Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains how Saachi LLC, d/b/a Duxora ("Duxora," "we," "us," or "our") collects, uses, and protects information when you use our employee scheduling platform, including our website, mobile applications, and related services (collectively, the "Service").

Saachi LLC, d/b/a Duxora, is a North Carolina limited liability company. If you have questions about this policy, contact us at [email protected].

Where We Operate: The Service is offered to Employers and Employees in the U.S. states we support at signup. It is not offered outside the United States.

1.Who This Policy Covers

Duxora is used by two types of users:

• Business Customers ("Employers") — organizations that sign up for Duxora to schedule their workforce.
• End Users ("Employees") — individuals added by an Employer to use the Service for clocking in/out, viewing shifts, requesting time off, and related tasks.

If you are an Employee using Duxora through your employer, your employer is the "business" or "controller" of your information under applicable privacy laws, and Duxora acts as its "service provider" or "processor." We process Employee information only on the Employer's behalf and to provide the Service. Questions about how your data is used should generally be directed to your employer first.

2.Information We Collect

Account & Profile Information

• Name, email address, phone number
• Job title, location assignment, role/permissions
• Login credentials

Scheduling & Work Data

• Shift schedules, availability, confirmations, swaps
• Time-off requests
• Clock-in/clock-out timestamps and task completion records

Biometric Data

If you enable Face ID or Touch ID unlock, we (or your device operating system) process biometric identifiers to authenticate your login.

• We do not store raw biometric images or templates on our servers. Biometric authentication is handled locally by your device's operating system (Apple/Google), which returns only a confirmation of identity to our app — not the underlying biometric data.
• You may disable biometric unlock at any time in your device or app settings and use a password instead.
• We retain any biometric-related authentication logs only as long as necessary to operate the feature, and delete them upon request or account deletion, consistent with applicable law (e.g., Illinois BIPA, Texas CUBI, Washington biometric privacy laws).

Location Information

If your Employer turns on geofenced clock-in, our mobile app reads your device's precise location once, at the moment you clock in or out, and only if you have granted location permission on your device. We do not track your location in the background or at any other time. We do not store your raw GPS coordinates; see "Data Retention" below for what we keep.

Device & Usage Information

• IP address, device type, operating system, browser type
• App usage and interaction data, log data, crash reports

Payment Information

Billing details are processed by our third-party payment processor. We do not store full payment card numbers.

Trial Access Requests

If you request trial access through our website, we collect your name, email address, company name, industry, and — if you choose to share them — your number of locations, team size, and any notes you provide. We also record how you found us (for example, a campaign link or referring website). We use this information only to evaluate and respond to your request for access to the Service; it is not added to a marketing list.

3.Sensitive Personal Information

Some state laws treat precise geolocation and biometric information as "sensitive" personal information. We use location only to check whether a clock-in or clock-out happened at the allowed location, and biometric unlock is handled on your device as described above. We do not use sensitive personal information to infer characteristics about you, and we use it only to provide the feature you or your Employer turned on.

4.How We Use Information

We use collected information to:

• Provide, operate, and maintain the Service (scheduling, shift management, clock-in/out, notifications)
• Authenticate users and secure accounts, including biometric login where enabled
• Communicate with you about your account, updates, and support requests
• Improve and develop new features, including the AI Store Manager scheduling tool
• Comply with legal obligations
• Detect and prevent fraud, abuse, or security incidents

5.How We Share Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We may share information with:

• Your Employer — Employee data (shifts, clock-in/out, time-off requests) is visible to the Employer that added you to the Service.
• Service Providers — third parties who help us operate the Service (hosting, analytics, payment processing, customer support), bound by confidentiality and data protection obligations.
• Legal Requirements — where required by law, subpoena, or to protect rights, safety, or property.
• Business Transfers — in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections.

6.Data Retention

We keep personal information only as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce our agreements. The periods below are the longest we keep each type of data; we may delete it sooner when it is no longer needed.

• Active accounts. Account, profile, location, schedule, and settings data are kept while the Employer's subscription is active.
• Time and payroll records. Shifts, clock-in/clock-out events, and closed pay-period summaries are kept for 3 years from the date of the record, then deleted.
• Quick notes and photos. Notes, replies, reactions, and attached photos are kept for 12 months from when they were posted, then permanently deleted. A note or reply that is deleted in the app is permanently removed within 30 days. Photo uploads that are never attached to a note are removed within 7 days.
• Notifications and technical records. In-app notifications are kept for up to 180 days. Sign-in sessions, one-time verification codes, invitation links, and device push tokens are deleted within 90 days after they expire or are revoked; a device push token that has not been used for a year is also deleted.
• Closed accounts. When an Employer's subscription is canceled or its trial ends without a paid subscription, the account is closed. For 30 days after closure the Employer may request an export of its organization's data (see our Terms of Service). Organization data, including Employee profiles that are not part of another active Employer's account, is permanently deleted within 90 days after closure. Copies in our backups are overwritten within a further 35 days.
• Records we keep for legal reasons. Records of SMS consent and opt-outs, Terms acceptances, and payment authorizations are kept for up to 5 years after the account closes, even after other data is deleted, so we can meet our legal obligations and resolve disputes.
• Location. We never store your raw GPS coordinates. For geofenced clock-ins we keep only whether the punch was inside the allowed area, the distance from the location, and the reported accuracy, as part of the time record above.
• Trial access requests. Requests that are declined or identified as spam are deleted within 12 months; requests that lead to an invitation are kept alongside that invitation. You can ask us to delete a trial access request at any time by writing to [email protected].

Employers may request deletion of their organization's data at any time. Employees may request deletion by contacting their Employer or us directly at [email protected]. We may keep data longer than stated above where the law requires it or to respond to a pending legal claim.

7.Your Privacy Rights

Depending on the state you live in (for example, California, Colorado, Connecticut, Texas, Virginia, and other states with consumer privacy laws), you may have the right to:

• Know what personal information we collect about you and access a copy of it
• Correct inaccurate personal information
• Delete your personal information
• Receive your personal information in a portable format
• Opt out of the sale or sharing of personal information, targeted advertising, and certain profiling. We do not do any of these.
• Limit the use of sensitive personal information. We use it only as described in Section 3.
• Withdraw consent for biometric data collection, where applicable
• Not be discriminated against for exercising any of these rights

How to make a request. Email [email protected]. We will verify your identity before acting on a request, usually by confirming details tied to your account. You may use an authorized agent to make a request for you; we may ask the agent for proof of your authorization and ask you to verify your identity directly. We will respond within 45 days, or tell you if we need more time as the law allows.

Employees. If your information was added to Duxora by your Employer, we process it as your Employer's service provider. We may refer your request to your Employer or handle it on their instructions.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing [email protected] with "Privacy Appeal" in the subject line. We will respond to your appeal within the time required by your state's law. If you are not satisfied with the result, you may contact your state attorney general.

8.International Data Transfers

If you access the Service from outside the United States, your information may be transferred to and processed in the United States. We take steps to ensure appropriate safeguards are in place for such transfers where required by law.

9.Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and, where applicable, your Employer, as required by applicable law.

10.Children's Privacy

The Service is not directed to individuals under 16. We do not knowingly collect personal information from children.

11.Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via a notice within the Service. Continued use of the Service after changes take effect constitutes acceptance.

12.Contact Us

Saachi LLC

[email protected]