Privacy Policy

01. Introduction & Scope

AuditShield HR ("we," "our," or "us"), operated by Spawn Point Tech LLC, respects the privacy of our business subscribers ("Employers"), their workforce ("Employees"), and candidate applicants ("Job Applicants").

This Privacy Policy explains how we collect, process, store, disclose, and protect personal data across our cloud application, employee portal, PIN kiosk, recruitment applicant tracking system (ATS), and automated statutory document vaults (collectively, the "Platform").

02. Information We Collect

2.1 Employer Account Data

When an Employer registers for an AuditShield HR account, we collect business identity and administrative details:

• Company legal name, DBA, Federal Employer Identification Number (FEIN), and registered business addresses.
• Primary administrator contact name, business email address, phone number, and support identities.
• Account credentials and role-based authorization levels (Admin, Manager, Payroll Auditor).
• Payment and billing metadata (processed securely via Square; we never store raw credit card numbers on our servers).

2.2 Employee Personally Identifiable Information (PII)

To populate statutory labor forms (e.g., NYS WTPA Section 195.1 notices, Federal I-9s, DB-120/PFL acknowledgments) and maintain legal record vaults, Employers transmit Employee data:

• Employee full legal name, residential address, contact details, and hire date.
• Social Security Number (last 4 digits) or Employee Identification Number.
• Compensation details: hourly rates, salary, pay frequency, regular/overtime allowances, and tax withholding credits.
• Pay stub scans or payroll exports uploaded via the Payroll Provider Ingestor (PPI) OCR engine.
• Digital signature timestamps, cryptographic SHA-256 audit hashes, and document execution records.

2.3 Job Applicant & Candidate Data (Recruitment ATS)

When candidates apply for job openings via our public recruitment board (/apply), we collect:

• Candidate full name, email address, phone number, and physical address.
• Resume files, cover letters, employment history, education, and professional references.
• Voluntary Equal Employment Opportunity (EEO-1) demographic survey responses (gender, race/ethnicity, veteran status, disability status), stored confidentially for federal reporting.
• Statutory pre-employment questionnaires (e.g., salary transparency disclosures, ban-the-box acknowledgments).

2.4 Time Clock Geolocation & Kiosk Telemetry

When employees record shifts using our Time Clock Kiosk (/kiosk) or mobile punch interface:

• We sample point-in-time GPS coordinates solely at the exact instant of punch submission to verify workplace geofence radius compliance.
• Zero Continuous Background Tracking: AuditShield HR does not engage in continuous GPS monitoring, passive location tracking, or tracking outside shift punch events.
• Time punch timestamps, punch type (clock-in, clock-out, break start/end), and mandatory meal/break attestations.

2.5 Training & LMS Progress Data

To establish statutory affirmative compliance defenses (e.g., mandatory annual sexual harassment prevention training):

• Training module progress, video completion checkpoints, interactive quiz scores, and comprehension timestamps.
• Cryptographically signed and archived Certificates of Completion.

2.6 Technical Telemetry & Device Metadata

• Browser type, operating system, IP address, and security audit logs to protect tenant data integrity and prevent unauthorized access.

03. How We Use Information

We process collected information strictly for business operational, workforce administrative, and statutory labor compliance purposes, including:

1. Statutory Document Generation: Populating mandated federal and multi-state wage notices, separation packets, and onboarding forms.
2. Automated 6-Year Vault Retention: Storing immutable, time-stamped HR records for the mandatory 6-year statutory audit retention period required under state and federal labor laws (FLSA, NYLL § 195, California Labor Code).
3. Payroll Ingestion & OCR Vision Processing: Extracting wage rates, hours, and deduction line items from uploaded pay stubs.
4. Recruitment Pipeline Administration: Facilitating applicant reviews, candidate notifications, and multi-state wage disclosure previews.
5. Compliance Notifications: Delivering automated alerts regarding statutory law updates, minimum wage rate changes, poster requirements, or expiring certifications.
6. Subscription Billing & Account Security: Processing flat-rate subscriptions securely via Square and authenticating tenant roles.

05. How We Share & Disclose Information

We disclose information only to vetted service providers (sub-processors) under strict confidentiality and data-protection agreements:

• Payment Gateways: Square, for tokenized subscription billing and transaction settlements.
• Transactional Mail Infrastructure: Stalwart / Amazon SES, for delivering authenticated compliance receipts and mobile signature links.
• Cloud Hosting & Storage: Dedicated encrypted PostgreSQL database clusters and AES-256-GCM object storage vaults.
• Legal & Regulatory Authorities: If required by valid court order, subpoena, or statutory labor department audit demand.

06. Data Security & Storage Architecture

6.1 Transport & Storage Encryption

All data in transit is protected by TLS 1.3 transport-layer encryption. All stored database tables, encrypted PDF documents, and pay stub images are safeguarded with AES-256-GCM encryption at rest.

6.2 Multi-Tenant Isolation & RBAC

Multi-tenant organization data is strictly isolated. Role-Based Access Control (RBAC) prevents unauthorized staff from viewing sensitive wage or identity records outside their organizational scope.

6.3 Statutory Retention Schedule

Statutory HR records and wage notices are retained for a minimum of six (6) years to satisfy federal (FLSA/EEOC) and state (NYLL § 195, California Labor Code) audit requirements, and at least three (3) years post-termination for former employee inspection demands.

07. Multi-State Privacy Rights & Notice at Collection (CCPA / CPRA)

Under applicable state privacy laws (including the California Consumer Privacy Act as amended by the CPRA), California residents (including Employees and Job Applicants) possess specific statutory data rights:

• Right to Know & Access: You may request disclosure of the specific categories and pieces of personal information collected about you.
• Right to Correct: You may request correction of inaccurate personal records.
• Right to Deletion: You may request deletion of your personal data, subject to mandatory legal record-keeping and statutory labor retention obligations.
• Non-Discrimination: We will not discriminate against any user, employee, or applicant for exercising statutory privacy rights.

To exercise these rights, submit a Data Subject Access Request (DSAR) to privacy@auditshieldhr.com. Requests are verified and processed within statutory timelines.

08. Contact & Governance Notices

If you have questions regarding this Privacy Policy, data handling practices, or sub-processor disclosures: