# Privacy Policy Last updated: October 13, 2026 This Privacy Policy describes how YYVZ LLC dba Mays.App ("Mays," "we," "us," or "our") collects, uses, and discloses your information when you use the Mays operations management platform, including our mobile app and web dashboard (collectively, the "Service"). ## 1. Information We Collect ### Information You Provide - **Account information:** Name, email address, phone number, password, and profile photo. - **Organization data:** Company name, branch/location details, user roles, and departments. - **Task submissions:** Text responses, photos, checkbox completions, GPS coordinates, inventory counts, and other data you submit when completing tasks. - **Messages:** Text and media messages you send through our in-app messaging feature. - **Payment information:** Billing details processed securely through Stripe. We do not store credit card numbers. ### Information Collected Automatically - **Device information:** Device type, operating system, unique device identifiers, push notification tokens. - **Usage data:** Features used, time spent, interactions, and crash reports. - **Location data:** When you submit a GPS-based task response or the app is used for location verification. ### Information from Third-Party Integrations If you connect third-party services (such as 7shifts, Square, Dropbox, or Google Drive), we access only the data you explicitly authorize: employee information, shift data, payment records, and files you choose to import. ## 2. How We Use Your Information - Provide, operate, and maintain the Service. - Process task submissions, generate task assignments, and send notifications. - Enable team messaging and real-time collaboration. - Process payments and manage subscriptions. - Power AI features (task verification, chat assistance) using OpenAI. We do not use your data to train AI models. - Respond to your requests and provide customer support. - Detect, prevent, and address technical issues or fraudulent activity. - Comply with legal obligations. ## 3. How We Share Your Information We do not sell your personal information. We share data only in the following circumstances: - **Within your organization:** Task data, messages, and user profiles are visible to authorized members of your organization based on their role. - **Service providers:** We use trusted third parties to operate the Service, including AWS (hosting), Stripe (payments), Firebase (push notifications), OpenAI (AI features), Twilio (SMS), and Resend (email). - **Legal requirements:** We may disclose information if required by law, subpoena, or court order. - **Business transfers:** In connection with a merger, acquisition, or sale of assets. ### Connected AI apps (ChatGPT, Claude and others) A manager or admin can connect Mays to an AI app they use, such as ChatGPT, Claude or Grok. They start the connection in the AI app and approve it on a Mays page. The connection works as that one person, in one organization: the AI app can see only the locations and information that person can already see in Mays, and only while the connection is active. Depending on that person’s role, the AI app can read: - Schedules, shifts and open shifts, timecards and attendance, and requests such as time off and shift swaps. - Team members’ first names and last initials, roles, positions and locations. Team members’ phone numbers, email addresses and home addresses are never shared. - Sales, orders and labor hours from your point-of-sale system. Guests appear only as an anonymous code; card details are never shared. - Wages, labor cost and tips, only if the person can see pay in Mays and chose to include pay when connecting. - Checklists and tasks, temperature readings, inventory, vendors, invoices, purchase orders, the knowledge base, and customer reviews (with the reviewer’s public name shortened to a first name and initial). - Files the person chooses to upload to Mays through the AI app, such as invoices and documents. **Changes:** an AI app can change anything in Mays only if an admin has allowed actions from AI apps for the organization and the person ticked “make changes” when connecting. Each change is shown to the person as a preview first and happens only after they confirm it, with the same permissions they have in Mays. **The AI provider:** what the AI app reads from Mays is sent to that AI provider (for example OpenAI, Anthropic or xAI) under the person’s own account with them, and is governed by that provider’s terms and privacy policy. Mays receives only the requests the AI app sends to Mays, not the person’s conversation with the AI app. We do not sell this information, and we do not use it to train AI models. **What Mays keeps:** a record of each request an AI app makes — who, which app, what it asked for and the outcome — for 180 days, shown to the person and to their organization’s admins under Settings → Connected AI apps. Phone numbers and email addresses in those requests are masked, and long text is shortened. **Tools that don’t need an account:** when an AI app uses Mays tools that don’t need an account, we keep a record of the request (the tool, the inputs and an anonymous ID from the AI app — never your name, email or IP address) for 90 days to prevent abuse. **Ending a connection:** the person can disconnect at any time in Settings → Connected AI apps, an admin can disconnect anyone in their organization or turn AI app connections off, and deactivating a person ends their connections. After that, the AI app can no longer read anything from Mays. ## 4. Data Security We implement industry-standard security measures including encrypted data transmission (TLS), encrypted authentication tokens, encrypted storage of sensitive credentials, and role-based access controls. However, no system is 100% secure, and we cannot guarantee absolute security. We use Cloudflare Turnstile to protect our forms from spam. ## 5. Data Retention We retain your data for as long as your account is active or as needed to provide the Service. When you delete your account, it is closed right away. Your contact and sign-in details (email, phone, photo, password and PIN) are permanently removed 30 days later. Your employer keeps the work and pay records (shifts, hours and pay) that the law requires them to keep. ## 6. Your Rights Depending on your location, you may have the following rights regarding your personal information: - Access the data we hold about you. - Correct inaccurate data. - Request deletion of your data. - Export your data in a portable format. - Opt out of marketing communications. To exercise these rights, use our contact form at [mays.app/contact](https://www.mays.app/contact) or call us at [(561) 286-3939](tel:+15612863939). ## 7. Children's Privacy The Service is not intended for users under 13 years of age. We do not knowingly collect personal information from children. ## 8. International Data Transfers Our servers are located in the United States. By using the Service, you consent to your data being transferred to and processed in the United States. ## 9. Third-Party Links and Services The Service may link to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies. ## 10. Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance. ## 11. Contact Us If you have questions about this Privacy Policy or our data practices, contact us at: YYVZ LLC dba Mays.App Contact form: [mays.app/contact](https://www.mays.app/contact) Phone: [(561) 286-3939](tel:+15612863939) Website: [https://www.mays.app](https://www.mays.app) Canonical: https://www.mays.app/privacy