Privacy Policy

Who we are

RoleCall is a team scheduling and time-clock service used by businesses to publish work schedules and let employees clock in and out. Your employer (the business that invited you) controls the workplace data in the service; we process it on their behalf.

Information we collect

• Account information — your name, email address, and phone number, provided by you or your employer, used to create and secure your account and to build the schedule.
• Work records — schedules, shifts, time cards, breaks, wage rates, and availability, created by you and your employer as part of using the service.
• Precise location, only at clock-in and clock-out — when you tap Clock In or Clock Out, the app captures your location one time to verify you are at the work site (a geofence check). We store that single reading with the time card. We do not track your location in the background, and we never collect location outside a clock-in/clock-out action.
• Sign-in via Google or Apple — if you choose these options, we receive your name and email from the provider. We never see your password.

Gmail and Outlook, if you connect your email

An owner or manager can connect their own Gmail or Microsoft Outlook (Microsoft 365 or Outlook.com) mailbox to RoleCall. This is optional and off unless you connect it.

• What we read — when you open Email in RoleCall, we read the sender, subject, date and short preview of the messages that arrived in your Inbox and Spam (Junk Email) folders in the last 30 days, and sort them into supplier bills and receipts, customer and job requests, messages from your team, and everything else. Sorting is done by rules on our servers; your email is not sent to an AI model to be sorted. We also read your email address, to show which mailbox is connected.
• What we ask permission for — from Google, to read your mail (gmail.readonly) and to create drafts and send email (gmail.compose); from Microsoft, to read your mail (Mail.Read), to write reply drafts (Mail.ReadWrite) and to send email (Mail.Send). RoleCall never deletes, moves or archives your email and never changes your mailbox settings.
• Writing a reply — only if you press "Write a reply" on one email, we read that email's text and send it, with long account, card and routing numbers removed, to OpenAI to write a draft. OpenAI does not use it to train its models. The draft is shown only to you to edit. When you ask the RoleCall assistant about your email, its answer is also written by OpenAI, never by another AI provider.
• Saving and sending replies — RoleCall can save your reply as a draft in your own Gmail or Outlook Drafts folder, in the same conversation, and, only when you confirm, send a reply from your mailbox. Nothing is sent automatically: before anything goes out, RoleCall shows you exactly who it goes to, the subject and the words, and sends only when you press Send now. RoleCall won't reply to email in your Spam or Junk folder or to an email asking to change bank or payment details, and a business can send a limited number of replies a day. For each reply sent we keep who sent it, when, to whom and the subject (not the words of the reply), for as long as the business keeps its account.
• What we keep, and for how long — we don't keep copies of your emails: they are read when you open Email and are not stored. We keep your email address, the permissions you granted, when RoleCall last looked, and the sign-in key the provider gives us, stored encrypted. We keep these until you disconnect, or until the business or your account is closed. If the provider stops accepting the key, we delete it right away.
• Who can see it — only the person who connected a mailbox can read its email in RoleCall. The business owner can see that a mailbox is connected and can disconnect it. People at RoleCall do not read your email, except with your permission (for example, when you ask for support), for security, or when the law requires it.
• How to disconnect — press Disconnect next to Gmail or Outlook in RoleCall Settings. That deletes the key and the connection right away; for Gmail we also ask Google to cancel RoleCall's access. You can also remove RoleCall yourself at myaccount.google.com/permissions (Google), or at account.live.com/consent/Manage or myapps.microsoft.com (Microsoft).

RoleCall's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We use Gmail data only to show you your own email in RoleCall, to write the reply drafts you ask for, and to save or send the replies you confirm. We do not sell it, use it for advertising, or use it to train AI models, and we share it only with the service providers that run those features for you (Supabase, Vercel and OpenAI, for reply drafts and for assistant answers that use your email).

Google Business Profile and Google Ads, if you connect them

A business can connect its Google Business Profile and Google Ads account to RoleCall. Each is optional and off unless the business connects it.

• What we access — Business Profile (permission: manage your business listings): the listings your Google login manages, their details (name, address, hours, phone, website, categories), verification status, reviews, and listing performance (searches, views, calls, website clicks and direction requests). Google Ads (permission: manage your Google Ads accounts): the ad accounts your login can access, their campaigns, budgets, spend, clicks and conversions, and keyword ideas for phrases you type.
• How we use it — only for the features the business turns on: keeping the listing up to date, publishing the posts and review replies the business approves, showing listing and ad results, pausing the campaigns the business chooses to follow and applying the monthly ad budget it approves. Ad spend is also used to calculate RoleCall's ad service fee, a share of spend the business agreed to. We do not sell this data, use it for advertising, or use it to train AI models.
• Who we share it with — only Supabase and Vercel, which run RoleCall, and OpenAI, which writes the ad wording you ask for and the RoleCall assistant's answers that use this data. OpenAI does not use it to train its models. It never goes to any other AI provider, to advertisers or to data brokers.
• What we keep, and how to delete it — the sign-in key Google gives us, stored encrypted, until the business disconnects; and the figures RoleCall saves (such as past ad spend, the campaigns you follow and listing performance) until you ask us to delete them. Disconnect in RoleCall Settings deletes the key right away and stops RoleCall reading anything new; you can also remove RoleCall at myaccount.google.com/permissions. Email us to delete the saved figures and we will do it within 30 days.

How we use information

• To run scheduling, time tracking, and payroll preparation for your workplace.
• To verify clock-ins happen at the work location.
• To sync employment records (team member identity, wage rates, and time cards) with your employer's Square account, when your employer has connected Square.
• To show a business its own Shopify store in RoleCall, when the business has connected Shopify. RoleCall reads the store's products, orders, inventory and locations. When the business's owner or a manager asks, and confirms, RoleCall changes a product's price or stock in the store or marks an order shipped with its tracking number; each change is recorded in the business's audit log. RoleCall does not read the store's customer list.
• To secure accounts and prevent misuse.

We do not sell personal information, we do not use it for advertising, and we do not track you across other companies' apps or websites.

MDML Connect (our Chrome extension), if a business uses it

MDML Connect is RoleCall's helper in the owner's own Chrome. With the business's approval it fills its forms (state filings, registrations, permits), connects its website's domain, fills its supplier carts from RoleCall's order plan, files its store receipts and supplier statements, looks products up for the Product finder, and reads the business's own connected Instagram grid for Content Studio. It works only on websites the person allows, one at a time, and never signs, submits, uploads or accepts terms.

• What the extension sends to RoleCall: only what each task needs. The blank layout of a form you chose (never what is typed in it), answers you type in its panel, a store's search results to pick your product, your receipts as text with card numbers, emails and phone numbers removed, your Instagram grid's post links, and problem reports you send. What the Product finder reads stays in your browser. Never passwords, security codes, Social Security, bank or card numbers, or cookies.
• Placing orders: never, unless the business's owner turns on Autopilot, accepts its terms and sets a store to "Place the order". Then it presses only that store's own Place order button, inside the owner's spending limits, and RoleCall records the order.
• Filing info: the answers the owner or a manager saves (legal name, addresses, registered agent, managers, contact, business FEIN) stay in that business's RoleCall account. When the owner registers the business for texting, its FEIN is sent from there to Twilio and the phone carriers for that registration. RoleCall refuses Social Security, bank and card numbers and passwords.
• The shared form library: to make the next fill better for everyone, RoleCall keeps what a form looks like and which saved answer belongs in each box. It holds no personal data: anything that matches a business's answers, or looks like an email, phone, SSN, EIN or long number, is stripped before it is saved.
• Your records: for each fill, the site, the form, the time, the outcome you report, which saved answer went in each box, and a one-way fingerprint (SHA-256) of each value, never the value itself, private to the business and deleted after 2 years. Cart runs, orders Autopilot placed, receipts and supplier statements stay in the business's account like its other records.
• AI: OpenAI processes a new form's blank layout (never anyone's answers), the words for "Find it for me", a store's search results, a store page's cleaned outline and receipts' cleaned text, to do those tasks. OpenAI doesn't use them for training.
• In the extension: its sign-in key stays on that computer until you sign out, 30 days pass without use, or the extension is switched off in RoleCall (Settings → Keys).
• The full policy: mdmltechnologies.com/privacy/mdml-connect.

Sharing

Workplace data is visible to your employer's managers as part of running the business. We share data with service providers that host the product (Supabase for database and authentication, Vercel for hosting) and, at your employer's direction, with Square (payroll/time card sync), Shopify (reading a connected store's products and orders, and making the changes the business confirms), Shippo (the one order's shipping address, when the business buys a shipping label for it) and Stripe (business subscription billing). These providers process data only to provide their services.

Retention & deletion

Work records are retained for as long as your employer keeps an active account, and as required for payroll and employment record-keeping. To delete your account or data, ask your employer's account owner, or contact us directly and we will handle it within 30 days.

Shopify: while a store is connected we keep its name, its myshopify.com address, its currency and the access key Shopify gives us (stored encrypted). Products and orders are read from Shopify when RoleCall shows them; we don't keep a copy, and we keep no Shopify customer records. A buyer's shipping address is read only to buy that order's label and is not stored; the label record keeps the order number, carrier, price and tracking number. Pressing Disconnect in RoleCall Settings deletes the store's connection, access key included, right away. Removing the app in Shopify deletes the access key right away, and 48 hours later Shopify asks us to erase that store's data, so we delete everything we still hold for the store, its shipping label records included.

Your choices

• Location permission is optional in your device settings — but clock-in requires it at the moment you punch, because location verification is the point of the feature. A manager can always record your time manually.
• You can sign in with email instead of Google or Apple.
• You can request a copy or deletion of your personal data at any time.

Contact

Questions or requests: support@mdmltechnologies.com