Break Schedule — Privacy Notice
Effective: September 22, 2026 · Last updated: October 15, 2026
The short version
- The schedules you upload come from the scheduling or workforce-management software you already use (UKG, Deputy, or whatever your stores run on today). We process that export just long enough to build your break schedule, then discard it — no employee names, hours, or shift times are kept on our servers, unless you choose to send us a file after a failed import (see §3).
- The account email and beta-request details you give us directly are kept, so we can run access to the Service.
1. Who we are
Break Schedule ("we", "us") provides a decision-support tool that computes meal-period and rest-break schedules for hourly retail employees. Questions about this notice or your data: [email protected].
2. Where your roster data comes from
Break Schedule doesn't replace the scheduling or workforce-management software your stores already run — it reads an export from it. The employee names, shift times, and other roster details in that export originate in your existing system, not in Break Schedule; that system's own privacy policy governs how it collected and retained that data before you exported it. This notice covers only what happens to that data once you upload it here. You're responsible for confirming you have the right to export that data and share it with us (see the Terms of Service).
3. Two kinds of data
Roster data (processed, never stored). When you upload a work-schedule export, we decode it in memory to produce a break schedule. This can include employee names and shift times. We do not write your upload or the derived schedule to disk, a database, a cache, or a session. It exists only for the duration of the request that processes it, and the working schedule you edit lives in your browser's memory — a page refresh or tab close discards it. When you download your result, the downloaded files are the only record; we keep none.
Support Files (stored only if you choose). If an import fails, you can choose to send us that file so we can see why. Nothing is sent unless you tick the consent box. We then store the whole file, including employee names and shifts, together with your optional note, the failure reason, the import's reference code, and when you consented. Only the Break Schedule team can open it. We delete it when we resolve your case, and never keep it longer than 30 days (§7).
Contact data (stored). To run access to the Service we keep:
| Data | Why | Where |
|---|---|---|
| Email address | identify your waitlist request and account, send sign-in and approval emails | Neon (database), Clerk (auth), Resend (email) |
| Beta-request qualifiers — scheduling tool used, California-retail attestation, optional store name and headcount | judge fit for the beta | Neon |
| Account and invite status | manage beta access | Neon, Clerk |
| Anonymous processing metadata — column counts, row counts, a one-way file "fingerprint", and reusable column-mapping settings | speed up and improve automatic reading of your exports | Neon |
The processing metadata contains no cell values other than open-shift placeholder words such as "OPEN SHIFT", and no recoverable personal data from your uploads. The fingerprint is a one-way digest, not reversible into your schedule.
4. Automated ("AI") reading of unrecognized exports
If we do not recognize your export format, we use an AI model to propose how your columns map. When this happens, the only data sent to the model provider is: the sheet name, the header row (when the export has one), and up to five sample rows with likely personal values masked before sending. Names and other text identifiers are replaced with placeholders. Numbers, dates and times are sent as-is so the model can read shift times. This means a numeric employee ID or pay rate may be included. We never send your full file or the finished schedule.
The model provider is OpenAI. We send it real (masked) sample data only under a zero-data-retention agreement, so OpenAI does not store or train on it. If no such agreement is in force, the AI path runs on synthetic sample data only, and an unrecognized real export is reported as "couldn't read automatically" instead of being sent.
5. Service providers (subprocessors)
We share the data above only with providers that operate the Service:
- Neon — database hosting (Contact data, anonymous metadata, and any Support Files you send), U.S. region.
- Clerk — authentication (email address only).
- OpenAI — automated column-mapping, under zero-data-retention terms, and only the masked sample described in §4.
- Vercel — application hosting and runtime logs.
- Resend — approval emails (Contact data).
- Axiom — import diagnostics: Account IDs, Import IDs, masked column headers, and other anonymous processing metadata.
- Cloudflare Turnstile — bot protection on the request-invite form.
6. Where data is processed
The Service runs on infrastructure in the United States (our application region is San Francisco, California; Neon stores Contact data in a U.S. region). We do not currently serve users outside the United States.
7. How long we keep it
- Roster data: not retained — discarded when each request ends.
- Support Files: kept until your case is resolved, and never longer than 30 days.
- Contact data: kept while your waitlist request or account is active. If your request is declined or your account is closed, we delete or anonymize it within 90 days, except where we need to keep limited records longer to comply with law, resolve disputes, or enforce our agreements.
- Import diagnostics (Axiom): deleted after 30 days.
8. Your California privacy rights
If you are a California resident, the CCPA/CPRA gives you rights to know, access, correct, and delete the personal information we hold about you, and to not be discriminated against for exercising them. Requests can concern your Contact data and any Support File you sent; you can also ask us to delete a Support File before its case is resolved. To make a request, email [email protected] from the address on your account or waitlist request (so we can verify it's you); we'll respond within 45 days. We do not sell or "share" personal information for cross-context behavioral advertising.
9. Security
We use TLS for data in transit, restrict database access to least-privilege credentials, and keep all secrets out of client code and the repository. No security measure is perfect; we cannot guarantee absolute security.
10. Children
The Service is for business use by adults and is not directed to children.
11. Changes
We may update this notice. Material changes will be signposted here with a new "last updated" date; where a change materially reduces your rights, we will also email accountholders.