CLENZUS
← Back to site

Clenzus - Privacy Policy

Effective date: July 13, 2026 Last updated: October 18, 2026

Plain-language summary (this is a friendly overview - the full policy below is what governs). Clenzus is software that companies use to run their field teams and the sites they service. Almost everything personal inside Clenzus is put there by, or on behalf of, your employer - your profile, your schedule, your hours, your pay information, and photos of completed work. Your employer decides what goes in, turns features on or off, and is responsible for telling you about it and getting any consent the law requires. Clenzus simply stores and protects that information so the software can do its job for your company. We are not in the business of reading your records: our platform-wide reporting of operational activity shows only combined, de-identified numbers, and we never see your password. Authorized security staff access an individual account only when genuinely needed to run, secure, support, or fix the Service, or when the law requires it. We do not collect your fingerprint or your face - any biometric check happens privately on your own device. Location tracking is off unless your company turns it on, and when it is on, you are asked to agree first and shown a clear indicator on your profile that it is on and which mode is active. This policy explains all of that in detail.

This Privacy Policy describes how Clenzus ("Clenzus," "we," "us," "our") - operated by Clenzus Inc., a corporation governed by the laws of the Province of Manitoba, Canada - collects, uses, stores, shares, and protects personal information in connection with the Clenzus web application, mobile applications, application programming interfaces, and related services (together, the "Service"). It forms part of, and is incorporated into, the Terms of Service. Please read both together. If there is any conflict between a short summary and the detailed terms, the detailed terms control.

1. Who Clenzus is built for

Clenzus is workforce and operations software built for companies that deliver services in the field - that is, any business whose people work across one or more customer sites, buildings, or locations rather than only at a single head office. This includes, without limitation, commercial cleaning and janitorial companies, facility-management and building-services providers, security and guarding firms, maintenance and repair businesses, landscaping and grounds companies, and other service-provider organizations that need to schedule crews, confirm attendance, track work, and keep their clients happy.

Clenzus is used by companies in most countries, across many industries. The Service is not yet available in the EU/EEA, the United Kingdom, Switzerland, India, the United Arab Emirates, or Saudi Arabia (coming soon - see Section 12.3), where we are still completing local data-protection requirements. Customers everywhere are responsible for using the Service in line with the laws that apply to them, their workforce, and their clients.

Because the Service is built for these organizations, most of the personal information it holds is information about a company's own workforce and its own clients, entered and controlled by that company. Understanding this is the key to understanding this policy, so we explain it next.

2. The most important thing to understand: who controls your information

Privacy law draws a line between the party that decides what personal information is collected and why (the "controller"), and the party that merely stores and processes that information on the controller's instructions (the "processor" or "service provider"). Clenzus sits on both sides of that line depending on whose information it is, and this shapes everything else in this policy.

2.1 For your company's workforce and client information, Clenzus is only the processor

For the operational and workforce information that a company (our "Customer") and its authorized users put into, or generate within, the Service - for example personnel records, schedules, hours, location signals (where enabled), pay information, photos of work, complaints, tickets, deficiencies, equipment issues, inventory and supply requests, site records, and client and contract records - the Customer is the controller and Clenzus is only the processor. In plain terms:

  • Your employer decides what is entered, what features are switched on, who can see what, and how

long it is kept.

  • Clenzus holds that information on your employer's behalf, so the software your employer chose

can actually run - the same way a filing cabinet or an accountant holds records for a business.

  • Clenzus does not use that information for its own purposes. We do not sell it, we do not

advertise with it, and we do not mine the content of your records to build unrelated products.

If you are a worker, supervisor, or administrator using Clenzus because your employer provisioned it for you, your employer - not Clenzus - is the party that decides what is collected about you and why. For most questions or requests about your personal information, you should contact your employer first; we will help your employer respond.

2.2 For our own business information, Clenzus is the controller

For the limited information we collect directly to run Clenzus as a business - such as the details used to create and bill an account, and the security and audit records we keep to protect the platform - Clenzus is the controller, and this policy describes how we handle it. This includes the business contact details of a company's primary administrator(s) - name, work email, and phone number - which we retain so that we can reach that company about its account (for example, for provisioning, support, security, and billing matters). We use these details for account and contact purposes only; we do not use them for advertising, and we do not sell them. It also includes business-verification information you provide when we ask you to confirm you operate a legitimate business (see Section 4.9), which we collect and review as a controller and then delete.

2.3 A Data Processing Addendum is available to business Customers

Because Clenzus is a processor of the Customer's workforce and client data, business Customers - and, should the Service open to Customers subject to the EU or UK GDPR, those Customers - are covered by the Data Processing Addendum (DPA), which is incorporated into the Terms of Service and takes effect when the Customer accepts the Terms (no separate signature required). The DPA sets out, under Article 28 of the GDPR (and equivalent UK rules), how Clenzus processes personal data on the Customer's instructions, the security and confidentiality commitments, the rules for engaging subprocessors, how Clenzus assists with data-subject requests and breach notification, the international-transfer safeguards, and how data is returned or deleted at the end of the relationship. A Customer that needs a signed copy may request one at legal@clenzus.com.

3. What "Clenzus does not see your data" really means

We want to be honest and precise here, because trust matters and because vague promises help no one.

  • We do not read the content of your operational records. Clenzus is designed so that the people

who operate the platform do not browse the contents of a company's individual operational records (the descriptions inside tickets and complaints, photos, notes, or site and facility details) in the ordinary course of business. Our platform-wide monitoring of that activity is deliberately limited to aggregate, de-identified numbers - for example, "how many tickets were opened across the platform this week" - and is built so it does not surface the content inside any specific company's records.

  • We never see your password. User passwords are stored only as a one-way cryptographic hash.

No one at Clenzus - including our security staff - can view, retrieve, or read your password. If a password reset is ever performed, it replaces the password with a new one; it does not reveal the existing one.

  • Account and identity information is accessed only for security. A small number of authorized

security staff can, when there is a specific need, see account-level information - such as a user's name, email address, role, whether an account is active, and account-security details such as a verification PIN - and perform account-security actions such as forcing a password reset or disabling an account. This is not part of day-to-day operation and is never used to read your work. It is reserved strictly for genuine security and account-integrity purposes - for example investigating a suspected breach or account misuse, acting on an authorized request from the platform operator, or protecting the Service and the people who use it. Access of this kind is limited to what is needed and is logged.

  • When we access anything else, it is narrow and purposeful. Like any hosted software provider, our

systems and authorized staff can technically access stored data when it is genuinely necessary - for example to keep the Service running, to provide support you or your employer request, to fix a defect, to make a lawful backup, or to comply with a legal obligation. We limit that access to what is needed, and we log it. The same limits apply to the AI-assisted tools described in Section 7.1.

  • Your data belongs to your company, not to us. As between Clenzus and the Customer, the Customer

owns its data. We keep it safe and available to the Customer; we do not treat it as ours.

In short: the reason this information lives in our database at all is so the software can do its job for your company - not so that Clenzus can read it. That is a meaningful and enforceable distinction, and it is how the platform is built.

4. Information stored in, or collected through, Clenzus

Below is the full picture of what may be present in the Service. Where an item is entered or controlled by your employer, we hold it as a processor (Section 2.1). Where an item is collected by us directly, we act as a controller (Section 2.2). We call this out for each category.

4.1 Account and identity information (entered/controlled by your employer)

Basic details that let the software recognize a person and give them the right access: name, work email address, phone number, an employee identifier, role, employment date and status, department or position, emergency-contact details, and profile information. Each account has a four-digit access PIN, which the Service generates automatically (users do not choose it) and stores in encrypted form, so it cannot simply be read back. A user's PIN is issued and managed by the people above them in their organization's reporting chain - a manager can regenerate and view the PIN of the users who report to them - and only the company's senior administrators may regenerate their own PIN. A user may instead turn on multi-factor authentication using an authenticator app for stronger sign-in protection; while it is on, the PIN is not required, and if the authenticator is lost an authorized administrator can remove it and re-issue a PIN. This information exists so the right person can log in and see the right things - it is provided under your employer's control, and we do not use it for our own purposes.

4.2 Human-resources and payroll information (entered/controlled by your employer)

Where a company chooses to run pay-related workflows in Clenzus, the software may hold pay rate, payroll file numbers and payroll identifiers, earning codes, partial tax identifiers (for example, only the last few digits of a government identification number), tax identifiers, and the codes used to line data up with an outside payroll provider (for example, ADP or Paychex identifiers). It may also hold your pay type (hourly or salary), a yearly salary, your usual weekly hours, a setting that says whether California overtime rules apply to you, and extra overtime hours or bonus amounts that a manager adds by hand (with any note the manager writes). When a week of hours is approved, the Service also saves a copy of the pay rules used for that week (for example your rate, pay type, and the company's overtime and premium settings). That saved copy does not change later, so a later raise or settings change does not re-price a week that was already approved. Your employer decides whether to use these fields at all and what to put in them. Clenzus stores this so your employer can prepare and reconcile pay accurately; we do not read it for any purpose of our own.

Payroll files. When your employer exports payroll (for example a CSV, QuickBooks, Gusto, ADP, or Paychex file), the file is made on your employer's own device and downloaded there. Your employer sends it to its own payroll company. Clenzus does not send payroll files to anyone, and your employer's payroll company is not a subprocessor of Clenzus - it works for your employer, under your employer's own agreement with it.

Some plans also give your employer a secure document store attached to an employee record, used to keep employment paperwork such as contracts and agreements, identification documents, certifications, licences, and training or compliance records. Your employer decides what, if anything, is uploaded there. These files are held with heightened protection (Section 11), are reachable only by the small set of roles your employer has authorized, and are served through short-lived links rather than public addresses. We do not open or use their contents for any purpose of our own.

4.3 Location and attendance information (off unless your employer turns it on - see Section 6)

When - and only when - a company switches on a location feature, the Service may process location signals to confirm attendance. This is one of the most sensitive areas, so it has its own detailed section below (Section 6, "Location and GPS"). The short version: location is off by default, nothing is tracked or stored while it is off, and when it is on everyone is clearly and continuously notified.

4.4 Photographs and work evidence (entered/controlled by your employer)

Photos that users attach to complaints, tickets, inspections, deficiencies, site audits, before/after records, and similar items. These are stored as proof of work - for example, to show a site was serviced properly - and may show the interior or condition of a building. Your employer decides whether and how photos are used.

4.5 Operational records (entered/controlled by your employer)

The day-to-day records that make the software useful: schedules and shifts; time and attendance punches; complaints, tickets, deficiencies, equipment issues; inventory and supply requests; site and facility records; points of contact; client and contract records (including contract values and the reasons a contract ended); notifications; and site notes. These are the substance of your company's operations and are controlled by your company.

Performance, reliability and disciplinary records. Where your employer uses these features, the Service also holds records about how work is going. That includes performance ratings a manager records about an employee, a disciplinary register of warnings (for example verbal, written, or final) together with the description, any corrective action, and any statement the employee gives in response, and reliability indicators that the software calculates automatically from attendance data already in the system - for example lateness, missed shifts, or absence patterns, which may be presented to managers as a score or a status.

Two things matter about the automatic indicators. First, they are advisory signals for a human, not decisions: Clenzus does not discipline, rank, promote, or dismiss anyone, and no employment decision is made automatically by the Service. Any decision is made by your employer, who is expected to review the underlying facts. Second, this is your employer's data, entered and controlled by them - if you disagree with a rating, a warning, or an indicator, raise it with your employer, who can correct it (see Section 12 for your rights and how we help).

4.6 Communications (some to us, some within your company)

Messages you send to Clenzus (for example, a support request or the contact form) are handled by us as a controller. If you join our early-access or waitlist list, we keep the details you give (such as your name, email, business name, country, and team or site size) to tell you about launches and availability; you can unsubscribe at any time. Comments and discussion you post inside a record in the Service are operational content controlled by your employer.

4.7 Device, log, and security information (collected by us to protect the platform)

To keep accounts and the platform safe, we and our infrastructure providers automatically record a limited set of technical signals: the IP address a request comes from and the city, region, and country derived from it; browser/device information and the last device an account was verified on; and sign-in, session, and account-activity records that form a security audit trail. We use this strictly to protect you and your company - for example, to notice an unusual sign-in by comparing where an account is signing in from against where that person is expected to work, to power multi-factor authentication, and to investigate suspected fraud or account misuse. This is not marketing data, and we do not use it to profile you. These security and sign-in records are kept for up to 180 days and are then automatically and permanently deleted.

To prevent abuse, we keep short-lived counters of attempts on forms such as sign-up and password reset, keyed to a one-way hash of your IP address; after repeated attempts you may be asked to complete a human-verification check (see Section 9). When you accept our Terms and this Privacy Policy, we record when you accepted, which version, and the IP address and browser used, as proof of acceptance.

If you enable push notifications on a device, your browser or operating system gives us a push subscription token (a device-specific delivery address and its keys). We store it only to deliver the alerts you have turned on, we transmit those alerts through your browser/OS push-delivery service (for example Google, Apple, or Mozilla - see Section 9), and you can revoke it at any time by turning off notifications for Clenzus in your device or browser settings.

4.8 Usage information (collected by us to run and improve the Service)

General information about how the Service is used - which helps us keep it reliable, secure, and better over time. Where possible this is handled in an aggregated form (Section 8).

4.9 Business-verification information (collected by us as controller)

If you register with a free or personal email address, we may ask you to provide a document that shows you operate a real, registered business (for example a business licence, a registration or incorporation certificate, or a tax registration). We collect this only to confirm you are a legitimate business, we hold it only for as long as it takes to review it, and we delete the document once verification is complete - keeping only a minimal record that verification occurred (its date, method, and the type of document reviewed - see Section 10). It is stored with heightened protection (Section 11) and is accessible only to the small number of people authorized to perform verification.

4.10 Candidate and former-employee information (entered and controlled by the company)

Cleaning and facilities work often needs a role filled quickly, so companies that use Clenzus can keep a short talent list - people they have already met, interviewed, or had recommended to them, and would like to contact first when a position opens up. A record is usually just a name, the general area someone is in, a phone number, and a brief note from whoever met them.

To be clear about who does what here: the company using Clenzus creates and manages this list. Clenzus does not build it, does not add anyone to it, does not look through it, and never uses it for any purpose of our own - we simply store it for that company alongside their other records, in the same way a filing cabinet holds their paperwork. If you would like to know what a company has noted about you, or would like it removed, just ask that company directly. If you are not sure who to ask, email us at privacy@clenzus.com and we will help you reach the right people.

The Service also keeps a record of people who have left a company - the fact and date they left, the reason where the company records one, and the work history that already existed. When someone leaves, their login is turned off, so they can no longer sign in. Their work and pay history stays with the company, because the company usually has to keep it by law. If the former employee asks, the company can erase their personal details; when it does, the documents stored about them are deleted, and the Service keeps a record that the erasure happened (when, who did it, and what was erased and what was kept). How long this is kept, and exactly what erasure removes, is described in Section 10.

We do not intentionally collect special-category or "sensitive" personal information beyond the limited payroll identifiers described above, and we ask Customers not to enter sensitive information the Service is not designed to hold.

5. Biometric information - we do not collect it

Clenzus offers on-device biometric verification (for example, Face ID or a fingerprint) and passkeys (WebAuthn) as an optional way to confirm that the right person is signing in or clocking in. It is off by default and can be turned on by the company on eligible plans. Passkeys are always optional for signing in. If your company turns on the clock-in check, clocking in asks for a quick confirmation on your own phone, and you can use your phone's own passcode instead of your face or fingerprint if you prefer. Whether or not you use this feature, the design principle below never changes - and it is important to understand exactly how it works, because biometrics are heavily regulated and often misunderstood:

  • The biometric check happens entirely on the user's own device, using the device's own secure

hardware (the same mechanism that unlocks the phone itself).

  • Clenzus never collects, receives, stores, or has access to any fingerprint, faceprint, face

geometry, or other biometric identifier. None of it ever leaves the device or reaches our servers.

  • All the device tells the Service is a simple yes/no: whether the on-device check succeeded. We

store only that result, not the biometric itself.

  • For passkeys, what is kept on our side (by our authentication provider) is a public key - a

code that can only check a sign-in made with the matching private key, which never leaves your device. A public key is not a fingerprint or a face, and nothing about your body can be learned from it.

Because the biometric never comes to us, Clenzus is not a collector of biometric information, and using this feature does not put your fingerprint or face into our database - it stays with you, on your device, under your control.

To be precise: the pass/fail result is not a biometric identifier or biometric information. It is not derived from, does not contain, and cannot be used to reconstruct any fingerprint, faceprint, face geometry, or other biometric. Clenzus performs no server-side biometric matching, does not compare photographs to identify or verify anyone, and does not store any biometric template in its database. Biometric verification results are never sold, disclosed, or included in aggregated or de-identified information. Because no biometric identifier or biometric information is ever collected, received, stored, or possessed by Clenzus, the laws that regulate the collection or possession of biometrics - such as the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act, and Washington's biometric law (RCW 19.375) - do not impose their collection, retention, or destruction duties on Clenzus. Where a Customer enables this feature, the Customer is responsible for any notice or consent those laws require of the employer.

6. Location and GPS - how it works, and how we keep it fair

Clenzus is built so companies can prove that field work actually happened - the crew arrived, at the right place, at the right time. Location features exist to serve that legitimate operational need. Because location is sensitive, we designed these features around three firm principles: it is off unless your company deliberately turns it on; you are always told when it is on; and your company chooses the least-intrusive mode that meets its needs.

6.1 Location is off by default - and off means nothing is collected

If your company does not use location - whether because it chooses not to, or because it cannot for legal, labour, or practical reasons - then GPS is simply off. When it is off, the Service does not request your location, does not track you, and does not store any location data at all. There is no hidden collection. No signal is captured "just in case."

6.2 If location is on, you are asked first and shown a clear indicator

When a company enables a location feature, the Service asks the affected user to agree before location is used, and shows a clear "location is on" indicator - including which mode is running - on the user's profile. The point is that no one is tracked without being asked and being able to see that it is on, and that your employer (the party that controls this) has provided any notice and obtained any consent the law requires before turning it on.

Only the field staff who clock in are ever located - specifically Personnel and Supervisors. Team Admins and every other role (Account Manager, HR, Finance, Global Admin, Assistant, and the account Owner) are never located, never tracked, and are never even asked to enable location, in any mode - because they do not clock in. Field staff agree once, when location is first turned on. Whenever your company later changes the location mode, the affected field staff are notified of the new setting with an on-screen notice the next time they use the Service, so they always know which mode is running. If they decline, they are not located - but they also cannot clock in while location is on for their company, until an administrator resets their choice (they are then asked again).

6.3 The four location modes, explained

Your company selects one of the following modes for the whole company - the same mode applies at every site - so tracking is never more than your company has chosen:

  • Mode 1 - Off (no location). The default. Attendance is recorded by clock-in and clock-out

only. No coordinates are requested, captured, or stored, ever. This is the most private option.

  • Mode 2 - Geofence / radius check. A privacy-minimal "am I at the right place?" check. When a

user clocks in, the Service confirms the device is within the company's set radius of the site. It is used to allow or block the clock-in - it does not save the user's coordinates and does not follow the user anywhere. It answers a single yes/no question at the moment of clock-in. If no location fix can be obtained, the clock-in may still be recorded and flagged for a manager to review.

  • Mode 3 - Point-of-action capture (clock-in / clock-out only). The Service records the location

at the exact moment a user clocks in and clocks out - and at no other time. There is no tracking in between. Managers can later see where the clock-in and clock-out happened, as proof of presence, but no one can watch a person move during the shift, because nothing in between is collected.

  • Mode 4 - Live location during a shift. For companies that need the highest accountability, the

Service can show a user's location on a map while a shift is active, so the team can see that people are where they should be and are safe. This mode captures the most, and is therefore the one that requires the clearest notice and, where applicable, consent - which your employer is responsible for handling before enabling it. Live location is tied to the active shift; it is not a round-the-clock tracker of your personal life. It runs only while the person is clocked in and stops when they clock out - outside a clock-in no new location is collected, and any last position drops off the map within 30 minutes.

6.4 Facility coordinates

Separately from tracking people, the Service converts the site addresses your company enters into map coordinates (geocoding), so sites can be placed on a map and used for the geofence check. This is information about places, not people.

6.5 Who is responsible

Whether any location feature is on, which mode is used, and for whom, is entirely your employer's decision, made through its administrators. Clenzus provides the tools and the notices; your employer is the controller and is responsible for the lawful basis, the notice, and any consent required by employment, labour, privacy, or electronic-monitoring law before enabling location tracking.

7. How we use information

We use personal information for the following purposes, and - where we act as a processor - only to provide the Service and only on the Customer's instructions:

  • to provide, operate, maintain, and secure the Service;
  • to create and manage accounts and enforce role-based access, so each person sees only what they

are permitted to see;

  • to record time and attendance and, where the Customer has enabled it, to verify location at

clock-in and enforce a geofence (Section 6);

  • to deliver notifications and to enable the in-app records and communications the Service

provides;

  • to process pay-related information as directed by the Customer, so the Customer can prepare and

reconcile payroll accurately;

  • to protect accounts and the platform - including detecting and investigating unauthorized

access, comparing sign-in location against expected work location, and enforcing multi-factor authentication;

  • to provide support and respond to requests from you or your employer;
  • to produce aggregated, de-identified statistics and benchmarks used to operate, analyze, and

improve the Service (Section 8); and

  • to comply with law and enforce our Terms.

We do not use the content of a Customer's operational records to make decisions about you; those decisions are made by your employer using the tools the Service provides. Where the Service calculates an indicator from your employer's own data - for example the attendance-based reliability signals described in Section 4.5 - it is produced for your employer to interpret, it is not used by us for any purpose of our own, and it never results in an automatic decision about your employment. A human at your employer decides, and can correct the record.

7.1 AI-assisted tools

Like many software companies, we may use AI-assisted tools (for example AI coding and analysis assistants) to help us develop, maintain, secure, test, troubleshoot, and improve the Service. While doing that work, these tools may process data held in the platform, including personal information. When they do, it is under our direction and our access controls, and only to run and improve the Service. We do not sell data, and we do not allow customer data to be used to train third-party AI models for the tool providers' own purposes. Access is limited to what the task needs, and it is monitored. The providers of these tools are listed with our other service providers in Section 9.

8. Aggregated and de-identified information

We create aggregated, de-identified information from use of the Service, and we use it to run, secure, analyze, and improve the product and to produce statistics and benchmarks. "Aggregated and de-identified" means the information has been combined across many sources and stripped of identifiers, so that it does not identify any Customer, worker, client, building, or individual and cannot reasonably be used to do so. As noted in Section 3, our platform-wide monitoring of operational activity works at this aggregate level - surfacing only numbers, never the content of any individual operational record; account-level access is separate and, as described in Section 3, is used only for security and account-integrity purposes. We will not publish aggregated information in any form that identifies anyone. We commit to maintain and use aggregated and de-identified information only in that form, and we will not attempt to re-identify it. Our right to use aggregated, de-identified information continues even after an account ends.

9. How we share information

We do not sell personal information. We share it only in the limited ways described here:

  • Within your own company's organization, according to the roles and access your company's

administrators configure. (This is how the software is supposed to work - a supervisor sees their team, an administrator sees the company, and so on.)

  • With service providers ("subprocessors") that host, run, and support the Service for us. We choose

reputable providers, give each one only the information it needs for its task, and use them under their published terms and, where the provider offers them, their data processing terms. The providers we use today are named below under "Our service providers".

  • For legal reasons - to comply with applicable law, to respond to a lawful request from a public

authority, or to protect the rights, property, or safety of Clenzus, our Customers, or others.

  • In a business transfer - in connection with a merger, acquisition, financing, or sale of

assets, in which case this policy continues to apply to the information transferred.

Our service providers. These are the outside services the Service uses today, and what each one does:

  • Supabase - our main database, sign-in (authentication) service, and the backend that stores

Customer Data.

  • Netlify - hosts the website and runs the application's server code, so Customer Data passes through

it whenever the app reads or saves information.

  • Cloudflare - three services: (1) our domain name service (DNS) and network protection - all website

and app traffic passes through Cloudflare, which processes your IP address, basic browser and device details, and the address of the page requested, to deliver pages securely and block attacks such as denial-of-service floods and malicious bots; (2) Cloudflare R2, which stores uploaded photos and documents; and (3) Cloudflare Turnstile, a human-verification check shown after repeated attempts on the sign-up, password-reset, waitlist, and contact forms, which receives only your IP address and basic browser signals.

  • Resend - sends account, security, and notification emails. It receives the recipient's email

address and the message.

  • Stripe - processes subscription payments (see "Payments (Stripe)" below).
  • Geoapify - turns the site addresses your company enters into map coordinates, and suggests

addresses as you type. If it is unavailable, we use the free public OpenStreetMap Nominatim and Photon (Komoot) address services for the same purpose. These services receive the address text being looked up, not names or other records.

  • FreeIPAPI - a public service that tells us the approximate city, region, and country of an IP

address. We use it for the sign-in security checks in Section 4.7 and to apply the correct regional availability. It receives the IP address only.

  • Google Analytics - measures how the website and Service are used, in aggregate and pseudonymous

form, and is loaded only if you choose "Accept" (Section 15). It is not used for advertising and receives no payroll, financial, or sensitive personal records.

  • Map display and web fonts - the live map loads map pictures ("tiles") from OpenStreetMap

servers and map pin images from unpkg (a public file server), and our pages and some of our emails load typefaces from Google Fonts. These services receive your IP address and basic browser details when your browser or email app asks for these files, and the map tile servers can tell which map area is being shown. They receive no names, records, or other Customer Data.

  • Push notification services - if you turn on push notifications, alerts are delivered through your

browser's or device's own push service (for example Google, Apple, Mozilla, or Microsoft). The alert is sent to them in encrypted form, together with your device's delivery address.

  • AI tool providers (for example Anthropic) - AI-assisted tools used to help us develop,

maintain, secure, test, troubleshoot, and support the Service, as described in Section 7.1.

Some of these services - the free public address and IP lookup services, the map and font servers, and the browser push services - are used under their standard public terms rather than an agreement signed with us. We send them only the limited information described above.

Payroll companies are not our subprocessors. Payroll files are made on your employer's own device and sent by your employer to its own payroll company (Section 4.2). Clenzus does not send them, and that payroll company is not a subprocessor of Clenzus.

Payments (Stripe). Paid subscriptions are processed by Stripe, Inc. ("Stripe"), our payment subprocessor. Card and bank details are entered directly into Stripe's secure, hosted payment pages - Clenzus never sees, receives, transmits, or stores your full card number, bank-account number, CVC/security code, or other sensitive payment credentials. We receive back from Stripe only limited, non-sensitive billing details (for example the card brand, the last four digits, the expiry, the billing country, and the payment status) to manage your subscription. Stripe processes your payment information as its own controller under the Stripe Privacy Policy and the Stripe Services Agreement. All billing is conducted exclusively in United States Dollars (USD) (see the Terms of Service for payment terms). Free and complimentary provisioning involves no charge and no payment details.

The list above is our current list of subprocessors. For more detail about a provider (such as its legal entity and where it processes data), email privacy@clenzus.com. Where required by the privacy laws that apply to a Customer, we will give affected Customers advance notice before a new subprocessor begins processing their personal information, together with a reasonable opportunity to object.

10. How long we keep information

We keep personal information for as long as it is needed to provide the Service and as directed by the Customer, and after that only for as long as required to comply with law, resolve disputes, and enforce our agreements. A Customer may archive or request deletion of its data. Some information may persist for a limited time in secure backups, or where the law requires us to keep it, and aggregated, de-identified information (Section 8) may be kept indefinitely because it no longer identifies anyone. After an account is terminated, the Customer may request an export of its data within 30 days, after which we may delete or de-identify it, subject to any legal retention requirements.

Audit-log retention. The audit-activity log described in Sections 4.7 and 11 (the history of administrative and operational actions shown on the Audit Logs screen) is kept for up to 180 days and is then automatically and permanently deleted by a scheduled retention process. Audit records with no associated company are deleted after 7 days.

  • What your company sees. Inside the Service, each Customer can view and export only the most

recent part of this history allowed by its subscription plan (for example, 7, 30, 90, or 180 days). The window for each plan is shown in the plan's feature details. Free accounts do not include the audit log screen.

  • Why we keep up to 180 days. Records older than your plan's window, up to the 180-day limit, are

not shown in the Service. We keep them only so they can be provided on a verified request from the Customer's authorized administrator, to investigate and respond to security incidents, fraud, or abuse, or where the law requires it. They are not used for any other purpose.

  • Changing plans. Moving to a lower plan narrows what you can see on screen, but does not delete

history sooner than the 180-day limit.

Business-verification documents. Any document you submit to verify your business (Section 4.9) is kept only until verification is complete and is then deleted. We retain only a minimal record that verification took place - its date, method, and the type of document reviewed - not the document itself.

When a Customer removes, resets, or archives a record within the Service - for example a site, a contract, or its operational history - that record is generally hidden from the Customer's day-to-day users but may be retained in the underlying system for the Customer's own recordkeeping, audit, security, and legal purposes, and to support the Customer's authorized administrators. Retained records remain subject to the Customer's instructions and to this policy.

Responding to individual deletion requests. Where an individual asks for their personal information to be deleted (see Section 12), the Customer - acting through the Service - can erase that person's personal details once the person has left the company (the Service only allows erasure for former employees, whose login has already been turned off). Here is exactly what happens:

  • What is erased. The person's name is replaced with a label such as "Former Employee 1234". Their

first, middle, and last name, email address (including any older email address kept on file), phone number, emergency-contact details, the last digits of their government ID number (for example the last four of a Social Security number), and the record of the last device they signed in from are cleared. Their login email is replaced with a meaningless address. Their name is also removed from their departure record and from their submitted hours. Documents stored about them in the employee document store (Section 4.2) are deleted, both the files and their entries.

  • What is kept. Time and attendance records (such as clock-in and clock-out entries), **submitted

and approved hours, and pay and wage records, together with the payroll identifiers that link those records together** - the employee ID, payroll ID, and payroll file number - and the person's department. These are kept because the Customer usually must keep them under tax, payroll, and employment law, or may need them for legal claims. They no longer carry the person's name, but because the payroll identifiers are kept, the Customer can still match them to its own payroll records.

  • A record of the erasure. The Service keeps a record that the erasure happened: when it was done,

who did it, what was erased, and what was kept.

  • Other records. We also keep the person's security and sign-in records (Section 4.7), the record of

their acceptance of our Terms and this Privacy Policy, audit-log entries (for the period above), and work content they added to company records, such as photos and comments.

Records kept on this basis are held only for the period, and for the purposes, that the applicable law permits, after which they may be deleted or further anonymized. This reflects the limits that data-protection laws place on the right to erasure where continued retention is legally required or necessary for legal claims.

Locked accounts. If we reasonably believe an account does not belong to a business in this field, or was opened for a harmful or bad-faith purpose (for example to copy the Service, to misuse information, or to commit fraud), we may lock, suspend, or delete it, as described in Section 16.5 of our Terms of Service. When we lock an account, we keep the minimum information needed to enforce that decision - such as the email addresses and business name involved and the reason - so the same people or business cannot simply register again, and we keep it only as long as needed for that purpose and to protect our legal rights.

11. How we protect information

We use technical and organizational safeguards designed to protect personal information, including:

  • Encryption in transit, so information is protected as it travels between your device and the

Service, and field-level encryption at rest (AES-256) of the most sensitive stored identifiers - including the access PIN, partial tax identifiers (such as the last four digits of a Social Security or equivalent national ID number), payroll file numbers, and a company's tax identification number (such as an EIN) - so they cannot simply be read from storage. These fields are additionally protected by strict tenant isolation and role-based access controls (described below), and are decrypted only when an authorized payroll/HR/administrator role reads them. A person's access PIN can also be shown to a manager above that person: the company's owner, a global administrator, or HR can see the PIN of someone below their own role, and a supervisor or team administrator can see it only for people in their own team (the people who report to them, directly or through others). No one can see the PIN of someone at or above their own role, the PINs of owners and global administrators cannot be shown at all (they can only be reset). As Section 3 explains, a small number of authorized Clenzus security staff can also see it, only for security purposes;

  • Strict tenant isolation and row-level security, so that one company's data is walled off and

is not accessible to another company;

  • Role-based, least-privilege access controls, including the data-minimizing oversight design

described in Section 3, where routine oversight sees only aggregate numbers rather than record content;

  • Layered verification for sensitive actions - the most sensitive functions require an additional

identity confirmation beyond an ordinary sign-in, and are available only to a small number of authorized people, never on a casual or open-ended basis;

  • Accountable, tamper-resistant access records - when an authorized person accesses account

information for a support or security reason, that access is tied to a specific, recorded purpose and written to a tamper-resistant record engineered so that these access entries cannot be altered or deleted in the ordinary course of operating the Service, so every such access can be accounted for afterward;

  • Sign-in anomaly detection - the Service is designed to flag unusual sign-ins (for example, from

an unexpected location, by comparing where an account signs in from against where that person is expected to work) and to raise them for prompt security review.

Security incidents and data-breach notification. If we become aware of a security incident (a personal-data breach) affecting Customer Data, we will notify the affected Customer(s) without undue delay and cooperate with their breach-response and notification obligations, consistent with applicable law (including, as applicable, PIPEDA, Québec Law 25, the GDPR, the Australian Notifiable Data Breaches scheme, and the New Zealand notifiable-privacy-breach scheme). Where Clenzus is the processor, the Customer (as controller) remains responsible for notifying affected individuals and any regulator; where Clenzus is the controller of information it collects directly (Section 2.2), it will make any notification the law requires to the relevant regulator (including, as applicable, the Office of the Privacy Commissioner of Canada, the OAIC, or the New Zealand Privacy Commissioner) and to affected individuals.

Reporting a security issue. If you think you have found a security problem in Clenzus, please email support@clenzus.com with "Security" in the subject line, and we will look into it promptly. Our security contact details are also published at https://www.clenzus.com/.well-known/security.txt.

No method of transmission or storage can be guaranteed to be perfectly secure, and we cannot promise absolute security. You and your company share responsibility by keeping credentials, PINs, and authenticator devices confidential and by removing access promptly when someone leaves.

12. Your privacy rights

Depending on where you live and your relationship to us, you may have rights to access, correct, update, delete, or receive a copy of your personal information, to object to or limit certain processing, to data portability, and to withdraw consent. Where any privacy law uses terms like the "sale" or "sharing" of personal information, Clenzus does not sell or share your personal information in that sense. As stated throughout, we do not sell personal information.

Because Clenzus does not sell personal information or use it for targeted advertising, opt-out preference signals (such as Global Privacy Control) do not apply to our processing, and Clenzus is not a data broker and is not required to register as one. Some information the Service can process - such as precise location (where a Customer enables it) and government or payroll identifiers - is treated as "sensitive" under some privacy laws; where Clenzus is the processor, it handles this only on the Customer's instructions, and the Customer, as controller, is responsible for any opt-in consent those laws require.

12.1 How to route a request (the controller/processor split)

Because of the controller/processor split (Section 2), where to send a request depends on whose information it is:

  • For workforce and client information held on your employer's behalf (most of what is in

Clenzus), Clenzus is only the processor. The Service does not currently offer self-service export or erasure directly to individual workforce members, because your employer (the Customer) is the controller that decides what is collected and kept. Please make your request to your employer; we will assist the employer's administrators, through the tools in the Service, to identify, export, correct, or delete the relevant records as their processor. The employer's own Owner, HR, and administrator accounts hold the in-Service access needed to fulfill these requests.

  • For information Clenzus controls directly (account, billing, and security information - Section

2.2), contact us at privacy@clenzus.com. We may need to verify your identity before we act, so that we do not disclose information to the wrong person. We will respond within the timeframe the applicable law requires.

  • To request deletion of your Clenzus account, ask your employer first: your company's Owner manages

your account and can remove your access. You can also use the account deletion request form, which needs no login. We verify your identity by replying to your account email before we act. Records an employer must legally keep (such as payroll and time records) are retained as described in Section 10.

You will not be discriminated against for exercising any of these rights.

12.2 Canada - PIPEDA and Québec Law 25

Residents of Canada have rights under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Québec's Law 25 and the Personal Information Protection Acts (PIPA) of Alberta and British Columbia. These include the right to access and correct your personal information and to complain to the Office of the Privacy Commissioner of Canada (or the applicable provincial regulator). Our lawful basis in Canada is consent (express or implied) and the other bases PIPEDA and Law 25 permit.

12.3 European Union / EEA, United Kingdom and Switzerland - GDPR, UK GDPR and nFADP

If you are in the EEA or the UK, the EU GDPR and UK GDPR apply.

  • Roles. For workforce and client data, the Customer (your employer) is the controller and

Clenzus is the processor, processing only on the Customer's documented instructions. For the account, billing, and platform-security data Clenzus collects directly, Clenzus is the controller.

  • Lawful bases (for data Clenzus controls directly). We rely on performance of a contract

(to create, run, and bill accounts), our legitimate interests (to secure the platform, prevent fraud, and improve the Service in ways that do not override your rights), consent where we ask for it, and compliance with a legal obligation. Where Clenzus acts as processor, the lawful basis is the Customer's to establish and document.

  • Your rights. You have the rights of access, rectification, erasure, restriction, objection,

portability, and the right to lodge a complaint with your local supervisory authority. For data held on your employer's behalf, route the request through your employer as described in 12.1. These rights are not absolute: in particular, the right to erasure does not extend to information that must be retained to comply with a legal obligation or for the establishment, exercise, or defence of legal claims, which is retained with the person's name removed, as described in Section 10.

  • Data Processing Addendum. Business Customers may execute Clenzus's Article 28 DPA (Section

2.3) to govern this processing.

  • International transfers. See Section 13 - Clenzus relies on the Standard Contractual Clauses

(and the UK Addendum) where personal data leaves the EEA/UK.

  • EU / UK / Switzerland availability and representative. Clenzus is **not yet available to companies

or individuals located in the EU/EEA, the United Kingdom, or Switzerland, and we do not currently accept account sign-ups from those regions (including sign-ups originating from EU/EEA, UK, or Swiss IP addresses). While the Service is closed to these regions, we do not intentionally process the personal data of individuals located there, with one exception: if someone tries to sign up from one of these regions, we keep their email address and country on our early-access list and email them once, so we can tell them when we launch there. They can unsubscribe at any time. We do not currently have a representative in any of these regions. We are completing the local data-protection steps - including appointing an EU representative under GDPR Article 27, a UK representative, and a Swiss representative under the revised Federal Act on Data Protection (nFADP) - and will publish each representative's name and contact details here before opening the Service to that region. In the meantime, if you believe we hold personal data about you, you may contact us at privacy@clenzus.com**.

12.4 California - CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, applies.

  • Service-provider role. For workforce and client data, Clenzus acts as a service provider to

the Customer (the business) and processes personal information only to perform the Service under our contract. Clenzus does not "sell" or "share" personal information (as those terms are defined by the CCPA/CPRA), does not retain, use, or disclose it for any purpose other than providing the Service, and does not combine it with data from other sources except as permitted.

  • Your rights. Subject to the routing in 12.1, you may have the right to know/access,

delete, correct, and opt out of sale/sharing (which Clenzus does not do), and to non-discrimination for exercising these rights. Requests about data Clenzus controls directly can be sent to privacy@clenzus.com.

12.5 Australia - Privacy Act 1988

Where the Australian Privacy Principles (APPs) apply, we handle personal information consistently with them, including openness about our practices (APP 1), notice of collection (APP 5), use and disclosure (APP 6), cross-border disclosure (APP 8 - see Section 13), security (APP 11), and access and correction (APPs 12 and 13). For workforce and client information held on your employer's behalf, route your request through your employer as described in 12.1; for information Clenzus controls directly, contact privacy@clenzus.com. You may also raise a concern with the Office of the Australian Information Commissioner (OAIC).

12.6 New Zealand - Privacy Act 2020

Where the Information Privacy Principles (IPPs) apply, we handle personal information consistently with them, including access and correction (IPPs 6 and 7) and cross-border disclosure (IPP 12 - see Section 13). Route workforce and client requests through your employer (12.1); for information Clenzus controls directly, contact privacy@clenzus.com. You may also raise a concern with the Office of the Privacy Commissioner.

12.7 Other jurisdictions

Individuals in other U.S. states with comprehensive privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas, and others as they take effect) and in other countries and regions (for example Brazil's LGPD, Singapore's PDPA, Japan's APPI, South Africa's POPIA, India's Digital Personal Data Protection Act, and similar data-protection laws) may have comparable rights. We honour the rights that apply to you under the law of your jurisdiction. Where Clenzus is a processor/service provider, route your request through your employer (12.1); where Clenzus is the controller, contact privacy@clenzus.com.

13. International data transfers and data residency

Clenzus is based in Canada. Because Clenzus serves companies worldwide, personal information may be stored and processed in Canada, the United States, the European Union, and other countries where our infrastructure providers and subprocessors operate.

Where your data is processed. The Service runs on the service providers named in Section 9 under "Our service providers" (for example Supabase for the database, Netlify for hosting, Cloudflare for network protection and file storage, Resend for email, and Stripe, in the United States, for payments). Google Analytics is not loaded for visitors in the regions we do not yet serve.

These providers may process data in the United States and other regions in addition to Canada; international transfers are governed by the safeguards described below in this Section and the security measures in Section 11. For more detail about where a particular provider processes data, email privacy@clenzus.com. We commit to giving affected Customers advance notice of a new subprocessor with an opportunity to object, as described in Section 9.

Transfer mechanism. The Service is not currently offered in the EEA, the UK, or Switzerland. To the extent any personal data originating in the EEA, the UK, or Switzerland is nonetheless processed under the Agreement and transferred to a country that has not received an adequacy decision, we rely on an approved safeguard - principally the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum - together with the security measures described in Section 11. For transfers subject to Canadian and other laws, we rely on comparable contractual and organizational safeguards.

For personal information subject to Australian or New Zealand law that is processed in Canada, the United States, or elsewhere, Clenzus uses reputable providers under their published terms and, where offered, their data processing terms, sends each one only the information it needs, takes reasonable steps designed to secure handling consistent with the Australian Privacy Principles (APP 8) and the New Zealand Information Privacy Principles (IPP 12), and remains accountable for its subprocessors' handling of that information.

By using the Service, you understand that your information may be processed in these locations, each of which may have data-protection laws different from those in your home jurisdiction.

14. Children

The Service is intended for business use by individuals who are at least the age of majority in their jurisdiction and of legal working age, and is not directed to individuals below that age. We do not knowingly collect personal information from anyone who is not of the age of majority and legal working age. If you believe such a person has provided personal information through the Service, contact us and we will take steps to delete it.

15. Cookies, and communications you receive

The Service uses cookies and local storage that are necessary to sign you in, keep your session active, remember basic preferences, and operate securely. We also use a small amount of analytics (currently Google Analytics) to understand, in aggregate, how our public website and the Service are used - such as which pages are viewed and how features perform - so that we can improve them. These analytics cookies collect usage and device information in a limited, pseudonymous form. We do not use them to build advertising profiles about you, we do not serve third-party advertising through the Service, and we do not sell your personal information. Analytics are off until you consent: where we offer analytics, we ask first and do not load them unless you choose "Accept" - declining is always available and the Service remains fully usable either way. You can also limit or block analytics cookies at any time through your browser settings or Google's browser opt-out. In regions where we are not yet operating, analytics are not loaded at all.

Separately, we operate our own first-party, cookieless analytics on our public website pages (for example the homepage, sign-up, contact, and legal pages). It records only limited information - the page path, the referring website's domain, a general device type (mobile, tablet, or desktop), an approximate country, and a daily, one-way value used only to count unique visitors (a scrambled code that changes every day and cannot be turned back into your IP address). It uses no cookies and does not store your IP address. It stores nothing on your device, except a small setting if you choose to opt out of this counting. Because it is this limited, we do not ask for consent for it. We use it only to measure website traffic in aggregate; it is never used for advertising, and it is not loaded in regions where we are not yet operating.

We send two kinds of email: service and security messages about your account, which are part of the Service; and optional product, launch, or early-access messages, which you can opt out of at any time using the unsubscribe link they contain or by emailing privacy@clenzus.com. Where we send commercial electronic messages, we comply with applicable anti-spam law (including Canada's CASL and, for United States recipients, CAN-SPAM): we identify ourselves and provide a working unsubscribe mechanism. If you turn on push notifications, we also send in-app and browser/device push alerts about your work activity; you can turn these off at any time in your Clenzus notification settings or in your device/browser settings. We do not send text messages or automated calls; if we introduce them, we will first obtain any consent the law requires and provide a clear opt-out.

16. Changes to this policy

We may update this policy at any time as the Service, our providers, or the law evolve. When you accept this policy - which you do once, when you first use the Service - you agree to the policy as it exists then and as we may update it in the future under this section; you do not need to re-accept it each time it changes.

When we make changes, we will update the "Last updated" date above and make the current version available in the app. If the changes are material, we will also provide reasonable notice - for example, an in-app notice or an email to your account address. Your continued use of the Service after a change takes effect means you accept the updated policy, so please keep your email address current and review the policy periodically. The version posted in the app is always the current one and supersedes prior versions.

17. Contact us

Questions, requests, or complaints about privacy are welcome. Clenzus has designated a Privacy Officer responsible for compliance with applicable privacy law (including PIPEDA, Québec's Law 25, Singapore's PDPA, and Brazil's LGPD), reachable at the address below and monitored on an ongoing basis.

Clenzus Inc. Canada Email: privacy@clenzus.com