ZEUS Privacy and Data Policy

This Global Privacy Policy (this "Privacy Policy" or "Policy") describes how Zeus collects, uses, discloses, stores and retains information — including Personal Information — in connection with the Services: the Zeus mobile applications, the Zeus web portal, tokenized link pages (document view, quote acceptance, signing and price-book import links), the Zeus supplier portal and public offer pages, and any websites and related services Zeus operates from time to time. It is written for every person the Services touch: Customers and their Account Owners, Administrators, Members and Helpers (together, Authorized Users), Invited Users, Link Recipients, Clients whose information a Customer causes Zeus to process, the members of supplier organizations that use the supplier portal ("Supplier Users"), and individuals who apply to or take part in the Zeus Partner Program through the Zeus partner portal ("Partners").

Capitalized terms used and not defined in this Policy have the meanings given in the Zeus Global Terms of Service and the defined terms used across the Zeus legal documents (including "Services", "Customer", "Account Owner", "Authorized User", "Helper", "Invited User", "Link Recipient", "Client", "Customer Content", "End-Customer Data", "Worker Data", "Account Data", "Personal Information", "Aggregated Data", "Usage Data", "Device Data", "Location Data", "Telemetry", "Offline Data", "Subprocessor", "DPA", "Third-Party Services" and "Supplement").

Jurisdiction-specific privacy disclosures for Canada, the United States, Australia and New Zealand are set out in the Canada Privacy Supplement, United States Privacy Supplement, Australia Privacy Supplement and New Zealand Privacy Supplement. Where mandatory law of your jurisdiction requires different or additional treatment, the applicable Supplement controls to the extent of that mandatory requirement, and only to that extent; this Policy's global positions otherwise remain in full force.

---

1. Scope, Status and Acknowledgment

Scope of this Policy. This Policy applies to information processed in connection with the Services on surfaces Zeus operates. It does not govern all information Zeus may process: it does not apply to Third-Party Services, third-party websites, products, applications, app stores or embedded content, even where they link to or are reachable from the Services (see Section 5.2), and it addresses Customer Content that Zeus processes for a Customer only through the two-roles structure in Section 2.

This Policy is a notice, not a contract; acknowledgment and consent.

This Privacy Policy is a transparency notice: it is expressly NOT part of the Zeus Global Terms of Service or any other agreement between you and Zeus, and it creates no contractual rights or warranties. By creating an account, accessing or using any part of the Services, or otherwise providing information to Zeus, you acknowledge — and, where consent is the operative legal basis in your jurisdiction, consent to — the collection, use, disclosure, storage and retention of information described in this Policy, including as this Policy is revised from time to time. Zeus records your acknowledgment at signup together with the Policy version; continued access to or use of the Services after a new version takes effect constitutes acceptance of the then-current version (Section 15).

Providing information is voluntary; consequences of refusal; sole recourse. You may choose not to provide information to Zeus; however, because the Services cannot operate without core account, business and device information, refusal may prevent or severely constrain Zeus's ability to provide the Services or your ability to use them. If you disagree with the practices described in this Policy, your sole recourse is to not access or use — or to stop accessing and using — the Services and to close your account.

Privacy-related claims sit under the Terms.

Although this Policy is not part of any agreement, any claim, dispute or controversy relating to privacy, data protection, or Zeus's information practices is a claim arising out of or relating to the Services and remains subject to the Zeus Global Terms of Service — including its limitation-of-liability, damage-exclusion and dispute-resolution provisions — as stated in the Terms.

---

2. Zeus's Two Roles

Zeus as accountable organization (controller) for Account Data.

Zeus is the organization accountable for — and the independent "controller"-equivalent of — Account Data: registration and login information, billing and subscription records, device Telemetry and diagnostics, security logs, support communications, and Zeus's own website and product-usage data. This Policy governs Account Data directly. The Zeus Data Processing Addendum does not apply to Account Data.

Zeus as processor/service provider for Customer-entered data; routing.

For End-Customer Data, Worker Data and other Customer Content that a Customer or its Authorized Users enter into or collect through the Services — client and job-site records, contact details, job and financial documents, photos, signatures, time entries and similar records — the Customer controls that information, and, unless otherwise required by law, Zeus processes it solely as a service provider (processor) on the Customer's behalf and instructions. If you are a Client, worker, Helper, Invited User, Link Recipient or any other individual whose information a Customer has caused Zeus to process, direct any question, concern or request about that information to that Customer (the business you dealt with): the Customer is responsible for its own privacy practices, and Zeus will refer requests concerning Customer-processed data to the relevant Customer. Data Processing Addendum cross-reference. Zeus's processor-role obligations for End-Customer Data and Worker Data are set out exclusively in the Zeus Data Processing Addendum (the DPA), and are limited to those obligations that applicable data-protection law expressly requires of a processor/service provider. Nothing in this Policy adds to, or creates independent claims in respect of, the DPA; for Account Data the DPA does not apply (Section 2.1).

Supplier offers and order requests. Zeus is the accountable organization for the account information of Supplier Users and for the records of the supplier portal (Section 3.12). When a Customer sends an order request to a supplier (Section 3.11), the request is part of that Customer's records and Zeus delivers it on the Customer's instruction; once the supplier receives it, the supplier holds what it received as an independent business, under its own privacy practices (Section 5).

---

3. Information We Collect

This Section describes Zeus's current data practices. Zeus does not collect information for features it does not offer: Zeus has no advertising SDKs, no advertising cookies, no audience-matching technology and no session-replay technology; no data-enrichment or credit-check practices; no call or screen recording; no background or continuous location tracking; no facial recognition; no large-language- model processing of your information; and no customer portal accounts. Zeus does use third-party product-analytics processors — PostHog Inc. (United States) for the usage telemetry described in Section 3.7, and, on the Zeus website only, Google LLC (United States) where Zeus has enabled Google Analytics — and you can switch the mobile application's share of that off at any time; and one third-party crash-diagnostics processor, Functional Software, Inc. (d/b/a Sentry) (United States), for the crash and error diagnostics described in Section 3.7, which are a service-integrity and security function of the mobile application and of Zeus's backend services and are not governed by that switch. Push notifications to the Zeus mobile applications are delivered by Google LLC (Firebase Cloud Messaging) (United States), which acts as Zeus's push-delivery processor on both Android and iOS. On iOS, Firebase Cloud Messaging in turn hands each notification to Apple Inc. (Apple Push Notification service) (United States) for delivery to the device, so Apple receives the device token and the contents of each notification in transit. Both are described in Section 3.7. Receipt text recognition runs within Zeus's own systems, as described in Section 3.8. Where a business's Account Owner connects a Google account for photo backup, Zeus receives limited information from Google and copies that business's stored photos and related job information into that Google account's Google Drive, as described in Section 3.10. Where a team member, or a business for its company calendar, connects Google Calendar or Outlook Calendar, Zeus exchanges schedule information with that calendar in both directions, as also described in Section 3.10. Before Zeus adopts an additional collection practice, this Policy will be updated and its version bumped.

Account, billing, support and business-profile data. When you sign up for or use the Services, Zeus collects: name, email address, password (stored as a hash), phone number where provided; business name, trade, logo and settings; where Google sign-in is used, the identity claims Google sends Zeus (name, email, subject identifier); subscription, plan, trial, coupon and referral records; support tickets and communications you send Zeus; and consent records (terms-acceptance and privacy-acknowledgment timestamps with policy versions). Zeus processes login IP addresses for security and rate-limiting purposes.

Customer Content your business enters. Customers and their Authorized Users enter Customer Content into the Services: client, job-site and general-contractor records (names, phones, emails, addresses, notes, site coordinates); jobs, schedules and appointments; quotes, invoices, payment records, price-book entries and purchase orders; plans and takeoff markups; subcontractor contracts; time entries and their approval state; crews and crew membership; team-availability records (a person, a date range, and a reason drawn from a fixed list that includes vacation, sick, personal, public-holiday, training, parental, bereavement, jury-duty and unpaid leave); job checklists and to-dos; skill, certification, licence and insurance records held about the people your business works with, which may include a licence or registration number, an issuing body and an expiry date; and photos, documents and signatures. Zeus stores and processes Customer Content to provide the Services, in its processor role described in Section 2.2; responsibility for the lawfulness of that data rests with the Customer as described in Section 10.

Location Data: six snapshot purposes only; no background tracking.

Zeus collects device location only as point-in-time snapshots, only for the following six purposes, and only where the operating-system permission has been granted and the relevant feature is used:

1. Photo location tagging (fallback): when a photo you capture lacks embedded GPS metadata, the app may stamp the device's current location onto that photo (foreground only).
2. Clock-in/clock-out snapshots: when a worker starts or ends a tracked time entry, the app may capture the device's coordinates at that moment (best-effort; recorded as empty if permission is denied).
3. GPS at signing (optional): where enabled, a signing event may record the signer's coordinates as part of the signing evidence (Section 3.6).
4. Address geocoding: street addresses your business enters are converted to coordinates through Zeus's backend geocoding service (Section 5.1).
5. Map-tile requests: the day-board route map fetches map tiles from the OpenStreetMap tile server directly from your device, which exposes your device IP address and the viewed map area to that third-party server (Section 5.2).
6. Receipt and expense capture: where the "record where I scanned this" switch is on, the app takes a coordinate snapshot when a receipt or expense form is opened and again when a receipt is scanned, and stores it on that record. It applies to a receipt entered by hand as well as one photographed. That switch is **on by default**; it is shown on the capture screen itself rather than in settings, so it is visible to the person it applies to at the moment it applies, and an individual who turns it off has that choice remembered on that device. These coordinates, and the distance to the nearest geocoded job site, appear on the receipt and expense reports and exports available to the Account Owner.

Location capture is snapshot-only: no background location collection, continuous tracking or geofencing capability exists in the Services, and location permission is requested from you before any collection, with denial degrading the feature gracefully rather than blocking the Services. Worker location snapshots and location-tagged records are collected for and made available to the Account Owner and its authorized users as described in Section 3.7. Location Data is never used for advertising or marketing and is never sold.

Photos and media metadata; no biometric identification.

When photos are captured or uploaded through the Services, Zeus reads embedded EXIF metadata (capture time and, where present, GPS coordinates). Before a photo is stored in Zeus's cloud storage, embedded EXIF data is stripped from the stored image file; the capture time and any GPS coordinates are retained as database metadata associated with the photo and are used to match photos to nearby job sites.

Photo metadata — including capture time and location metadata — is collected and made available to the Account Owner and its authorized users. Zeus does not process photos or videos to identify any individual; if a Customer's use of imagery ever involves biometric-type data, the Customer controls that data and bears all related notice, consent and retention duties (Section 10). Photo-library EXIF scan ("Find Nearby Photos"). If you use the "Find Nearby Photos" feature and grant the photo-library permission, the app reads the EXIF location and capture-date metadata of images in your device's photo library (scoped to the access you grant) solely to suggest photos taken near a job site. This scan runs on your device; library images are not uploaded by the scan itself, and only photos you then choose to attach are uploaded.

Signatures and signing-evidence data. When a document is signed through the Services, Zeus captures and stores an append-only signing evidence record: the signer's name and contact details as entered, the signature image, IP address, device summary, content hashes of the signed document, consent records, server timestamps, and — where the optional feature is enabled — the signer's GPS coordinates at signing (Section 3.3, purpose 3). Signer identity is recorded as unverified (link/PIN-based). Signing-evidence records are designed to survive account purge as processing evidence (Section 8).

Device Data, Usage Data and Telemetry; cookies. Zeus collects: Device Data (device model, operating system and version, locale, app install identifier, error stacks and crash diagnostics); Usage Data and Telemetry (server-side product events keyed to business and user identifiers, session heartbeats while logged in, feature-usage events); and, on web surfaces, strictly necessary first-party cookies and tokens (authentication, session, security, preferences) together with the analytics cookies described in the Zeus Cookie and Tracking Policy. Telemetry is collected into Zeus's own infrastructure and is also processed by PostHog Inc. (United States), which acts as Zeus's product-analytics processor for the mobile application, the Zeus website and Zeus's server-side product events, on Zeus's instructions and for no purpose of its own. On the Zeus website Zeus additionally deploys Google Analytics; where Zeus has enabled it, Google LLC (United States) acts as a website-analytics processor and sets first-party analytics cookies. Both website analytics processors run only where the visitor has allowed analytics under the Zeus Cookie and Tracking Policy, and neither runs where the browser signals Global Privacy Control. Under that same choice, and never where the browser signals Global Privacy Control, the Zeus website also sends to Zeus's own infrastructure a report of an uncaught browser error on the page (the error type, a redacted message and stack trace, the page path without its query string, and the website release identifier) so that Zeus can find and fix faults in the website. These website error reports carry no cookie and no account, device or visitor identifier, are redacted of personal information and credentials in the browser and again on receipt, are not sent to any analytics or crash-diagnostics processor, and are retained for up to 90 days; where analytics have not been allowed, none is sent. Error stacks, crash diagnostics and a sampled share of performance traces from the mobile application, together with server-side exception and performance events from Zeus's backend services, are additionally processed by Functional Software, Inc. (d/b/a Sentry) (United States), which acts as Zeus's crash-diagnostics processor on Zeus's instructions and for no purpose of its own. Server-side events carry request metadata and environment and release identifiers; personal data is not sent by default, and credentials, tokens and other sensitive fields are redacted before transmission. Zeus does not enable Sentry's session-replay or screenshot-attachment features. No third-party advertising SDK, advertising cookie, audience-matching technology or session-replay technology runs in the Services. How optional analytics are controlled differs between the mobile application and the website. In the Zeus mobile application, product analytics are on by default, and you can turn them off at any time in Settings › Privacy › Share Usage Data; turning them off stops both collection and transmission from that device. On the Zeus website, analytics load nothing and send nothing unless you affirmatively allow them when Zeus asks on your first visit or afterwards at https://fieldzeus.com/legal/privacy-choices, where a browser sending the Global Privacy Control signal is treated as a decline. That control governs product analytics and the website error reports described above only, and does not stop the other crash and error diagnostics described above, which Zeus processes as a service-integrity and security function. Raw telemetry is retained for 30 days and aggregated telemetry rollups for 365 days (Section 8.5). Location coordinates are removed from Zeus's analytics events, and diagnostic logs are scrubbed of personal information.

When you sign in to the Zeus mobile application, Zeus also collects a push registration token — an identifier that the Firebase Cloud Messaging service issues to a single application install so that a message can be routed to it — together with the member and business identifiers the install is signed in as, the device platform, the time Zeus last saw the token, and, where the application is new enough to send it, that install's own identifier. Zeus keeps one such record for each install and re-registers it whenever the operating system issues the install a new token; signing out marks the record deleted, after which the token can no longer be used to reach the device. The application asks for the device's notification permission at sign-in, and that permission, together with your operating system's notification settings, governs whether a notification is shown to you.

The registration token is the personal-information element in this collection. The notifications themselves are reduced to a short work label and record identifiers before they are sent — that a job has been assigned to you and that job's own title, or that a change you made needs a decision — and carry no client name, address, phone number or email address. Delivery is performed by Google LLC through Firebase Cloud Messaging, which acts as Zeus's push-delivery processor on Zeus's instructions and for no purpose of its own and which receives the registration token and each message Zeus sends through it (Section 5.1); the Firebase software development kit in the application also generates its own installation identifier on the device. Push notifications carry work events inside your Workspace and are never used for marketing. On iOS, delivery additionally passes through Apple's Push Notification service: the application registers a device token with Apple Inc., and each notification Zeus sends is handed by Firebase Cloud Messaging to Apple for delivery. Apple therefore receives that token and the contents of each notification in transit, acting as a push-delivery party on the same terms — on Zeus's instructions, for no purpose of its own, and never for marketing.

The Zeus Cookie and Tracking Policy describes Tracking Technologies in detail.

Receipt images and OCR; no third-party OCR; no significant automated decisions.

If your business uses the expenses module, receipt images you scan are transmitted to Zeus's own systems, where Zeus's text-recognition service produces draft parsed values (supplier, amounts, tax, categories). Receipt content leaves your device only to Zeus's own systems: no third-party OCR or AI vendor is involved.

OCR-parsed values are Machine-Generated Output — drafts requiring your review — and Zeus gives no warranty of the readability of receipts you upload or of the accuracy or completeness of values its OCR service extracts from them, as further described in the Machine-Generated Output provisions of the Zeus Global Terms of Service. Zeus does not make decisions producing legal or similarly significant effects about any individual solely by automated means; Zeus may use automated risk signals (for example, fraud or abuse flags and rate-limiting) to protect the Services. Workforce data visibility; always-on activity logging.

If you use the Services under a business's Workspace as a Member, Helper or other Invited User, your activity, time entries and the approval or rejection of them, clock-event location snapshots, any location snapshot taken when you record a receipt or expense, assignments and crew membership, time recorded against you as unavailable together with the reason given for it, any skill, certification, licence or insurance record held about you, and other in-tenant data are collected for, and are visible to and may be monitored, processed and analyzed by, the Account Owner and its authorized administrators; you should have no expectation that in-tenant data is private from the business that invited you. Two of those are worth stating plainly. A reason for absence — which may indicate sickness, a bereavement or parental leave — is recorded by whoever schedules work and, once recorded, is readable by every user of that Workspace rather than by managers alone, because it is shown on the shared planning board. And a pay rate, the hours approved against it and the resulting pay total are readable by, and exportable by, the Account Owner and the administrators it authorizes. Zeus does not decide who inside a business may see either; the business does, and Section 10.2 places the notice and authorization duties for both on it. No in-tenant "private" setting defeats the Account Owner's access: content you submit within the Workspace may be accessed, copied and processed by the business's administrators. The Services maintain an always-on, append-only activity and audit log that users cannot disable. The business you work for — not Zeus — decides how these features are used and is responsible for all workplace-monitoring notices and authorizations (Section 10.2).

Google Drive photo backup (optional; connected by the Account Owner).

What it does. A business's Account Owner may choose to connect a Google account to Zeus so that Zeus copies the business's photos into Google Drive. Only the Account Owner can connect, switch or disconnect the Google account. The Account Owner and the business's administrators can start, cancel and retry a backup, and can turn automatic backup on or off; automatic backup is off until one of them turns it on. Zeus records each connection, disconnection and backup in the business's audit log.

What Zeus copies into Google Drive. Zeus copies:

1. Photos, as stored in Zeus. Each copy is the same file Zeus stores: a reduced-size image from which embedded metadata, including embedded location data, has already been removed (Section 3.4). Zeus does not copy the original camera file, and does not copy the capture-location coordinates it holds as database records.
2. Job names in folder names. Photos are placed in a folder named after the job (the job number and job title as your business entered them) inside a folder named "Zeus Job Photos". Job titles often contain a client's name or a site address.
3. Photo captions as the file description in Google Drive.
4. Index files. CSV files ("_Manifest.csv" in the main folder and "_Photos.csv" in each job folder) listing, for each photo: the job number, job title, client name, the job's status in Zeus, the job date, the photo date, the caption, the folder and file names, the file size, and the backup status and date.
5. Private technical labels attached to each file and folder (Zeus's internal identifiers for the business, job and photo, and a file checksum), which Google makes visible only to Zeus's application and which Zeus uses to find its own files again.

What Zeus receives from Google. Zeus requests three permissions: the Google account's basic identity (openid), its email address (email), and Google Drive's https://www.googleapis.com/auth/drive.file permission. The drive.file permission lets Zeus see and change only the files and folders Zeus itself creates in that Google Drive; it does not let Zeus see, open or list any other file in the Google account. From Google, Zeus receives and stores: the Google account's identifier, email address and, for a Google Workspace account, its organization domain; the permissions granted and, where access is time-limited, when that access ends; OAuth access and refresh tokens; the Google Drive's available storage; and, for files and folders Zeus created, their identifiers, names, sizes, checksums, folder location and whether they have been moved to the trash or removed.

How Zeus uses it. Zeus uses information received from Google only to provide the photo backup feature the Account Owner turned on: to copy photos, to avoid copying the same photo twice, to confirm each copy arrived intact, to show the business the state of its backup (for example, the connected account, available space and the result of each backup), and to tell the business when a backup is paused because the connection needs to be renewed, the Google Drive is full, or the organization's Google Workspace administrator has blocked it.

Security. OAuth access and refresh tokens are encrypted at rest with a key used only for this feature, are never sent to the Zeus app on any device, and are removed from Zeus's diagnostic logs and crash reports.

Disconnecting. The Account Owner can disconnect Google Drive in Zeus at any time. When a connection ends, Zeus stops starting new copies, cancels any backup in progress (a copy already being sent at that moment may finish), deletes the stored tokens and asks Google to revoke Zeus's access, unless another Zeus business is using the same Google account for the same feature, in which case Zeus deletes its own tokens but leaves that access in place and the Google account holder can remove it in their Google account settings. A connection also ends when the person who connected it stops being able to manage it, and when account deletion is requested (Section 8.3). You can also remove Zeus's access at any time from your Google account's security settings. Disconnecting, or deleting your Zeus account, does not delete the copies already in Google Drive, and Zeus cannot delete them (Section 10.5).

Google's terms apply to the copies. Once a copy is in Google Drive, Google LLC (or the Google entity that provides the Google account) stores it under the terms and privacy policy that apply to that Google account, which the Account Owner or its organization agreed with Google. Google does not act as Zeus's Subprocessor for those copies, and Zeus does not control where Google stores them or how long Google keeps them.

Google API Services User Data Policy — Limited Use. Zeus's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular, Zeus does not sell information received from Google; does not use or transfer it for advertising, including retargeting, personalized or interest-based advertising; does not use or transfer it to determine credit-worthiness or for lending purposes; does not use or transfer it to create, train or improve any machine-learning or artificial-intelligence model; does not transfer it to third parties except as needed to provide the backup feature, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent; and does not allow people to read it unless you have given affirmative agreement for specific data (for example, in a support request), it is necessary for security purposes such as investigating a bug or abuse, it is necessary to comply with applicable law, or it is aggregated and anonymized for internal operations.

Calendar sync with Google Calendar or Outlook Calendar (optional; connected per person).

What it does. A team member may connect their own Google Calendar or Outlook Calendar (Microsoft) so that their Zeus schedule appears there and changes made in that calendar come back into Zeus. Separately, the business's Account Owner or an administrator may connect one company calendar, which Zeus creates in that account and names "ZEUS — " followed by the business name, to hold the whole business's schedule. Each person connects, and can disconnect, only their own calendar; only an Account Owner or administrator can connect or disconnect the company calendar. Each connection, disconnection and calendar change Zeus applies is recorded in the business's audit log, without the event's content.

What Zeus sends to the calendar. For a job, Zeus sends only the job title, the site address and the scheduled time. It never sends the client's name, phone number or email address, any note or any price. For an appointment, Zeus sends its title, description, location and time. On the company calendar, a visit's event also lists the names of the team members assigned to it. Each event Zeus creates carries a private Zeus identifier so Zeus can find its own events again.

What Zeus receives from the calendar provider. On a personal Google calendar Zeus requests https://www.googleapis.com/auth/calendar.events.owned, which lets it see and change events on calendars the person owns, and https://www.googleapis.com/auth/calendar.freebusy, which shows only when the person is busy. For the company calendar Zeus requests https://www.googleapis.com/auth/calendar.app.created, which lets it manage only the calendar Zeus itself creates and not any other calendar in that account. On Outlook, Microsoft offers no narrower permission, so Zeus requests Calendars.ReadWrite and offline_access. Using those permissions, Zeus reads events in the connected calendar that changed within roughly 30 days in the past to one year ahead — their title, description, location, start and end time, and when they were last changed — and stores: OAuth access and refresh tokens; the calendar's identifier; for each synced event, its identifier and a fingerprint of its content used to detect changes; and busy time ranges (a start, an end and whether the block is all day — never the event's title, attendees, location or description).

How Zeus uses it. Zeus uses calendar information only to provide calendar sync for the person or business that connected it: to keep the schedule the same in both places, and to warn when someone may be busy at a time being planned. When an event Zeus created is moved or changed in the calendar, Zeus updates the matching visit, job dates or appointment in Zeus; when it is deleted there, Zeus removes the scheduled time (a job itself is never deleted, and a job's site address is never changed, from a calendar). An event added directly in a personal calendar comes into Zeus as a private appointment, visible only to that person and to the business's Account Owner, administrators and office staff; an event added to the company calendar comes into Zeus as a company appointment visible to the business.

Security. OAuth tokens are encrypted at rest with a key used only for this feature, are never sent to the Zeus app on any device, and are removed from Zeus's diagnostic logs and crash reports. Error messages from the calendar provider are never stored in raw form, because they can contain other events.

Disconnecting. A person can disconnect their calendar in Zeus at any time, and an Account Owner or administrator can disconnect the company calendar. When a calendar is disconnected, Zeus deletes the stored tokens, asks the provider to revoke Zeus's access and stops syncing. Events already in the calendar stay there; Zeus does not delete them. You can also remove Zeus's access at any time from your Google or Microsoft account's security settings.

The Google API Services User Data Policy and Limited Use commitments above apply equally to information Zeus receives from Google Calendar; for Google Calendar, the transfers needed to provide the feature are the calendar sync described here. Zeus applies the same commitments to information it receives from Microsoft.

Supplier offers in the Zeus app. Where a business turns on supplier offers, Zeus shows its users offers from suppliers near the business. To choose which offers are eligible, Zeus uses, on its own servers, the business's trades, the country, and a browsing location the user selects — the business address, a job location, or, with the device's permission, the current location at that moment — together with the search radius the business sets. Suppliers never receive that location, coordinates or address.

Zeus records which offers were shown to a user and when, so that the same offer is not repeated too often, and the business's offer preferences: offers saved, hidden or dismissed, suppliers followed or hidden, and the radius and trades chosen. Zeus also records how users interact with offers — offer views, saves, dismissals, and taps on "Call" or "Email" for a supplier — as usage telemetry (Section 3.7). Those interaction records are not kept for a user who has turned off "Share Usage Data", except order requests, which are business records.

Order requests. A user can send a supplier an order request: an inquiry about an offer, which charges nothing, reserves nothing and creates no invoice. Before it is sent, the form shows exactly what the supplier will see. An order request carries the offer, the quantity and price shown at the time, the business's trade, and the details the user chooses to include: the business name, a contact name, a phone number, an email address, and notes. At least a phone number or an email address is required so the supplier can reply. No job address and no location is included.

Contact activity shown to suppliers. Suppliers see counts of how their offers are viewed and contacted, never which business viewed them. A business's Account Owner or Administrator may turn on "Let Suppliers See When My Business Contacts Them" (off by default). While it is on, a supplier sees the business name and trade, and the time, offer and branch, when someone at the business taps "Call" or "Email" on that supplier's offers; it never shows a person's name, phone or email. Turning it off removes the business's name from what suppliers see through the Services from then on, including for earlier taps, but cannot recall a file a supplier has already downloaded.

Supplier portal accounts and supplier content. Supplier organizations use the Zeus supplier portal by invitation. For each Supplier User, Zeus collects an email address, a display name, a role, a password (stored as a hash), and, where the user turns it on, a two-step verification secret; Zeus records sign-ins and sessions, including the IP address and device or browser type, failed sign-in attempts and lockouts, and the actions a Supplier User takes in the portal. For rate limiting and abuse prevention Zeus keeps IP addresses and browser details only as one-way keyed hashes.

A supplier organization may give Zeus its organization and branch details (including business addresses, phone numbers and hours), offers and their images, an email inbox for order requests, and stock reports. Stock reports contain product and sales information (such as item codes, descriptions, quantities, costs, prices and sale dates), which Zeus uses to find slow-moving stock and suggest offers for that supplier; Zeus does not show one supplier's stock information to any other supplier or to Zeus businesses. Zeus removes all embedded metadata, including location data, from offer images when they are uploaded.

Zeus reviews offers before businesses see them, and may edit, pause or remove an offer or pause a supplier organization; the supplier is told in the portal when this happens and why. Zeus sends Supplier Users service emails (invitations, sign-in and verification messages, and order requests) in English.

Public offer pages. A supplier may share an approved offer through a public Zeus page and a downloadable image with a QR code. The page sets no cookies and runs no scripts. Zeus counts visits to each page per day without identifying the visitor, and uses the visitor's IP address only to limit excessive requests, keeping it only as a one-way keyed hash. Where a person signs up for Zeus through a supplier's code, Zeus records that code, and how it reached Zeus, as part of the new business's account information; the supplier sees totals only, and small totals are withheld, so a supplier cannot tell which business signed up. Images and previews that others have saved or that messaging apps have cached are outside Zeus's control.

Partner Program. When you apply to or take part in the Zeus Partner Program, Zeus collects your name, display name, email address, country and region, sign-in and session records, the payout method and payout reference you give, the tax information the law requires Zeus to hold to pay and report on you (such as a Business Number, a Social Insurance Number where an individual must be reported on a T4A slip, or a tax form), your acceptance of the Partner Program Agreement, messages you send Zeus through the partner portal, and records of your partner codes and links, the signups attributed to them, and your commission and payouts. Zeus uses this information to run the Partner Program, pay you, meet its tax and reporting obligations, and prevent fraud.

---

4. How We Use Information

Purposes of use. Zeus uses the information described in Section 3 to: (a) provide, operate, maintain, secure and support the Services, including authentication, synchronization, document generation and sending, and the features you or your business enable; (b) administer accounts, plans, subscriptions, trials, coupons and the referral program; (c) process security-purpose data, including login IP addresses for rate limiting and abuse prevention, and automated fraud/abuse risk signals; (d) monitor, analyze and improve the Services using the analytics and Telemetry and to develop new features and products, including through Aggregated Data (Section 13); (e) communicate with you as described in Section 11; (f) comply with law, enforce the Zeus Terms of Service and other Zeus policies, and establish, exercise or defend legal claims; and (g) for any other lawful purpose, or other purpose that you consent to.

Zeus may also process information for any other lawful purpose, or other purpose that you consent to. Security-purpose processing includes automatically processing login and request IP addresses and related signals to detect fraud, abuse and unauthorized access.

---

5. How We Disclose Information

Service providers and Subprocessors.

Zeus discloses information to service providers that host and support the Services. Zeus's current Subprocessors and infrastructure providers are listed on the published subprocessor page at https://fieldzeus.com/legal/subprocessors, which currently comprises: Cloudflare, Inc. (network and security edge, and R2 object storage, region-pinned as described in Section 6.2; and Cloudflare Turnstile bot checks on sign-in and certain public forms); Resend, Inc. (transactional and document email delivery, United States); Brevo. SIB INC. US (Zeus's own marketing and lifecycle email, and the contact records supporting it; contracting entity in the United States, hosting infrastructure in the European Union); KEPTAGO LTD, trading as Geoapify (conversion of the street addresses your business enters into coordinates, for addresses in every country Zeus serves — both where one of your users asks for an address to be looked up and for addresses already held in your Workspace; established in Cyprus, with the service hosted in European Union data centres); PostHog Inc. (product analytics and usage telemetry, United States); Functional Software, Inc. (d/b/a Sentry) (crash and error diagnostics for the mobile application and for Zeus's backend services, with a sampled share of performance traces from the mobile application only — server-side performance tracing is switched off, United States); RevenueCat, Inc. (subscription and entitlement records for Zeus's own paid plans, United States); Google LLC (Google Analytics — website analytics for the Zeus website, where Zeus has enabled it and only where the visitor has allowed analytics, United States); Google LLC (Firebase Cloud Messaging — delivery of push notifications to the Zeus mobile applications, and the device registration tokens that make delivery possible, United States); Apple Inc. (Apple Push Notification service — delivery of push notifications to the Zeus iOS application, and the device tokens that make delivery possible, United States); Intuit Inc. (QuickBooks Online API — where a supplier's owner connects the supplier's own QuickBooks Online company, read-only access to its accounting records for supplier inventory and sales analytics; contracting entity in the United States, records held wherever Intuit hosts that company); and Google and Apple (identity providers, if you sign in with Google or with Apple). Receipt text recognition is performed within Zeus's own systems (Section 3.8), so no OCR vendor is listed.

Using a feature constitutes your ongoing consent to the disclosure of the associated information to that feature's Subprocessors — for example, storing photos in Zeus's cloud storage discloses photo data to Zeus's storage provider, sending a document by email discloses recipient and content data to Zeus's email provider, and entering an address discloses it to Zeus's geocoding provider. Copying photos to your own Google Drive is not a disclosure to a Subprocessor; it is described in Sections 3.10 and 5.2. No opt-out is available for providers Zeus deems critical to the Services, such as infrastructure, security, and fraud or abuse prevention. The subprocessor list may change over time; publication of the change on that page is the exclusive notice channel for subprocessor changes, and you are responsible for checking it. Third-Party Services are outside this Policy.

This Policy does not apply to — and Zeus is not responsible for — the personal- information practices of Third-Party Services, third-party websites, products, applications, app stores, embedded content or links, even where they link to or are reachable from the Services; you should review those third parties' own privacy policies carefully. This includes, today: the OpenStreetMap tile server (which receives your device IP address and viewed map area directly from your device when you use the route map); Google Maps (which receives a destination address or coordinates, and your device IP address, when you tap through for driving directions); YouTube (which receives device traffic when you play an embedded help video); Apple and Google app-store and review services; Google Drive, where a business's Account Owner has connected it for photo backup (which receives, from Zeus's servers, the photos, job names, client names and captions described in Section 3.10, and stores them under the Google account holder's own terms with Google); and your own device's SMS, dialer and email applications when you send messages from your device (Section 11.3).

Legal process, protection of rights, and lawful access.

Zeus reserves the right to access, read, preserve and disclose any information — including Personal Information and Customer Content — where Zeus believes, in its sole discretion, that doing so is appropriate or necessary to: (a) satisfy or comply with any applicable law, regulation, legal process or governmental request; (b) enforce the Zeus Terms of Service and other Zeus policies, including investigating potential violations; (c) detect, prevent or address fraud, abuse, security or technical issues; (d) collect amounts owed to Zeus; (e) respond to support requests; or (f) protect the rights, property or safety of Zeus, its users or the public. Such disclosures may be made to government or law-enforcement officials or to private parties, and Zeus makes no commitment to notify you before or after any such disclosure. Because information is stored and processed in the United States, Canada and other locations (Section 6), it may be subject to preservation or disclosure obligations under the laws of those jurisdictions, including lawful access by foreign courts, law enforcement and governmental authorities, and Zeus and its Subprocessors may disclose information without your consent where they believe in good faith that the law requires or permits it. Access by Zeus personnel (support access).

Zeus staff can access your Workspace to answer a support request or investigate a problem. To do so, a Zeus operator can open a time-limited support session and use the Services as one of your users. A support session must be linked to a support ticket for your business. It is recorded as resting either on consent you gave or on an emergency ("break-glass") access where your consent could not be obtained in time. It is limited to the areas of the Services chosen when it is opened — clients and job sites, jobs and timesheets, quotes, invoices and receipts, documents and photos, or your business profile, user profile and preferences — and it expires within thirty minutes of being opened and cannot be extended or renewed.

Every support session is recorded in Zeus's append-only operator audit log, and changes made in a support session are also written to your own business's audit trail. When a support session is opened, Zeus emails the user whose access is used, identifying the support case, whether the session rests on consent or on break-glass, what the session is limited to and when it expires; that email is sent on a best-effort basis and a delivery failure does not stop the session. You can ask Zeus about support access to your Workspace as described in Section 9. Business transfers.

Zeus reserves the right to disclose and transfer information — including Personal Information and Customer Content — to third parties as part of, or in diligence for, any potential or actual business or asset sale, merger, acquisition, amalgamation, consolidation, investment, round of funding, financing, reorganization or similar transaction, including before closing. Information may likewise be disclosed and transferred in the event of insolvency, bankruptcy, receivership, liquidation or dissolution proceedings, as part of the sale or reorganization process. Any acquirer or successor will be subject to the obligations of this Privacy Policy as it applies to the transferred information. Third-party businesses you contact, including suppliers. Where you choose to contact or share your details with a third-party business, such as a supplier, the information you share with that business is governed by that business's own privacy practices and policies, not by this Policy, and Zeus does not control that business's use of your information.

When you send an order request, Zeus delivers it to the supplier's portal and, where the supplier has a verified order inbox, emails it to that inbox through Zeus's transactional email provider; if you included an email address, replies from the supplier go directly to it. A supplier sees the name and trade of your business beside a "Call" or "Email" tap only if your business has turned on the setting described in Section 3.11. Tapping "Call" or "Email" opens your own device's phone or email application; Zeus records only the tap (Section 3.11) and never whether a call or message was made. Supplier Users' information is not disclosed to Zeus businesses, except the business details, offers and contact routes the supplier publishes.

To the partner who referred your business. If your business signed up through a Zeus partner's code or link, or told Zeus a partner referred it, Zeus shows that partner your business's name, the date it joined, its region, its current plan and status, how many months it has paid, and the commission the partner earned from it. Because a business name can identify its owner, Zeus treats this as Personal Information: it does not show the partner any email address, postal address, phone number, the owner's personal name, transaction records or anything inside your Workspace, and the Partner Program Agreement allows the partner to use what it sees only to follow its own referrals, never to market to you or share it.

No sale of Personal Information; no third-party marketing sharing.

Zeus does not sell Personal Information, and no mobile information, SMS opt-in data or consent records will be shared with third parties or affiliates for their marketing or promotional purposes; disclosure to Subprocessors supporting the Services (Section 5.1) is permitted. Location Data is never used for advertising and is never sold or shared for advertising purposes. These statements describe Zeus's actual practices; they are not a contractual warranty (Section 1.2), and if Zeus's practices ever change this Policy will be updated first (Section 15).

---

6. International Transfers and Storage Locations

Consent to cross-border transfer; weaker-law acknowledgment.

By using the Services or submitting information — and this applies expressly to users located in Canada, Australia and New Zealand — you consent to the transfer, storage and processing of your information in the United States, in Canada, and in any other location where Zeus or its service providers maintain facilities. You acknowledge that the laws of those jurisdictions may be less protective than the data-protection laws of your home jurisdiction and that your information may be subject to lawful access by courts, law enforcement and governmental authorities in those jurisdictions. If you do not consent to these transfers, you must not use the Services; your continued use constitutes consent. European Union / United Kingdom transfer mechanisms (standard contractual clauses, adequacy frameworks) are outside the scope of this Policy at this time: Zeus's launch jurisdictions are Canada, the United States, Australia and New Zealand, and Zeus makes no representation regarding EU/UK transfer frameworks.

Storage locations as fact; no data-residency warranty; relocation.

As a statement of current practice: Zeus's primary application data and object storage are hosted with Zeus's infrastructure providers with object storage region-pinned to an Eastern North America region, and receipt text recognition runs on Zeus's own infrastructure. Copies a business makes to its own Google Drive (Section 3.10) are stored wherever Google stores that Google account's files; that location is outside this practice and is not chosen or controlled by Zeus.

Zeus makes NO warranty that any specific hosting or storage location will be used or maintained or that a storage region will meet your data-residency requirements; the current-practice statement above is not a residency commitment. Regardless of storage region, traffic to and from the Services is processed at the network-edge data center closest to the connecting device, and copies of data may exist transiently or in backups, diagnostics and support tooling outside the primary region. Zeus may migrate accounts and relocate data between cloud facilities and regions at any time.

---

7. Security

Safeguards; no guarantee of security.

Zeus maintains commercially reasonable administrative, technical and physical safeguards designed to protect information under its control.

However, no system is perfectly secure: Zeus does not guarantee that unauthorized third parties will never defeat its safeguards or that information will never be accessed, disclosed, altered, lost, corrupted or destroyed, and you acknowledge that you provide your information at your own risk. To the maximum extent permitted by law, Zeus makes no warranty, express or implied, regarding the security of the Services, including with respect to the ability of unauthorized persons to intercept or access information transmitted through them. You acknowledge that the internet and telecommunications networks are inherently insecure and that Zeus will have no liability for any changes to, interception of, or loss of information while in transit over them. Zeus is not responsible for security issues that arise from Customer Content, Third-Party Services or applications, your own access administration, credential misuse or sharing, phishing of you or your users, your device configuration (including Offline Data on your devices), or circumvention of Zeus's measures. What Zeus's safeguards include. Zeus's current safeguards include: logical isolation of customer data between accounts; audit logging of changes, with append-only audit and payment records; operating-system-level device encryption plus the application sandbox and secure keystore for tokens on mobile devices; protection of local app data using device and application-level safeguards where the device supports them; scrubbing of personal information from diagnostic logs; and rate limiting and abuse controls. This description is informational and point-in-time, does not constitute legal advice or a warranty, is not incorporated into any agreement, and is subject to change without notice.

---

8. Retention and Deletion

Retention standard; Zeus sets retention parameters.

Zeus retains information for as long as reasonably required for the purposes described in this Policy, unless a longer retention period is required or permitted by law. Zeus may establish, and may change at any time, general practices and limits concerning use and storage, including the maximum period of time that data or content will be retained by the Services. Extended retention grounds.

Zeus may retain information beyond account closure or a deletion request — for a reasonable period or as long as the ground persists — for backup and archival cycles, fraud and abuse prevention, security, dispute resolution, enforcement of the Zeus Terms of Service and other agreements, establishment and defense of legal claims, legal and regulatory compliance, and other legitimate business purposes. Zeus may retain information for a longer period in the event of a complaint or where Zeus reasonably believes there is a prospect of litigation in respect of its relationship with you. Account deletion is two-phase; export first; what survives.

You can delete your account in-app (Profile → delete account) and can export your Workspace data in-app before doing so; export before deletion is solely your responsibility.

Account deletion is two-phase: the first phase immediately deactivates the account and revokes sessions; the second phase permanently purges account rows and stored objects on Zeus's schedule, which Zeus runs as soon as reasonably practicable — Zeus commits to no fixed automatic purge timing. Zeus's audit logs and its record that an erasure was performed are append-only and survive account purge by design, as evidence of the orderly and accurate processing of data, and are retained after termination or deletion. Other append-only records — including invoices, payments, signing evidence and the client communication timeline — cannot be edited or deleted while your Workspace exists, but they are erased with the rest of your Workspace's records on account purge; see Section 5 of the Zeus Data Retention and Deletion Policy, which governs what survives a purge. On or after account closure Zeus may delete, archive, retain or anonymize Customer Data in accordance with its policies and applicable law. Google Drive copies are not deleted. When account deletion is requested, Zeus ends any Google Drive photo backup connection straight away: it cancels any backup in progress, deletes the stored Google tokens and asks Google to revoke Zeus's access as described in Section 3.10. Account deletion and purge remove Zeus's own records of that connection with the rest of the Workspace. They do not delete, and Zeus cannot delete, photos, folders or index files that were already copied to Google Drive; those copies remain in that Google Drive under the Google account holder's control (Section 10.5).

Backups, residual copies, and uninstalling the app.

Backup copies are excluded from targeted deletion and are destroyed on Zeus's standard backup-rotation schedule, due to the cost and technical difficulty of deleting from backups. It is not technologically possible to remove each and every record of the information you have provided; residual copies may persist in systems and archives, and complete erasure cannot be assured. Uninstalling the mobile application deletes nothing server-side: Zeus may retain collected data after uninstallation, and the local on-device copy of Workspace data (Offline Data) remains on your device under your control until you remove it. Retention schedule (current parameters). Zeus's current retention parameters, published for transparency and subject to Section 8.1, are: raw device/session Telemetry — 30 days; aggregated synchronization-telemetry rollups — 365 days; photos after a plan downgrade — a 60-day grace period, at or after the end of which full-resolution files are reduced to thumbnails (thumbnails and records are retained, not hard-deleted); reducing a photo to a thumbnail changes only Zeus's stored copy and never changes or replaces a copy the business has already made to its own Google Drive (Section 3.10), and copies in Google Drive are outside Zeus's retention and deletion schedules; Zeus's own customer, billing and tax records — the statutory retention periods of the applicable jurisdiction (typically six to seven years); records inside your Workspace, including invoices and payments — for the life of the Workspace, then removed on account purge; account data after deletion — until the post-deletion purge; supplier offers — offer interaction records, including named contact activity, 13 months; the record of which offers were shown to a user, 120 days, and each day's featured offer, 90 days; daily public-offer-page visit counts, 25 months; supplier stock reports — the uploaded file, 30 days after it is processed, unprocessed uploads 30 days, working rows 7 days after processing, and the processed stock records and their findings 180 days; order requests — for the life of the sending business's Workspace. Zeus publishes a period only where a scheduled job enforces it; everything else is retained for as long as necessary for the purposes described in this Policy. The Zeus Data Retention and Deletion Policy carries the authoritative schedule.

Data after subscription end or termination.

Exporting your data before cancellation or termination is solely your responsibility; after termination Zeus has no obligation to maintain, retain or provide Customer Data, any post-termination retrieval window is discretionary and may be ended by Zeus at any time with or without notice, and Customer Data may thereafter be deleted. Zeus shall be entitled, except to the extent legally prohibited, to delete Customer Data by deleting the account. Offline Data remaining on your devices after termination is outside Zeus's systems and control; securing or deleting it is your responsibility.

---

9. Your Rights and How to Exercise Them

Rights exist as provided by applicable law and are not absolute.

Depending on your jurisdiction, you may have rights of access, correction, deletion, portability and objection or consent-withdrawal in respect of your Personal Information; these rights exist as provided by applicable law, are not absolute, and in some cases Zeus may limit or deny a request because the law permits or requires it, or because your identity cannot be adequately verified. The jurisdiction-specific rights, procedures and statutory response timelines for Canada, the United States, Australia and New Zealand are set out in the jurisdiction-specific Supplements.

Requests about Customer-processed data are routed to the Customer.

Zeus cannot honor requests concerning End-Customer Data, Worker Data or other Customer-processed information directly from Clients, workers or other individuals; those requests must be directed to the relevant Customer, and Zeus will assist that Customer in honoring them. Where a request reaches Zeus, Zeus may instruct you on how to fulfill it yourself through in-product self-service, refer you to the relevant Customer or its account administrators, or require additional information and documents before acting. Assistance Zeus provides to a Customer in connection with data-subject requests is provided at the Customer's expense as described in the DPA. If the business you dealt with has copied photos or job information to its own Google Drive (Section 3.10), a request about those copies — including a request to access, correct or delete them — must be made to that business. Zeus cannot access, change or delete copies in a business's Google Drive, and deleting information in Zeus does not delete those copies. Self-service channels first. For Account Data and your own Workspace, the designated request channels are the in-product tools: you can review and update profile and business information in-app, export your Workspace data in-app (Account → Export Data), and delete your account in-app (Section 8.3). Requests that in-product self-service can fulfill should be made through those tools; other requests may be sent to [email protected] or by mail to 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada.

Identity verification is a precondition.

Identity verification may be required before any data-rights request is fulfilled; failure to verify may result in denial of the request. Zeus may request up to three pieces of personal information to compare against its records, may ask for copies of relevant identity documents, and may take additional fraud-prevention steps. Where a request is made through an authorized agent, Zeus requires your written permission to the agent and direct verification of your identity with Zeus; failure to provide either may result in denial. Refusal grounds, fees, redaction and timing.

Zeus may refuse requests where allowed under law, including requests that are manifestly unfounded or excessive. Zeus may decline to process requests that are unreasonably repetitive, require disproportionate technical effort, jeopardize the privacy of others, are extremely impractical, or for which access is not otherwise required by local law, and may advise you accordingly where a request is frivolous or vexatious or cannot reasonably be processed in the manner requested. Where permitted by law, Zeus may charge a reasonable fee — or refuse to comply — where a request is clearly unfounded, repetitive or excessive. In certain limited circumstances Zeus may not be able to make all relevant information available, such as where information also pertains to another user or third party, in which case disclosures may be limited or redacted. Zeus responds within the timeline applicable law requires and reserves any extension that law allows.

Consent withdrawal and its limits.

Where processing is based on consent, you may withdraw consent at any time; however, withdrawal does not affect processing that occurred before withdrawal, and Zeus reserves the right to continue processing to the extent required or permitted by law. Because core processing is necessary to operate the Services, withdrawing consent may result in your inability to continue using the Services. You may not opt out of administrative or transactional communications (Section 11.1). Deletion-request carve-outs.

Zeus may decline to fulfill a deletion request, in whole or in part, where Zeus or its service providers are required or permitted to retain the information for enumerated purposes — including completing transactions and providing the Services; security, fraud and abuse prevention; debugging; legal compliance; establishing or defending legal claims; and internal uses compatible with the context in which the information was provided. Deletion is further subject to the two-phase mechanics, backup rotation, residual-copy limits and audit/financial-record survival described in Section 8, and Aggregated Data survives deletion as described in Section 13.

---

10. Business-Customer Responsibilities

The Customer's consent, notice and lawfulness duties.

Each Customer represents and warrants, on a continuing basis, that it has obtained and will maintain all legally and contractually required notices, consents, permissions and lawful bases for all information it or its Authorized Users submit to or collect through the Services — including End-Customer Data and Worker Data — and for its transfer to and processing by Zeus in the United States and Canada. The Customer is solely responsible for the accuracy, quality and legality of that information and of how it was acquired, for providing all legally required privacy notices to its own customers, employees, contractors and Authorized Users, for maintaining lawful bases, and for handling data-subject requests directed to it. The operative representations, warranties, prohibited-data rules and indemnities appear in the Zeus Terms of Service, Acceptable Use Policy and DPA; this Section summarizes them for transparency to individuals.

Workforce records belong to the business; monitoring authorizations.

Workforce records created under a business's Workspace — time entries, clock-event location snapshots, photos, assignments and crew membership, recorded absences and the reason given for them, skill and certification records, and activity data — belong to the business that owns the account, not to the individual users who created them, and location and time data are used to provide the Services to that business. Zeus is not permitted to delete those records at the request of an individual worker; workers should direct deletion and other requests to their employer or account administrator. The Customer is responsible for compliance with employment, workplace-monitoring, privacy, surveillance and consent laws applicable to its use of these features, and must obtain all requisite approvals and authorizations from its personnel for the creation, display, analysis and distribution of the data they generate. Location, photo, media and field-data consents; accuracy disclaimer.

Before enabling or using any location-dependent feature, and before collecting or processing location, GPS, photo, media or field data through the Services, the Customer represents and warrants that it has provided all required notices and obtained all required consents from employees, contractors, subcontractors, clients, property owners and other affected individuals, and the Zeus Acceptable Use Policy prohibits using location-based features without legally required notice and consent. Location, time and field data may be inaccurate, unavailable, delayed or incomplete, and may be affected by device settings, permissions, network conditions, user behavior, GPS limitations and third-party systems; Zeus disclaims all warranties that such data will be accurate, available, timely or complete. Zeus's liability for Customer-processed personal data.

Zeus explicitly disclaims any liability for the loss, disclosure or misuse of any personal data processed, uploaded or transmitted through the Services, except to the extent that such liability cannot be excluded or limited by law.

Copies your business makes to its own Google Drive.

When a Customer connects Google Drive for photo backup (Section 3.10), the Customer directs Zeus to copy Customer Content — photos, job names, client names and captions — out of the Services and into a Google Drive that the Customer's Account Owner controls. From the moment a copy is made:

• the copy is the Customer's record, held under the Google account holder's own agreement with Google, and is outside the Services, this Policy's retention and deletion practices and the Zeus Data Retention and Deletion Policy;
• Zeus cannot change or delete the copy, and does not delete it when a photo, job or client is deleted in Zeus, when Google Drive is disconnected, or when the Zeus account is deleted;
• the Customer is responsible for deciding who may access that Google Drive and the copies in it, for securing that Google account, for keeping or deleting the copies, and for giving any notice and obtaining any consent that the law requires before copying its clients' and workers' information to Google Drive; and
• the Customer is responsible for responding to requests from its own clients, workers and other individuals about those copies, including requests to access, correct or delete them.

Before connecting a personal Google account rather than one the business controls through Google Workspace, the Customer should consider who will keep access to the copies if that person leaves the business.

---

11. Communications and Marketing

Service and administrative communications are mandatory. Zeus sends service and administrative communications in connection with the Services. These are dispatched by email from Zeus's servers through its transactional email delivery Subprocessor (Resend, United States — Section 5.1), and, where your business triggers them, include document-delivery messages (quote, invoice, purchase-order and signing emails) sent at your direction (Section 11.3).

Service and administrative communications include account and email-verification notices, password and credential notices, security incident alerts, security and privacy update notifications, billing, subscription, trial and renewal notices, technical notices, and legal notices including notices of changes to the Terms or this Policy. You cannot opt out of service and administrative communications: they are integral to your use of the Services, and unsubscribing from marketing communications will not prevent you from receiving administrative messages regarding the Services or stop Zeus contacting you regarding administrative matters and your own requests. Where the mandatory law of your jurisdiction draws the transactional/commercial boundary differently, the applicable Supplement controls to the extent of that mandatory requirement.

Marketing communications: consent-based, and withdrawable at any time.

Zeus may communicate with you about products, services, features, offers and events we think may interest you. Zeus sends these messages only where it holds a lawful basis to do so for your jurisdiction — which, in Canada, Australia and New Zealand, means your express consent, given by an affirmative act and recorded with the date and the version of the wording you agreed to. Zeus does not treat silence, a pre-ticked box, or your use of the Services as consent to marketing. You can withdraw at any time by following the unsubscribe instructions contained within the message or by contacting [email protected]. Withdrawal is honoured without delay and in any event within ten (10) business days of the request; you may continue to receive messages already in flight for a short period while it is processed, and a withdrawal never applies to the service and administrative communications described in Section 11.1, which you continue to receive for as long as you have an account. Marketing is sent from a different sending domain than those service and administrative communications, so that a complaint about marketing cannot affect delivery of the messages your account depends on.

Every marketing message identifies Zeus and carries a working unsubscribe. Each message states that it is sent by Omni Data Tech Inc., gives Zeus's registered mailing address and an address at which Zeus can be reached, and carries an unsubscribe mechanism that can be used without charge, without signing in and without giving a reason, and that stays functional for at least sixty (60) days after the message is sent. Zeus keeps the record of the consent it relied on — what you were shown, when you agreed, by what act, and the version of the wording you agreed to — and retains that record after the consent ends under the Data Retention and Deletion Policy, so that Zeus can show the basis on which it wrote to you. The jurisdiction-specific requirements that apply to these messages — Canada's Anti-Spam Legislation, the CAN-SPAM Act, the Australian Spam Act 2003 (Cth) and APP 7, and the New Zealand Unsolicited Electronic Messages Act 2007 — are stated in the applicable Supplement, which controls for its jurisdiction.

Messages your business sends through the Services. The Services let your business communicate with its own Clients, Helpers and suppliers in two ways, both at your direction: (a) device-originated SMS, phone calls and emails (invoice sends, "on the way" notifications, Order Supplies orders, Helper invites) composed in the Services but sent from your own phone's dialer, SMS and mail applications over your own carrier or mail account — Zeus's servers send no SMS; and (b) server emails (quote, invoice, purchase-order and signing emails) that Zeus dispatches at your direction through Resend.

Your business is the sender and originator of every such communication, regardless of how it is transmitted, and is responsible for all such messages, including those sent by its employees, Members, Helpers, contractors or other users. Your business — not Zeus — must obtain all necessary consents from the recipients of its communications, and Zeus is not liable for communications your business sends to its users, employees, contractors, or potential or actual customers. The Customer's consent, lawfulness and record-keeping duties for these communications are set out in Section 10.1 and in the SMS, Email and Messaging Terms, which governs messaging conduct in full.

Messaging data and delivery providers.

Zeus does not sell, rent or share mobile telephone numbers, SMS opt-in or consent status, or related messaging consent data with third parties or affiliates for their own marketing or promotional purposes (Section 5.6); Zeus may share such information with service providers that assist in the delivery of messages — for Zeus today that is its transactional email delivery Subprocessor (Resend, United States) — acting on Zeus's instructions.

---

12. Security Incident Response

What counts as a Security Incident.

A "Security Incident" is a confirmed unauthorized access to or disclosure of personal data processed by Zeus; Security Incidents do not include unsuccessful attempts or activities that do not compromise the security of personal data, including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks and similar events. How and when Zeus notifies; no admission.

Zeus will notify affected Customers without undue delay after confirming a known or reasonably suspected Security Incident affecting their personal data, to the extent notification is required by applicable law, using the contact details provided under the Customer's account. The Customer is solely responsible for ensuring that its notification contact details are valid and accurate; incidents not specific to a particular Customer may be communicated through Zeus's status, blog or equivalent public channels. Zeus will take the remediation steps it in its sole discretion deems necessary and reasonable, within measures reasonably within its control, and no notification of or response to a Security Incident is or will be construed as an acknowledgment by Zeus of any fault or liability. Nothing in this Section limits any notification, record-keeping or reporting duty that applicable law imposes on Zeus and that cannot be excluded — including the statutory breach regimes of the launch countries, which are summarized in the jurisdiction-specific Supplements. Those duties are preserved in full.

Incidents involving Customer-processed data; carve-outs.

For End-Customer Data and Worker Data that Zeus processes for a Customer (Section 2.2), any and all regulatory and data-subject reporting obligations, decisions and filings related to a Security Incident are the responsibility of the Customer, as the party best placed to assess whether and to whom the incident must be reported; the DPA governs Zeus's processor-role incident duties and assistance. Zeus's incident-response obligations do not apply to incidents caused by the Customer, its Authorized Users or anyone using the Services on the Customer's behalf, or misuse of the Customer's access credentials, and Zeus's liability is excluded for incidents arising from Customer actions, third-party conduct outside Zeus's reasonable control, or force majeure, in each case to the maximum extent permitted by law. The Customer's own duty to notify Zeus of suspected incidents on its side is set out in the Terms.

---

13. Aggregated and De-Identified Data

Aggregated Data is not Personal Information.

Zeus may create, collect, use, disclose and share aggregated, anonymized and de-identified data derived from Customer Content, Personal Information and use of the Services — such as statistical or demographic data — for any purpose; the license and ownership terms for such data are set out in the Terms. Aggregated Data may be derived from your Personal Information but, once aggregated or de-identified so that individuals cannot be re-identified, it is not Personal Information and this Policy does not apply to it. Survival, benchmarks and the savings pack.

Zeus may continue to use Aggregated Data that does not identify any individual during and after your use of the Services — including after account deletion, a deletion request or withdrawal of consent (Section 8.3). Zeus may use Aggregated Data to improve and develop the Services and new products, and to generate market-research statistics, industry insights, benchmarks, reports and recommendations across its customer base, and may surface those insights and recommendations to other users of the Services. Aggregated Data will never identify your business, your clients or any individual; one account's underlying data is never exposed to another account; Zeus maintains and uses such data in de-identified form and will not attempt to re-identify it, except where necessary to satisfy requirements under applicable law; disclosure to third parties is limited to non-identifiable form; and no sale of data is made (Section 5.6).

---

14. Age Requirement and Children

The Services are for adults (18+); no knowing collection from children. The Services are business tools offered for use by field-service and construction businesses; they are not directed to children.

By using the Services, you represent that you are at least 18 years of age (or the equivalent age of majority specified by law in your jurisdiction); if you are under 18 or the age of majority you must not use the Services. Zeus does not knowingly collect data from or market to children under 18 years of age, and if Zeus learns that an account is held by a person under that age it will close the account and delete the associated Account Data as described in Section 8. If your business enters Personal Information about a minor into the Services as Customer Content (for example inside a client record), your business is solely responsible for the lawfulness of that collection, as described in Section 10.1 and in the Acceptable Use Policy's regulated-data rules.

---

15. Changes to this Policy

Zeus may revise this Policy; posting makes it effective.

Zeus may revise this Policy from time to time; changes are effective immediately upon posting of the updated Policy with a new version date, and each revision is recorded under a new policy version (see Section 1.2). Unless stated otherwise, the then-current Policy applies to all Personal Information Zeus holds, including information collected before the change. Continued use of the Services after a revision takes effect constitutes acceptance of the revised Policy; you should review this page periodically to remain familiar with the current version, and for material changes Zeus may additionally notify you by prominently posting a notice or by sending you a direct notification. Where the mandatory law of your jurisdiction limits the application of a revised policy to previously collected Personal Information or requires fresh consent for a new purpose, the applicable Supplement controls to the extent of that mandatory requirement.

---

16. Contact, Accountability and Complaints

How to contact Zeus about privacy. Questions, concerns and requests about this Policy or Zeus's handling of Personal Information should be directed to:

Omni Data Tech Inc. Attn: Privacy Officer 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada Email: [email protected]

Your message should provide evidence of your identity and set out the details of your request (such as the Personal Information or the correction requested), as described in Sections 9.3 and 9.4.

Accountability and complaints. Zeus has designated its Privacy Officer (contact details in Section 16.1, above) as the individual accountable for Zeus's compliance with applicable privacy law. If you believe Zeus has not handled your Personal Information in accordance with this Policy or applicable law, contact Zeus first using the details in Section 16.1; Zeus will investigate complaints it receives. The regulator complaint routes, statutory escalation rights and jurisdiction-specific accountability disclosures for Canada, the United States, Australia and New Zealand are set out in the jurisdiction-specific Supplements.