tax forms. Check uses it to pay you and to calculate, file, and pay payroll taxes, and processes it under its own Privacy Policy.
• With payroll add-on partners, when your employer turns one on. If your employer adds a 401(k), workers’ compensation insurance, or benefits to Payroll, the information that add-on needs goes to the licensed partner that provides it, under that partner’s own terms and privacy policy.
• When the law requires it, or to protect people’s safety, the Service, or our rights. We push back on requests that are too broad, and where we can, we tell the customer first.
• In a business transfer, such as a merger or sale, to a successor bound by this policy.

We set one cookie, which only marks that your browser session is open, and keep a few settings and offline copies in your browser so the app works without a signal. There are no analytics, advertising, or third-party tracking cookies, which is why there is no cookie banner. The full list is in our Cookie Policy.

Each workspace is walled off from every other, every sensitive change is checked on our servers, data is encrypted in transit and at rest, and sign-ins end after an hour without activity. No system is perfectly secure; our Security Overview describes what is in place and what is not yet. If we learn of a breach that affects your information, we will tell the affected customers, and you where the law requires, without undue delay.

• Workspace data is kept while the workspace exists, and for as long as the workspace’s own settings say. For example, admins can set chat messages to be deleted after 30, 90, 365, or 730 days.
• Notifications are deleted 60 days after they are created.
• Presence (online and on shift) is cleared when you go offline or clock out.
• Security audit logs of administrative actions and staff access to data are kept for 400 days. Our hosting provider’s request logs are kept for about 30 days.
• When a workspace closes, we delete its data within 90 days, except what the law requires us to keep.
• Messages you send us are kept as long as needed to answer and follow up, and then deleted.

An employer may need to keep some records, such as timesheets, for the period employment law sets. Ask your employer about their records.

Depending on where you live, you may have the right to access your personal information, correct it, delete it, get a copy in a portable form, object to or restrict some processing, and withdraw consent. You can update much of your own profile in the app.

For workspace data, send requests to your employer, who controls it; we will help them answer. If you send a request to us about workspace data, we will pass it to the employer and tell you we did. For data we control, write to [email protected]. We will confirm who you are before acting, answer within the time the law sets, and never treat you differently for using your rights.

In the last 12 months we have collected the categories of information described in Sections 2 to 4: identifiers, professional and employment information, commercial information for billing, geolocation at punches, audio and visual information (photos and signatures you upload), internet activity on our own servers, and inferences only as part of features you use. Some of it, such as bank details, account sign-in details, and precise geolocation, is sensitive personal information; we use it only to provide the Service and never to infer characteristics about you.

We do not sell or share personal information as California law defines those words, and we have not done so in the last 12 months. We do not knowingly collect information from anyone under 16. You can read more, and see how to use your rights, on our Your Privacy Choices page.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights in Section 11 and the right to complain to your data protection authority. We would appreciate the chance to answer your concern first at [email protected].

We store and process information in the United States, on Google Cloud in the us-central1 region. When we receive personal data from the EEA, the UK, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents, as our Data Processing Agreement sets out.

The Service is for people at work and is not meant for anyone under 16. We do not knowingly collect information from children under 16. If you think a child has given us information, write to [email protected] and we will delete it.

We send emails and notices about your account and workspace, such as invitations, security alerts, and billing, which you cannot turn off while you have an account. You can turn notifications from each tool on or off in Settings, Notifications. Marketing emails sent with the Email tool come from the business that sent them, which you can unsubscribe from with the link in each email.

We may update this policy. We record each substantive change in our change history, and when a change matters, we tell workspace owners before it takes effect.

Privacy questions and requests: [email protected]. Legal: [email protected]. Our postal address: