Synchee Customer Terms of Service

For business accounts at app.synchee.com and the Synchee mobile apps | Effective date: November 1, 2026

1 Parties and acceptance

These terms are between Synchee, LLC and the business or organization accepting them (“Customer”). The person accepting represents that they have authority to bind Customer. These terms, an accepted checkout or order (“Order”), and Appendix A, the Data Processing Addendum (“DPA”), including its schedules form the agreement. If an Order conflicts with these terms on pricing or purchased features, the Order controls for that subject. Authorized workforce users accept separate Worker Terms; Customer remains responsible for administering its workspace.

2 Service and access

Synchee grants Customer a nonexclusive, nontransferable right during the subscription term to use the subscribed workforce management service for its internal business operations and to allow authorized users to do so. Customer designates administrators and controls staff roles, access to locations, and accuracy of workspace content. Customer will protect credentials and promptly report suspected compromise. Synchee may maintain, modify, and improve the service, provided it does not materially remove the core paid functionality during a prepaid term without an appropriate remedy.

3 Subscription, locations and billing

An accepted checkout or order (Order) identifies the subscribed locations, start date, billing frequency, and charges. Current standard pricing is US $29 per month per location or US $276 per year per location, paid upfront (equivalent to $23 per month), unless a different price is disclosed and accepted in the Order. Each subscribed location includes unlimited employees or seats. The accepted Order controls the price for its term.

Synchee uses Stripe for payment processing. Customer authorizes Synchee and Stripe to store payment credentials and charge the accepted payment method for authorized subscription fees, renewals, location additions, and separately agreed charges, plus applicable taxes. Synchee does not directly collect or store raw card numbers or card security codes. Fees exclude applicable sales, use, and similar transaction taxes unless stated otherwise. Customer must provide accurate billing information and pay applicable taxes, excluding taxes on Synchee’s net income.

Each additional subscribed location is billable at the monthly or annual rate disclosed when activated. Any offered location trial and its end date will be disclosed in the Services. When an authorized location addition becomes billable partway through an existing billing period, Synchee will charge the prorated amount immediately to align it with the existing billing cycle. Before Customer accepts an addition or trial, Synchee will disclose the applicable charge, charge date, and any authorization for automatic charging after the trial. Removal of a location stops renewal charges for that location after the current paid period, without an ordinary prorated refund. Export needed records before deleting a location; deleting a location is distinct from canceling its renewal and may end access to its records before the paid term ends.

A monthly subscription renews monthly and an annual subscription renews annually unless renewal is canceled. Synchee will notify Customer of price changes before they take effect at a later renewal, and Customer may cancel before that renewal. No separately priced add-ons are currently offered. Future optional add-ons require separate disclosure and Customer authorization; any billing alignment or proration will be disclosed at activation.

Free beta and trial access does not convert into a paid subscription without Customer’s affirmative payment authorization. A trial period and any authorized post-trial charge must be disclosed before acceptance. If Customer does not authorize a paid subscription, access may be restricted when free access ends. Native iOS and Android apps provide read-only plan information; administrators manage billing through the web app.

Cancellation and refunds. Customer may cancel a subscription’s automatic renewal at any time through https://app.synchee.com/settings under Plan & billing or by emailing legal@synchee.com. Cancellation takes effect at the end of the current paid subscription period. Customer retains paid access through that date, and Synchee will not charge for the next period.

Subscription fees are otherwise nonrefundable, except as required by law or expressly stated in this agreement or an Order. If Customer requests cancellation and a refund within 30 calendar days after its first purchase of an annual subscription, Synchee will refund the annual subscription fee paid in full. Paid access ends when Synchee processes that refund. This 30-day offer does not apply to annual renewals or monthly subscriptions.

Synchee will email Customer a reminder approximately 30 days before an annual subscription renews, stating the renewal date, price, and how to cancel.

4 Customer data and privacy

Customer owns or controls the data it and its users enter or generate in the service (“Customer Data”). Customer authorizes Synchee and its subprocessors to process Customer Data to deliver, secure, maintain and support the service, comply with law, and follow Customer’s documented instructions, subject to the DPA. Customer is responsible for the legality, accuracy, collection notices, permissions, retention decisions, and authorized access to Customer Data. Synchee will not sell Customer Personal Data, share it for cross-context behavioral advertising, or use identifiable Customer Personal Data to train general-purpose or public AI models. Appendix A governs processing of Customer Personal Data and controls conflicting data-processing language. Our Privacy Policy describes information Synchee controls for its own account and website purposes.

5 Employment and I-9 responsibilities

Customer is responsible for its employment decisions and compliance with wage and hour, scheduling, meal and rest, leave, hiring, immigration, privacy, and recordkeeping laws. Synchee is a workforce management tool and does not determine worker classification, legally owed wages, or compliance with employment or immigration law.

Synchee’s onboarding features provide preliminary employee data collection, typed-name submissions, submission timestamps and IP addresses, and generic document uploads. They do not provide a compliant electronic Form I-9 completion, verification, signature, or retention system. Entering information resembling Form I-9 Section 1, typing a name, or uploading an identity document does not by itself complete a legally compliant Form I-9 process.

Synchee does not provide an employer Section 2 document examination and attestation workflow, a reverification or rehire workflow, official Form I-9 generation, or the audit trail and indexing capabilities needed for a compliant electronic I-9 system. Synchee does not integrate with E-Verify. Customer must separately arrange compliant Form I-9 completion, authorized document examination, employer attestation, any required reverification, record retention, and government inspection readiness. Customer must not rely on Synchee as its sole I-9 compliance or retention system. These Customer responsibilities do not excuse Synchee from its own data protection obligations under this agreement and the DPA.

6 Acceptable use and external content

Customer and its users will not circumvent access controls, reverse engineer the service except where law permits, upload malware, use the service for unlawful conduct or harassment, send unlawful communications, or violate another person’s rights. Customer controls custom forms, documents, integrations, and links it adds and must ensure they are lawful and authorized. Synchee may suspend access to address an imminent security threat or material misuse, with notice where practicable and restoration when the issue is resolved.

7 Confidentiality and security

Each party will protect the other’s confidential nonpublic information using reasonable care and use it only under this agreement. Standard exclusions apply to information lawfully public, independently developed, already known, or lawfully received without a duty of confidence. Synchee will maintain safeguards for Customer Data as described in the DPA. Legally compelled disclosure is permitted after advance notice where allowed.

8 Intellectual property

Synchee owns the service, software, and documentation. Customer retains rights to Customer Data. Customer grants Synchee no right to publish identifiable Customer Data or use Customer’s name or logo in marketing without permission. Synchee may use voluntary product feedback without disclosing Customer’s confidential information.

9 Termination and customer data

Either party may terminate this agreement for a material breach that remains uncured 30 days after written notice. A party may terminate immediately upon written notice for a breach that cannot be cured or where law requires. Subscription cancellation operates as stated in Section 3; turning off renewal does not end access before the paid term expires.

Customer should export needed records before expiration, termination, or deletion. For 30 calendar days after the effective expiration or termination date, or after Customer initiates deletion of its entire employer workspace (the Export Window), Customer may request retrieval of retained Customer Data by emailing legal@synchee.com from its account owner email or through another verified authorized representative. Synchee will verify identity and authority before releasing records. Synchee will provide available standard extracts through secure administrative delivery or, where appropriate, temporary retrieval access. The Export Window does not promise continued ordinary service or an automated post-termination self-service portal. Synchee may restrict direct access for security or legal reasons and will provide a lawful, reasonably secure retrieval method. Synchee will preserve records needed to fulfill a timely retrieval request until the available export has been securely delivered, unless Customer requests earlier deletion or law prohibits retention. This limited preservation may extend the ordinary deletion deadlines below for those records.

While Customer has active workspace access, available self-service exports include employee rosters and timesheets/timecards in CSV format and schedules through browser print or save-to-PDF. There is no single-click full-workspace archive. Customer may request additional retained workspace records by emailing legal@synchee.com during the Export Window. Synchee will arrange available standard database or CSV extracts, subject to identity verification, access permissions, legal restrictions, and reasonable technical limitations. Synchee does not promise to recreate deleted information or supply a custom migration or report.

Following standard subscription expiration or termination, unless Customer requests earlier deletion, Synchee will delete Customer Data from active production databases and workspace-specific uploaded files within 30 days after the Export Window ends, subject to lawful retention and pending timely retrieval requests. Files include onboarding and I-9 attachments, certificates, task photos, and message attachments. Database backups age out within 30 days after production database deletion. These consecutive periods may total up to 90 days after the effective expiration or termination date; they are not measured from an advance cancellation notice. The owner-initiated workspace deletion process below starts its own recovery and deletion schedule.

Owner-initiated workspace deletion. When the business owner confirms Delete All Locations in Settings, team access is suspended immediately and a 30-day recovery and Export Window starts at the recorded request time. During that period the owner may cancel deletion or request retrieval at legal@synchee.com. At the end of that period, Synchee automatically purges the workspace operational database records and queues its uploaded files for permanent deletion by an hourly cleanup worker. File deletion ordinarily follows within the next hourly processing cycle; Synchee will complete production file cleanup no later than 30 days after the Export Window ends, subject to the limited exceptions above. Database backup copies age out within 30 days after production database deletion. The 30-day recovery process described here applies to deletion of the entire employer workspace; it does not promise recovery for an individually deleted location. Restoring a workspace, where available, does not necessarily restore an expired subscription or authorize a new charge.

Earlier deletion requests. A verified request for permanent deletion before the normal recovery or Export Window ends may shorten that window. Synchee will complete deletion from production databases and workspace-specific file storage within 30 days after the verified request, subject to lawful retention. Customer should retrieve required records before requesting permanent deletion.

Individual account deletion. An individual may permanently delete their personal login through Settings under Profile by confirming Delete Account. The account deletion workflow immediately removes the personal login credentials, contact profile, personal tasks, and associated Synchee device push tokens and clears local session storage on the device completing the action. This action has no 30-day recovery period. Removing a login link does not necessarily erase historical shift, timecard, or other employer-controlled records. Those records may remain in the employer workspace, disassociated from the deleted login, for authorized employment and recordkeeping purposes under the DPA. Disassociation alone does not make a record anonymous or establish that it satisfies employment recordkeeping requirements. Cached information on another or offline device may persist until that device reconnects or its local copy is cleared.

Portable accounts. Deleting an employer workspace disassociates workers from that workspace but does not delete their independently maintained login accounts for other or future employers. Customer cannot require deletion of another employer’s records or of an individual’s independent account. Administrative credentials associated only with the deleted workspace are revoked, removed, or disassociated when deletion is finalized.

Transactional email delivery and authentication email logs use a rolling 30-day retention cycle. Synchee removes device push tokens through the personal account deletion workflow and unregisters the device from notification delivery. Push providers process device tokens and notification payloads under their applicable service terms; deleting a token does not recall a notification already delivered. Standalone task photos are subject to automated 30-day cleanup. Limited billing, invoice, transaction, audit, and security records may be retained where needed for legal obligations or legitimate recordkeeping, with continued protection and restricted use. Stripe may retain payment-related information for its own lawful purposes. These exceptions do not exempt unrelated Customer Personal Data from deletion. Information may be retained as deidentified only where it meets applicable legal requirements. Provider obligations are further addressed in Appendix A.

10 Warranties, liability and claims

10.1 Service warranty and remedy

Each party represents that it has authority to enter this agreement. Synchee warrants that it will provide the paid service with reasonable care and skill and that the service will materially conform to its published documentation for the subscribed features. Customer must notify Synchee at legal@synchee.com of a claimed material failure and provide information reasonably needed to investigate. Synchee will use commercially reasonable efforts to correct the failure. If Synchee does not correct a material breach within the 30-day cure period in Section 9, Customer may terminate the affected subscription and receive a prorated refund of prepaid fees for the unused period after termination. This remedy does not restrict the first-annual-purchase refund in Section 3, other express obligations in this agreement, or rights that cannot be limited by law.

10.2 Other warranties

Except for express commitments in this agreement and to the maximum extent permitted by law, Synchee disclaims implied warranties of merchantability, fitness for a particular purpose, and noninfringement. Synchee does not promise uninterrupted or error-free service or that use of the service will, by itself, satisfy Customer’s employment, immigration, or recordkeeping obligations. Free beta and trial features are provided as available without the paid-service warranty in Section 10.1. The confidentiality, data protection, and security obligations in this agreement and the DPA continue to apply to those features.

10.3 General liability cap

To the maximum extent permitted by law and subject to Sections 10.4 and 10.5, each party’s total aggregate monetary liability arising out of or relating to this agreement, including the DPA, will not exceed the greater of (a) US $100 or (b) subscription fees paid or payable by Customer for the service during the 12 months immediately preceding the first event giving rise to liability (the General Cap). Related claims are treated as arising from the first related event. This limit applies across all claims and legal theories, including contract, negligence, and indemnity, and is not a separate limit for each claim, user, or location.

10.4 Confidentiality and data protection claims

Liability arising from a party’s breach of its confidentiality obligations or its privacy, data protection, or security obligations under this agreement or the DPA is subject to the General Cap in Section 10.3 and the exceptions in Section 10.5. No separate or higher monetary cap applies. Reasonable and necessary costs of investigating and containing a security incident, restoring affected Customer Data, and providing legally required notices are recoverable as direct damages to the extent caused by that breach, within the applicable General Cap. All covered claims count toward the same aggregate General Cap; the limits do not stack. These limits allocate responsibility between the parties and do not limit a regulator’s powers or an individual’s nonwaivable statutory rights.

10.5 Exclusions and exceptions

Subject to the exceptions in this paragraph, neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, or lost profits, revenue, or goodwill, arising out of this agreement, even if advised of their possibility. This exclusion does not bar covered third-party awards, approved settlements, or reasonable defense costs under Sections 10.6 and 10.7, or the direct costs described in Section 10.4; the applicable monetary caps still apply to those amounts. Neither the monetary caps nor the damages exclusion applies to a party’s fraud, gross negligence, willful misconduct, or liability that applicable law prohibits limiting or excluding. Monetary caps do not reduce Customer’s obligation to pay properly due subscription fees or Synchee’s obligation to issue refunds expressly required by this agreement.

10.6 Claims against Customer concerning Synchee software

Synchee will defend Customer against a third-party claim that Customer’s authorized use of the Synchee service infringes a United States patent, copyright, or trademark, or misappropriates a trade secret, and pay damages and reasonable legal costs finally awarded against Customer and settlement amounts approved by Synchee. This obligation does not apply to claims caused by Customer Data, modifications not made or authorized by Synchee, combinations with products not supplied or required by Synchee where the claim would not arise without the combination, or use outside this agreement. If such a claim arises or is reasonably likely, Synchee may obtain the right to continued use or modify or replace the affected functionality with materially equivalent functionality. If neither is commercially reasonable, Synchee may terminate the affected subscription and refund prepaid fees for the unused period. These obligations are subject to Section 10.3, except where Section 10.5 requires otherwise.

10.7 Claims against Synchee concerning Customer conduct

Customer will defend Synchee against a third-party claim to the extent arising from (a) Customer Data or Customer-supplied content that infringes another person’s rights or was collected or disclosed unlawfully; (b) Customer’s or its authorized users’ unlawful use of the service; or (c) Customer’s employment decisions or failure to comply with the employer obligations described in Section 5. Customer will pay damages and reasonable legal costs finally awarded against Synchee and settlement amounts approved by Customer. Customer has no obligation under this paragraph to the extent a claim is caused by Synchee’s breach of this agreement, negligence, or misconduct. These obligations are subject to Section 10.3 or, for a covered confidentiality or data protection breach, Section 10.4, except where Section 10.5 requires otherwise.

10.8 Defense process

A party seeking a defense must promptly notify the other party of the claim; delay relieves the defending party only to the extent materially prejudiced. The defending party controls the defense using reasonably qualified counsel and pays for reasonable cooperation it requests. The protected party may participate with its own counsel at its own expense. No settlement may admit fault by, impose nonmonetary obligations on, or require payment by the protected party without its prior written consent, which will not be unreasonably withheld. Defense costs, awards, and settlements count toward the applicable cap. A defending party must give reasonable notice before ending a defense because that cap has been reached.

10.9 Application and survival

This Section 10 survives expiration or termination and applies to claims, disputes, and liabilities arising out of or relating to this Agreement, the DPA, and the Service, unless the DPA expressly states that a specified provision overrides this Section. These limitations reflect an allocation of risk between the parties in light of the subscription fees and apply to the fullest extent permitted by law, subject to Sections 10.4 and 10.5. Nothing limits nonwaivable rights or remedies under applicable law.

11 Notices, changes and governing law

Legal notices to Synchee must be sent in writing to legal@synchee.com or by certified mail to Synchee, LLC at 21213 Hawthorne Blvd STE B PMB #5593, Torrance, CA 90503. Synchee may send formal notices to Customer’s account owner email. Routine service communications may also be delivered within the account. Material changes to these terms will be communicated in advance and apply at renewal or after another lawful acceptance process; they will not silently rewrite a current prepaid term. California law governs, excluding conflict-of-law rules, and the state and federal courts serving Los Angeles County, California have exclusive jurisdiction, subject to applicable mandatory law. These contractual notice methods do not replace any legally required method for service of court process.

12 General provisions

This agreement, including applicable Orders and the DPA, is the complete agreement concerning the subscribed Services and supersedes prior discussions on that subject. If a provision is unenforceable, the remaining provisions remain effective to the extent permitted by law. Failure to enforce a provision is not a waiver. The parties are independent contractors. Neither party may assign this agreement without the other’s written consent, except to a successor in a merger, reorganization, or sale of substantially all related assets, provided the successor assumes the obligations and the assignment does not materially reduce protection of Customer Data. Provisions that by their nature should survive expiration or termination, including confidentiality, intellectual property, accrued payment obligations, liability limitations, claims, and governing law, survive.

Appendix A Data Processing Addendum

Synchee, LLC | Part of the Customer Terms of Service

Effective version: November 1, 2026 matching the Customer Terms of Service

This Data Processing Addendum (DPA), including Schedules 1 through 3, forms part of the Customer Terms of Service between Synchee, LLC (Synchee) and Customer (together, the Agreement). It takes effect when Customer accepts the Agreement and applies while Synchee processes Customer Personal Data. Acceptance of the Agreement includes acceptance of this DPA; a separate signature is not required.

A1 Scope and roles

Customer Personal Data means personal information contained in Customer Data that Synchee processes on Customer’s behalf. Processing includes collection, storage, access, use, transmission, disclosure, return, and deletion. Data Protection Laws means United States privacy, data protection, security, and breach notification laws applicable to the processing, including the California Consumer Privacy Act and its regulations (CCPA) where applicable. Terms such as business, controller, service provider, contractor, processor, sell, and share have the meanings given by applicable law.

Customer determines the purposes and means of workforce processing and acts as the business or controller, as applicable. Synchee acts as its service provider or processor. If Customer processes information for another controller, Customer warrants that it has authority to appoint Synchee as a subprocessor and provide lawful instructions. This DPA does not govern information Synchee independently controls for its own billing, sales, account administration, or security purposes, as described in the Privacy Policy; describing information there does not permit Synchee to repurpose Customer Personal Data contrary to this DPA.

A2 Instructions and Customer responsibilities

Synchee will process Customer Personal Data only on Customer’s documented instructions, including the Agreement, selected features, authorized workspace actions, and lawful written requests, for the specific purposes in Schedule 1, or as required by law. Synchee will inform Customer before legally required processing unless prohibited by law. Synchee will promptly inform Customer if it believes an instruction violates Data Protection Laws and may pause the affected processing while the parties resolve the issue.

Customer is responsible for lawful collection and disclosure, required worker notices and consents or other legal authority, data accuracy, appropriate permissions, and employment decisions. Customer will limit sensitive information to what is necessary, configure access appropriately, and export legally required records before deletion. Synchee’s onboarding collection tools do not constitute a compliant electronic Form I-9 system; Section 5 of the Customer Terms continues to apply. These responsibilities do not reduce Synchee’s obligations for its own processing.

A3 Restrictions on use

Synchee will not sell Customer Personal Data, share it for cross-context behavioral advertising, or use it for targeted advertising. Synchee will not retain, use, or disclose it for purposes other than the limited and specified purposes in Schedule 1 or outside the direct business relationship with Customer, except as expressly permitted by Data Protection Laws. Synchee will not combine it with information obtained from another customer, another source, or Synchee’s own interactions with an individual except where expressly permitted by applicable law.

Synchee will not use identifiable Customer Personal Data to train general-purpose or public AI models, build advertising profiles, or conduct third-party commercial benchmarking. Synchee will not make autonomous employment decisions for Customer. Synchee will comply with applicable Data Protection Laws and provide the same level of privacy protection required by those laws. Synchee certifies that it understands and will comply with these restrictions. No general permission elsewhere in the Agreement overrides them.

A4 Confidentiality and security

Synchee will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only as needed for their duties. Synchee will maintain reasonable technical and organizational measures appropriate to the nature, sensitivity, and risks of the information, including the minimum measures in Schedule 2. Changes must not materially reduce overall protection during the subscription term.

A5 Subprocessors

Customer authorizes Synchee to engage the approved subprocessors in Schedule 3 for their stated functions. Before providing access to Customer Personal Data, Synchee will enter into written contracts imposing applicable data protection and confidentiality obligations consistent with this DPA. Synchee remains responsible to Customer for performance of delegated obligations. Schedule 3 identifies the provider, function, data involved, and relevant processing locations.

Synchee will give Customer at least 30 calendar days’ advance written notice before a new or replacement subprocessor begins processing Customer Personal Data, by emailing the primary account owner’s registered email and updating Schedule 3 or a designated online subprocessor directory. The notice will identify the provider’s legal name, function, processing locations, and proposed start date. Customer may object within 15 calendar days after receiving notice by emailing legal@synchee.com on reasonable, documented data protection or information security grounds. The parties will work in good faith to resolve the objection, including a reasonable alternative where available. If no resolution is reached before the proposed processing begins, Customer may terminate the affected service on written notice and receive a prorated refund of unused prepaid fees. An unresolved timely objection does not authorize the disputed subprocessor to process Customer Personal Data.

A6 Security incidents

Security Incident means a breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Synchee or its subprocessors. Unsuccessful attempts that do not compromise Customer Personal Data are not Security Incidents.

Synchee will notify Customer in writing without undue delay and no later than 72 hours after becoming aware of a Security Incident, or sooner where applicable law requires. Initial notice may be preliminary and will not be delayed while all facts are established or an investigation is completed. Notice will be sent to Customer’s primary account owner or designated security email and describe, to the extent known, the nature and scope of the incident, affected data categories and approximate numbers of records and individuals, likely consequences, containment and remediation measures, and a contact for follow-up. Synchee will provide material updates as information becomes available.

Synchee will promptly investigate, contain, and remediate the incident, preserve relevant evidence, and reasonably assist Customer with legally required notices and other obligations. Customer determines notices to its workers and regulators, except where law independently requires Synchee to notify them. Synchee will coordinate such notices where lawful. Notification does not itself admit liability; the Agreement governs allocation of responsibility.

A7 Individual requests and compliance assistance

Taking account of the processing and information available to it, Synchee will assist Customer with legally required access, correction, deletion, portability, restriction, and opt-out requests. Customer will verify requests and provide the information and lawful instructions needed to act. Synchee will promptly forward requests concerning Customer Personal Data to Customer and will not respond substantively except on Customer’s instructions or as required by law.

Synchee will provide assistance in time for Customer to meet applicable deadlines, including using available export tools or standard extracts. Synchee will reasonably assist with applicable risk assessments, cybersecurity audits, regulator inquiries, and other required assessments using relevant information in its possession or control. The parties will cooperate on scope and secure delivery; charges, if any, require advance written agreement and may not defeat mandatory assistance obligations.

A8 Demonstrating compliance and remediation

Synchee will make available information reasonably necessary to demonstrate compliance with this DPA. Customer may take reasonable and appropriate steps to verify that processing complies with applicable law, including periodic reviews and assessments. Existing documentation or independent reports may be used where sufficient; this provision does not represent that Synchee holds a certification.

Where documentation is insufficient, Synchee will permit a reasonably scoped audit by Customer or an independent auditor bound to confidentiality, with reasonable advance notice and safeguards for other customers’ information and service security. Ordinary audits may occur once in 12 months; additional reviews are permitted following a Security Incident, reasonable evidence of noncompliance, or a legal or regulatory requirement. Neither party may use these arrangements to block legally required oversight.

Synchee will promptly notify Customer if it determines that it can no longer meet its obligations under this DPA or applicable Data Protection Laws. Upon notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized use, including requiring corrective action and evidence of completion. If compliance cannot be restored, Customer may suspend affected processing or terminate the affected service and receive unused prepaid fees back.

A9 Return and deletion

During the subscription, Synchee will act on lawful Customer instructions to return or delete Customer Personal Data, subject to applicable legal requirements. Section 9 governs available exports and administrative assistance, the 30-day Export Window, earlier deletion requests, and the separate personal account and employer workspace deletion processes. Synchee does not promise an automated post-termination self-service portal. After standard subscription expiration or termination, production database records and workspace-specific files are deleted within 30 days after the Export Window, and database backups age out within 30 days after production database deletion, ordinarily totaling up to 90 days after the effective expiration or termination date. Owner-initiated Delete All Locations starts a 30-day recovery window, followed by database purge and queued hourly file cleanup as described in Section 9. Lawful retention and preservation to fulfill timely retrieval requests are the limited exceptions stated there.

Synchee will direct approved subprocessors to return or delete Customer Personal Data in accordance with this DPA and applicable legal requirements. Backup data will remain protected, be used only for recovery or legally required purposes, and be re-deleted if restored to active systems. Legally retained data will be limited to what is required, segregated or access restricted, and deleted when the basis for retention ends. Synchee will provide written confirmation of completed deletion upon reasonable written request to legal@synchee.com.

Employer workspace deletion removes employer operational records and memberships but does not close workers’ independently maintained portable accounts. Personal account deletion removes the login and profile; historical employer records may remain disassociated from that login for lawful purposes under Customer’s instructions. Such records remain protected under this DPA while they are identifiable. Customer remains responsible for ensuring that retained records meet its employment recordkeeping obligations.

A10 Processing locations and international scope

The initial service is offered to United States customers. The core database is hosted in the United States; global delivery infrastructure and provider operations may process information elsewhere as specified in Schedule 3. Synchee will notify Customer before a material change in processing locations. Synchee will comply with applicable restrictions on disclosure and cross-border processing. This DPA does not itself include EU or UK transfer clauses or represent that the Services are ready for every jurisdiction. The parties must address additional applicable requirements before introducing processing subject to those regimes.

A11 Relationship to the Agreement

This DPA controls over conflicting provisions of the Agreement concerning processing of Customer Personal Data. Section 10 of the Customer Terms, including its General Cap, exceptions, and treatment of confidentiality and data protection claims, applies to this DPA; this DPA does not establish a separate or additional liability cap. Nothing limits statutory rights of individuals, regulator powers, or liability that cannot lawfully be limited. The Agreement governs notices, governing law, and disputes. The DPA survives until Customer Personal Data has been returned or deleted, except for obligations that by their nature continue.

DPA requests and notices to Synchee: legal@synchee.com. Customer’s contact is its account owner email unless another authorized contact is designated in writing.

Schedule 1 Processing details

Subject and duration: Provision of the subscribed workforce management Services during the Agreement and the limited export, deletion, backup, and legally required retention periods afterward. Frequency: ongoing as Customer and authorized users use the enabled features.

Specific purposes and operations: Collect, organize, store, retrieve, transmit, display, and delete worker profiles; prepare and communicate schedules and availability; record time punches, breaks, geofence results, and manager edits; administer leave and shift requests; deliver team messages and notifications; manage tasks, completion photos, shift notes, and manager logs; collect onboarding responses and documents; produce authorized exports; and provide technical support, troubleshooting, access control, and security for these functions.

Individuals: Customer’s employees, contractors, administrators, managers, invited workers, and emergency contacts, to the extent Customer supplies their information. The Services are not directed to children under 13.

Data categories: Names and contact details; roles, departments and locations; credentials and authentication records; wage rates and wage history; hire dates; schedules and availability; time punches, breaks and edits; precise location and geofence flags; leave balances; tasks and photos; messages and acknowledgments; manager notes and sales records where identifiable; onboarding responses, certifications, uploaded documents, typed-name submissions and signatures; IP addresses, device details, and notification tokens.

Sensitive information: Where Customer enables the relevant features, Social Security numbers, birth dates, home addresses, citizenship or immigration information, USCIS/I-94/passport details and other identity document information, precise geolocation, and potentially sensitive information entered in custom forms or messages. Processing is limited to the requested features and authorized access. Customer must not submit unrelated sensitive information or information prohibited by the Agreement.

Schedule 2 Minimum security measures

Synchee maintains administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of Customer Personal Data. The following measures form part of Synchee’s commitments under this DPA.

Access control and authentication. Users authenticate through salted cryptographic password hashing and token-based session management. Database row-level security and role-based permissions separate workspaces and restrict Owner, Manager, and Employee access. Removing a user’s workspace membership revokes that user’s access to the affected workspace. Privileged administrative access to production systems is limited to authorized personnel and requires multifactor authentication.

Encryption and file access. Public network connections use encrypted HTTPS/TLS transport, with HTTP redirection and HSTS. Production databases, database backups, and file storage are encrypted at rest using AES-256. Workspace uploads, including onboarding documents, certificates, task photos, and message attachments, reside in private storage buckets and use time-limited signed links issued after authorization checks. Payment credentials are collected through Stripe; Synchee does not store raw payment card numbers or security codes.

Operations and recovery. Synchee maintains incident response and escalation procedures consistent with Section A6. Automated database snapshots and point-in-time recovery are maintained on a rolling 30-day backup schedule. Recovery procedures are tested periodically. Application dependency scanning and managed infrastructure patching address vulnerabilities. Automated database purge, file purge queues, and storage cleanup implement the deletion processes in Section 9 and Section A9.

Personnel and vendors. Personnel authorized to access Customer Personal Data are bound by written confidentiality obligations and receive appropriate security guidance. Synchee reviews its subprocessors and requires written data protection obligations consistent with this DPA.

Assurance and scope. Synchee reviews safeguards periodically and addresses identified material weaknesses. This schedule does not represent that Synchee holds SOC, ISO 27001, FedRAMP, or another formal third-party certification. Secure document storage does not make Synchee a compliant electronic Form I-9 completion, signature, verification, or retention system; Section 5 applies.

Schedule 3 Approved subprocessors

The following providers support the stated functions. Provider roles depend on the activity; a provider’s independent processing is not automatically subprocessing on Customer’s behalf. Core storage is in the United States; global delivery and provider operations may involve processing elsewhere. Synchee maintains this inventory and gives notice of additions or replacements under Section A5.

Lovable Labs Incorporated operating Lovable Cloud. Core application hosting, backend execution, authentication email delivery, database and storage management, and service metadata. Customer account and workforce records, uploaded documents and photos, and authentication information. Core deployment: United States, AWS us-east-1, Northern Virginia. Infrastructure is supported by Supabase, Inc.; its direct or downstream role depends on Synchee’s contracted deployment.

Supabase, Inc. Database, authentication, private file storage, and backend infrastructure supporting the Lovable Cloud deployment. Customer account and workforce records, documents, photos, and service metadata. Reported core database, storage, and backup region: United States, AWS us-east-1, Northern Virginia. See the deployment confirmation below.

Cloudflare, Inc. Content delivery, DNS, edge routing, TLS termination, and web application and DDoS security. IP addresses, request and response headers, traffic content where processed, and transmission metadata. Processing locations: global edge network, with origin infrastructure in the United States.

Google LLC operating Firebase Cloud Messaging. Push notification routing and dispatch for Android and iOS. Device registration tokens, alert titles, and notification text, which may include shift times, task assignments, or team message previews. Processing locations: United States and global delivery infrastructure. Delivery processing and any queued notifications are subject to applicable provider settings and terms.

Apple Inc. operating Apple Push Notification service. Push notification transport to iOS devices. Device tokens, alert titles, badge information, and notification payloads, potentially including workspace information. Processing locations: United States and global delivery infrastructure. Delivery processing and any queued notifications are subject to applicable provider settings and terms.

Plus Five Five, Inc. operating Resend. Transactional email delivery for invitations, published schedules, shift requests, and operational alerts. Recipient addresses, message contents, delivery events, and metadata. Reported processing location: United States. Synchee’s configured delivery-log retention is 30 days. Account verification and password reset messages use the backend authentication email service rather than this transactional delivery route.

Stripe, Inc. Subscription management, invoicing, payment processing, customer billing portal, and tax calculation where configured. Customer contact, billing, payment-related, and transaction metadata. Reported primary processing location: United States; Stripe’s global provider operations may also apply. Stripe acts as a processor for applicable delegated activities and independently for certain payment, compliance, anti-fraud, and financial recordkeeping purposes, under its applicable terms.