Privacy Policy

1. Who We Are

Skoreboard is a staff performance tracking platform operated by Skor Systems ("Skoreboard," "we," "us," or "our"), whose postal address is Skor Systems, 440 San Ysidro Blvd #430490, San Ysidro, CA 92173, USA. Questions about this policy may be directed to help@skorsystems.com.

2. Data We Collect

We collect information you provide directly and information generated through your use of the platform:

• Account data: name, email address, phone number, and profile photo.
• Business data: business name, address, and type.
• Performance data: task completions, daily scores, win/loss records, shift attendance, and time logs.
• Security data: hashed passwords, two-factor authentication secrets, login timestamps, and failed login counts.
• Payment data: billing details managed by Stripe. We do not store credit card numbers.
• Usage data: pages visited, feature interactions, and device/browser information collected by Vercel analytics and Google Analytics (only if you accept analytics cookies).
• Communications: emails sent and received through the platform, including staff invitations and performance digests.

3. How We Use Your Data

• To provide, operate, and improve the Skoreboard service.
• To calculate staff performance scores and generate team reports.
• To send transactional emails (account creation, password resets, billing alerts).
• To send operational notifications (weekly digests, task reminders) — you may unsubscribe at any time.
• To process billing and manage subscriptions via Stripe.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with legal obligations.

4. Performance Monitoring Disclosure

Skoreboard is a workforce performance tool. If you are a staff member using the platform, your employer (the account administrator) can view your task completions, daily scores, attendance, and ranking data. This is the core function of the platform and is disclosed at account creation. Data is retained for up to 3 years to support employment records, scheduling decisions, and performance reviews.

4a. Automated Scoring & Profiling

Skoreboard automatically calculates daily performance scores from the tasks assigned to your shift and the completions you record. This constitutes profiling of work performance. The scores are advisory information for your employer: the platform does not itself make any decision with legal or similarly significant effect about you. Any employment decision informed by a score is made and reviewed by a human at your employer.

You can see how your score is composed on your own scoreboard, raise inaccuracies with your manager or administrator, and contest profiling through our data request form (request type: objection). A Data Protection Impact Assessment covering the scoring engine is maintained and available to customers on request.

5. Third-Party Processors

We share data with the following sub-processors only to the extent necessary to deliver the service:

• Stripe: payment processing and subscription management (USA).
• Resend: transactional and operational email delivery, primary sender (USA).
• SendGrid (Twilio): transactional and operational email delivery, fallback sender (USA).
• Zoho Mail: inbound support and data request mailbox hosting (USA).
• Vercel: application hosting and edge delivery (USA/global).
• Neon: PostgreSQL cloud database (USA).
• Cloudinary: media/image storage for profile photos (USA).
• Anthropic: AI assistant features. When you use the in-app assistant, the prompt and the limited context it needs (which may include names, task descriptions, and performance figures from your workspace) are processed by Anthropic to generate a response (USA). Lawful basis: contract performance for the requested feature, Art 6(1)(b) GDPR. We do not permit Anthropic to train models on this data, and we do not send passwords, payment data, or security credentials.
• Google Analytics: aggregate usage analytics (pages visited and feature interactions). Loads only if you accept optional analytics cookies; no analytics data is collected if you decline (USA/global).

We do not sell your personal data to third parties.

6. Cookies & Analytics

We use cookies for session authentication (required for the service to function) and optional analytics cookies via Vercel Speed Insights and Google Analytics. Optional analytics load only after you accept them (opt-in); you may decline, or withdraw consent at any time, via the cookie consent banner without affecting platform functionality. We also honor the Global Privacy Control (GPC) browser signal as a valid opt-out.

7. Data Retention

• Active account data is retained for the duration of your subscription.
• Performance and task completion records are retained for up to 3 years.
• Payment and billing records are retained for 7 years (tax compliance).
• Audit logs are retained for 2 years.
• Accounts deleted via account deletion request are anonymized within 30 days.
• When an account is offboarded or removed, a copy of its data is kept in a restricted-access archive so we can answer data requests: for 30 days after an erasure request, or up to 3 years otherwise, after which the archived data is purged automatically.

8. Your Rights (GDPR / CCPA)

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of your personal data via your account settings.
• Correction: update your name, phone, and profile in your account settings at any time.
• Deletion: request deletion of your account and personal data via account settings. Data used for employment records may be retained per applicable law.
• Portability: download a JSON export of your personal data from account settings.
• Opt-out of marketing: unsubscribe from non-essential emails at any time via the link in any email we send.
• California residents (CCPA): you have the right to know what personal information we collect, to request deletion, and to opt out of any sale of personal information (we do not sell personal information).

To exercise any of these rights, contact us at help@skorsystems.com.

8a. CCPA — California Residents: Data Categories

Under the California Consumer Privacy Act (CCPA), we are required to disclose the categories of personal information we collect and the business purposes for which we use them:

• Identifiers — name, email address, phone number, IP address, account ID.
  Purpose: account creation, authentication, service delivery, email communications.
• Commercial Information — subscription plan, billing history, payment method (managed by Stripe — we do not store card numbers).
  Purpose: billing, subscription management, fraud prevention.
• Internet or Network Activity — pages visited, feature usage, device and browser type, analytics data collected by Vercel and Google Analytics (analytics only with your consent).
  Purpose: service improvement, performance monitoring, security.
• Professional or Employment-Related Data — task completions, daily performance scores, shift attendance, win/loss records, job title, employment type.
  Purpose: core platform function — workforce performance tracking as contracted by your employer.

We do not sell, rent, disclose, or share personal information for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising.

To exercise your CCPA rights (right to know, right to delete, right to access, opt-out confirmation), visit our Do Not Sell My Personal Information page or contact us at help@skorsystems.com.

9. Security

We implement industry-standard security measures including bcrypt password hashing, AES-256 encryption for sensitive vault data, TOTP two-factor authentication, HMAC-signed session tokens, Content Security Policy headers, and HTTPS-only transport. Despite these measures, no system is perfectly secure — please use a strong, unique password and enable 2FA.

10. Children's Privacy

Skoreboard is intended for use by adults (18+) or individuals authorized to enter binding agreements. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this policy periodically. We will notify account administrators by email when material changes are made. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

12. For EU/EEA Data Subjects (GDPR)

This section supplements the notice above for individuals located in the European Union or European Economic Area.

Controller and processor roles: for staff and workforce data inside a customer's workspace, the customer organization is the controller and Skor Systems is the processor, acting only on the customer's documented instructions. For account registration, billing, and website data, Skor Systems is the controller.

Lawful basis per purpose (Art 6 GDPR):

• Providing the service (accounts, scoreboards, scheduling): contract performance, Art 6(1)(b).
• Security, fraud prevention, and service improvement: legitimate interests, Art 6(1)(f).
• Optional analytics cookies: consent, Art 6(1)(a).
• Tax and accounting records: legal obligation, Art 6(1)(c).

Your rights (Art 12-22 GDPR): you have the right to access, rectify, erase, and restrict processing of your personal data; the right to data portability; the right to object to processing; the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal; and the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, submit a request via our data request form (which also handles GDPR requests) or contact us at help@skorsystems.com. We respond to EU/EEA requests within one month.

Data you must provide: a name and email address are required to create an account; without them we cannot provide the service. All other personal data is either generated by your use of the platform or optional.

Recipients and retention: the recipients of your personal data are the sub-processors listed in Section 5, and your employer where it is the controller. Retention periods per data category are listed in Section 7.

Profiling: automated performance scoring as described in Section 4a applies to staff accounts. No solely automated decision with legal or similarly significant effect is made by the platform.

International transfers: your personal data is processed in the United States. For personal data of EU/EEA data subjects, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the operative safeguard under GDPR Chapter V, incorporated into our Data Processing Agreement and into our agreements with the sub-processors listed in Section 5.

13. Contact

For privacy inquiries, data requests, or concerns, contact us at:
help@skorsystems.com
Skor Systems, 440 San Ysidro Blvd #430490, San Ysidro, CA 92173, USA