United States Privacy Supplement

---

1. Application, Scope and Framing

1.1 Application of this Supplement; statutory floors only

This United States Privacy Supplement (this "Supplement") forms part of the Zeus Privacy Policy and applies to Personal Information of individuals located in, or residents of, the United States, in addition to — and not in place of — the Privacy Policy. Depending on the state in which you reside, you may be able to exercise additional rights granted by applicable law in relation to the Personal Information about you that Zeus has collected, subject to the limitations and exceptions described in this Supplement and permitted by law. This Supplement restates United States statutory rights and obligations solely as the statutory floors that applicable law actually imposes on Zeus in the capacity in which Zeus is acting; it grants no right, remedy, or obligation beyond what applicable law requires, and where a statement in this Supplement exceeds what applicable law requires of Zeus, the statement is limited to the statutory minimum. This Supplement, like the Privacy Policy, is not part of the Agreement and creates no contractual rights; privacy-related claims remain subject to the limitations, exclusions, and dispute-resolution terms stated in the Terms.

1.2 Processing basis; acknowledgment through use

For United States users, and except to the extent this Supplement or applicable law states otherwise, Zeus does not rely on consent as the operative basis for processing Personal Information; Zeus processes Personal Information for its legitimate business purposes as described in the Privacy Policy, and processing described in the Privacy Policy is not conditioned on a separately revocable consent except where applicable law requires opt-in consent. By accessing or using the Services, or otherwise providing Personal Information to Zeus, you acknowledge the collection, use, disclosure, retention, and storage practices described in the Privacy Policy and this Supplement. Providing Personal Information is voluntary, but refusing to provide it may prevent use of some or all of the Services; if you disagree with the practices described in the Privacy Policy or this Supplement, your remedy is to discontinue use of the Services.

1.3 Roles: business versus service provider; request routing

Zeus operates in two distinct roles under United States privacy laws. For Account Data — registration, billing, device-telemetry, diagnostics, and site data — Zeus acts as the "business" (controller) and this Supplement's rights procedures apply directly. For End-Customer Data and Worker Data that a Customer or its Authorized Users cause Zeus to process, Zeus acts solely as a "service provider" or "processor" on the Customer's instructions; that data is controlled by the Customer, this Supplement does not govern the Customer's own privacy practices, and individuals should direct questions and requests about that data to the relevant Customer (see Section 3.3).

---

2. Notice at Collection (California) and Contact Points

2.1 California notice-at-collection mapping; no sale, no sharing

For California residents, the Privacy Policy's sections describing (a) the categories of Personal Information Zeus collects, (b) the sources of that information, (c) the business purposes for collection, use, and disclosure, (d) the categories of recipients, and (e) retention practices together serve as Zeus's notice at collection, and this Section maps those disclosures to the California statutory categories.

Zeus does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising; Zeus discloses Personal Information only as described in the Privacy Policy, including to Subprocessors acting for Zeus, in legal-process and protective disclosures, and in business transfers.

Because Zeus does not sell or share Personal Information, no "Do Not Sell or Share My Personal Information" action is required; if Zeus's practices ever change, Zeus will update this Supplement and provide the legally required opt-out mechanisms before engaging in any sale or sharing.

2.2 How to submit requests; contact points

United States privacy-rights requests may be submitted through either of the following methods: (a) the in-product self-service tools described in Section 3 (data export and account deletion inside the application), which are the designated primary channels; or (b) by email to [email protected]. Written correspondence may be sent to Omni Data Tech Inc., 3601 Highway 7 East, Suite 1006, Markham, Ontario, L3R 0M3, Canada. Where a request can be fulfilled through the in-product self-service tools, Zeus may direct you to those tools instead of processing the request manually.

---

3. United States Privacy Rights and Request Procedures

3.1 Your rights under United States privacy laws

Where and to the extent an applicable United States privacy law grants them, and subject to verification and the exceptions in this Supplement, residents of covered states may exercise the following rights with respect to Personal Information for which Zeus acts as the business:

The right to know and access — no more than twice in any 12-month period for California right-to-know requests — the categories of Personal Information Zeus has collected, the categories of sources, the business purposes for collecting the information, the categories of third parties to whom it was disclosed, and the specific pieces of Personal Information collected.

The right to receive a copy of that information in a portable and, to the extent technically feasible, readily usable standardized format.

The right to request deletion of Personal Information Zeus collected from you, subject to the exceptions in Section 3.7; the right to request correction of inaccurate Personal Information; the right to opt out of sale, sharing, or targeted advertising (Zeus engages in none — Section 2.1); and the right to limit the use and disclosure of sensitive Personal Information as described in Section 4.1.

These rights are not absolute, and in certain cases Zeus may decline a request as permitted or required by law.

3.2 Who holds these rights; California B2B and workforce coverage

Outside California, the state privacy rights described in this Supplement generally apply to individuals acting in a personal or household context and do not extend to individuals acting in an employment or business-to-business context.

For California residents, these rights also apply to business contacts and to individuals acting in an employment context — including Account Owners, Members, Helpers, and business representatives of Customers and prospects — because California's business-to-business and employee exemptions have expired.

Only you, or an authorized agent you have validly authorized under Section 3.4, may make a verifiable request related to your Personal Information.

3.3 Requests concerning End-Customer Data and Worker Data — routing

Zeus cannot honor privacy-rights requests submitted directly by Clients, workers, or other individuals whose Personal Information Zeus processes as a service provider for a Customer; those requests must be directed to the relevant Customer, and Zeus will provide reasonable assistance to that Customer in honoring verified requests as appropriate and required by applicable law.

Directing your request to the relevant Customer may expedite its completion, because the Customer controls that data and is best placed to act on it.

If you contact Zeus about data a Customer controls, Zeus may refer you to that Customer's Account Owner or administrators and take no further action on the direct request.

3.4 Identity verification and authorized agents

Zeus cannot respond to a request or provide Personal Information if it cannot verify your identity or your authority to make the request and confirm that the Personal Information relates to you; failure to verify is grounds for denial.

To verify a request, Zeus may require you to provide up to three pieces of Personal Information to compare against its records, may ask you to provide copies of relevant identity documents, and may apply anti-fraud checks.

Depending on the nature and sensitivity of the request, Zeus may require additional verification actions, including a signed declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request, where permitted by the CCPA.

An authorized agent must hold your signed written permission describing their authority, and you must verify your own identity directly with Zeus and confirm you granted that permission; failure to satisfy these conditions may result in denial of the agent's request.

If Zeus is unable to verify your identity, it may be unable to respond to your request.

Verification information is used only to verify the requester's identity or authority.

3.5 Response timing, request rationing and fees

Zeus endeavors to respond to a verifiable request within forty-five (45) days of receipt; if more time is required (up to 90 days in total where the statute allows), Zeus will inform you of the reason and the extension period in writing.

Zeus does not charge a fee to process or respond to a verifiable request unless it is excessive, repetitive, or manifestly unfounded, in which case Zeus may charge a reasonable fee or decline to act on the request as the statute permits.

Right-to-know requests are limited to the statutory maximum of twice in any 12-month period.

Opt-out and preference requests may take up to ten (10) business days to process, and communications already in progress may be received during that period.

3.6 Grounds for declining; multi-party data; redaction

Zeus may limit or deny a request where the law permits or requires it to do so, or where Zeus is unable to adequately verify the requester's identity.

In certain limited circumstances Zeus may be unable to make all relevant information available, such as where the information also pertains to another user or identifiable individual; in those cases Zeus may redact or withhold the portions relating to others and fulfill the remainder of the request.

Grounds on which Zeus may decline or limit a request, as permitted by applicable law, include: the request is manifestly unfounded, excessive, repetitive, frivolous, or vexatious; the request would impair the privacy or rights of another person; granting access would present a risk to the security of the Personal Information, your account, or the Services; the information is subject to a legal retention duty or the exceptions in Section 3.7; or the right asserted is not one applicable law grants against Zeus in the capacity in which Zeus holds the data. Where required by law, Zeus will state the basis for a denial.

3.7 Deletion mechanics and retention carve-outs

Account deletion is available in-product and is the designated deletion channel for account holders. Deletion is two-phase: submission of a deletion request promptly deactivates the account and revokes active sessions, and a subsequent purge removes the underlying records and stored objects.

Zeus does not commit to a fixed interval between deactivation and purge; purge is completed on Zeus's own schedule as soon as reasonably practicable.

Zeus may decline to fulfill a deletion request, in whole or in part, if Zeus or its service providers are required or permitted to retain the Personal Information for one or more recognized purposes, including: completing a transaction or performing a contract with you; detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity; debugging; exercising or ensuring another person's exercise of legal rights; complying with a legal obligation; or internal uses that are lawful and compatible with the context in which the information was provided.

Zeus's append-only audit and financial records are retained by design and survive account purge, and residual copies may persist in backups until those backups are rotated on Zeus's normal cycle.

3.8 Effect of withdrawal and opt-outs; transactional communications

If you withdraw consent to a processing activity (where consent was the basis) or exercise an opt-out, Zeus reserves the right to continue processing and using your Personal Information to the extent required or permitted by law.

Withdrawing consent or exercising deletion or opt-out rights may result in your inability to continue using some or all of the Services, and information required for legal or regulatory compliance or other permitted business purposes is exempt from withdrawal.

You may not opt out of administrative or transactional communications, such as those confirming your requests, providing security notices, or updating you about the Privacy Policy or this Supplement.

3.9 Non-discrimination; appeals; regulator route

Unless permitted by applicable law, Zeus will not discriminate against you for exercising a privacy right, including by denying Services, charging different prices, or providing a different level of quality; legitimately different tiers, plans, and feature sets of the Services are not discrimination.

If Zeus declines to act on your request and the law of your state grants an appeal right, you may appeal the decision through the contact methods in Section 2.2; Zeus will inform you in writing of any action taken or not taken on the appeal, including a written explanation of the reasons for the decision.

If your appeal is denied, you may submit a complaint to your state Attorney General or other supervisory authority where applicable law provides that route.

3.10 Other-state rights matrix

Residents of states other than California whose comprehensive privacy laws are in force may hold some or all of the following rights, in each case only as their state's law provides and subject to that law's exemptions (including its business-to-business and employment-context exemptions): access/confirmation, correction, deletion, portability, opt-out of targeted advertising, sale, and certain profiling, and (in some states) an appeal right as described in Section 3.9. Zeus honors these rights at the statutory floor of the requester's state.

---

3.11 Commercial email: CAN-SPAM and Zeus's higher standard

The CAN-SPAM Act sets the floor for commercial email sent to recipients in the United States. It permits a sender to email until the recipient opts out. Zeus does not work that way. Zeus sends commercial email only with the recipient's express consent, obtained by an affirmative act taken separately from any other request and recorded with its date and the version of the wording agreed to; Zeus does not treat silence, a pre-ticked box, or use of the Services as consent to marketing. This is a deliberate common standard Zeus applies across its markets, and it is more than CAN-SPAM requires; it is not a statement about what United States law requires.

Every commercial message Zeus sends carries accurate header and routing information, an accurate and non-deceptive subject line, identification of the message as an advertisement or solicitation where it is one, the valid physical postal address of Omni Data Tech Inc., and a clear and conspicuous explanation of how to opt out. The opt-out mechanism costs nothing, requires no sign-in, no account and no reason, and remains functional for at least sixty (60) days after the message is sent — twice the thirty (30) days CAN-SPAM requires. Zeus gives effect to an opt-out without delay and in any event within ten (10) business days of receiving it, and does not sell, lease, exchange or otherwise transfer an opted-out address.

Zeus does not use a third party to send commercial email on its behalf in a way that would avoid these commitments: where a service provider transmits the message, Zeus remains the sender of record and these commitments apply to that message in full. The transactional and relationship messages described in Section 3.8 — account, verification, security, billing, subscription, technical, legal and document-delivery messages — are not commercial email, continue regardless of any opt-out, and are never used to carry marketing content.

---

4. Sensitive Personal Information, Location Data and Worker Data

4.1 Precise geolocation as sensitive Personal Information; right to limit

Zeus collects Location Data only as point-in-time snapshots for the six purposes disclosed in the Privacy Policy: photo location-tag fallback, clock-in/out snapshots, optional GPS captured at signing, address geocoding, map-tile requests, and the location recorded against a receipt or expense where that capture switch is on.

When you clock in or clock out in the application, the application may capture your device's precise GPS coordinates at the moment of that event; no background or continuous location tracking exists in the Services.

Location features operate only with the device permissions you grant; permission is requested beforehand and may be revoked at any time in device settings, and revoking it stops the dependent features but may limit functionality.

Location Data is never used for advertising or marketing and is never sold or shared.

Login IP addresses are processed for security purposes, such as rate limiting and detecting potential unauthorized access to your account.

Under the CCPA, precise geolocation is "sensitive personal information," and California residents may request that Zeus limit its use and disclosure of sensitive Personal Information; because Zeus uses Location Data only to provide the Services as described above, a limit request does not change how the live features must operate, but Zeus will honor any statutory limitation that applies. Requests may be made through the methods in Section 2.2.

4.1A Photo-library EXIF scan

The Services can, with your photo-library permission, read the EXIF location and capture-date metadata of images in your device's photo library to match photos to job sites ("Find Nearby Photos"). The Privacy Policy describes this practice in more detail.

4.1B GPS-at-signing evidence records

When a signer chooses to allow it, the e-signature feature may capture the signer's GPS coordinates at the moment of signing as part of the append-only signing evidence record. The Privacy Policy and the e-signature terms describe this practice in more detail.

4.2 Worker Data and workforce visibility

Worker Data — time entries and their approval state, clock-in/out location snapshots, assignments and crew membership, recorded absences and the reason given for them, skill and certification records, and activity data about a Customer's personnel — is processed for, and controlled by, the Customer that operates the Workspace.

Worker time-tracking data, including its optional location component, is made available to the Account Owner and the Customer's administrators and authorized personnel.

Worker location data is used exclusively to provide the Services to your employer — the business that owns the Workspace — and is not sold, not used for advertising, and not shared beyond the employer and the Subprocessors described in the Privacy Policy.

If you use the Services as a Member, Helper, or other Invited User, your Personal Information and activity within the Workspace may be monitored, processed, and analyzed by the Account Owner and administrators, and no in-tenant content should be assumed to be private from the business that invited you.

The Customer, as employer, is solely responsible for compliance with the employment, workplace-monitoring, privacy, surveillance, and consent laws that apply to its use of these features, including providing all required notices to and obtaining all required consents and authorizations from its personnel before enabling them.

Worker privacy-rights requests, including deletion requests, route to the employer under Section 3.3.

---

5. Do Not Track, Opt-Out Preference Signals and CalOPPA

5.1 Do Not Track

Zeus takes no action in response to browser "Do Not Track" (DNT) signals and does not respond to other mechanisms that transmit a do-not-track preference, because no uniform industry or legal standard for recognizing or honoring DNT signals currently exists. This statement is made for the purposes of the California Online Privacy Protection Act.

5.2 Opt-out preference signals (Global Privacy Control)

Zeus honors legally recognized opt-out preference signals, such as the Global Privacy Control (GPC), only where and as applicable law requires, treating a valid signal as a request to opt out of any sale or sharing of Personal Information for the sending browser or device.

Because Zeus does not sell or share Personal Information, a GPC signal ordinarily requires no change to Zeus's processing; it is nonetheless recognized as a valid opt-out request where the law of your state so requires.

Recognition of an opt-out preference signal occurs only for the device and browser that communicates the signal, so you may need to set your preference on every device and browser you use, and preferences stored in cookies may be lost when cookies are cleared, requiring you to opt out again.

5.3 CalOPPA statement

For the purposes of the California Online Privacy Protection Act: the Privacy Policy (including this Supplement) identifies the categories of personally identifiable information Zeus collects through its online surfaces and the categories of third parties with whom it may be shared; the Privacy Policy carries its effective date; Section 9 of this Supplement describes how changes are notified; and Section 5.1 states Zeus's response to Do Not Track signals.

---

6. CCPA Service-Provider Commitments

6.1 Statutory-minimum service-provider statement

Where Zeus processes Personal Information as a "service provider" or "processor" for a Customer under the CCPA or another applicable United States state privacy law:

Zeus will not (a) sell or share that Personal Information, or (b) retain, use, or disclose that Personal Information for any purpose other than the specific business purposes of providing the Services under the Agreement and the DPA, except for uses permitted for service providers under the CCPA or the equivalent processor permissions of the applicable state law.

Zeus will not retain, use, or disclose such Personal Information outside the direct business relationship with the Customer, and will not combine it with Personal Information received from other sources, except as permitted by applicable law or authorized by the Customer.

---

7. Security Incident Notification (United States)

7.1 Breach-regime summary and savings

If required by law to do so, Zeus will notify affected individuals and/or the relevant authorities in the event of a Security Incident affecting Personal Information for which Zeus is the business, in the manner and within the time the applicable state breach-notification statute requires.

For Personal Information Zeus processes as a service provider, Zeus notifies the affected Customer as the data owner in accordance with the DPA, and regulator and individual notification decisions rest with that Customer.

No notification of, or response to, a Security Incident is an acknowledgment of any liability or fault, and Zeus's obligations do not apply to incidents caused by a Customer, its Authorized Users, or misuse of a Customer's access credentials.

Nothing in this Supplement or any Zeus document reduces a notification duty that a mandatory United States breach-notification statute imposes on Zeus directly.

---

8. United States Processing, Storage and State-Specific Disclosures

8.1 Processing and storage locations; no residency warranty

Your Personal Information may be stored and processed in the United States, in Canada, or in any other location where Zeus or its service providers maintain facilities, and by using the Services or submitting information you consent to that transfer, processing, and storage.

If you do not want your information stored and processed in these locations, you should not use the Services; continued use constitutes consent.

Zeus's current primary object-storage region is stated in the Privacy Policy as a factual practice only; Zeus gives no warranty of data residency, and content-delivery edge processing, backups, diagnostics, and support access may occur in other locations.

8.2 Nevada residents

Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect about the resident. Zeus does not sell covered information within the meaning of that chapter. Nevada residents may nonetheless submit an opt-out request for future sales through the methods in Section 2.2, and it will take effect if Zeus's practices ever change.

---

9. Changes to this Supplement

9.1 Amendment

Zeus reserves the right to change this Supplement, as part of the Privacy Policy, at any time. Changes take effect when the updated version is posted with a new version identifier and effective date, and your continued use of the Services after posting constitutes acknowledgment of — and, where consent is the operative basis, consent to — the then-current version. Where applicable law requires notice of material changes, Zeus will provide notice by email, in-app notification, or posting, as the Privacy Policy describes. The version applicable to you is recorded at acceptance and on each version bump.

---

10. Interpretation

This Section is organizational only. In this Supplement: capitalized terms have the meanings given in the Privacy Policy and the Zeus Terms of Service (including Zeus, Services, Customer, Account Owner, Authorized User, Member, Helper, Invited User, Link Recipient, Client, End-Customer Data, Worker Data, Account Data, Personal Information, Location Data, Privacy Policy, DPA, Subprocessor, Security Incident, and Workspace); "including" is non-exhaustive; headings are for convenience only; and if this Supplement conflicts with the Privacy Policy, this Supplement controls solely for United States data subjects and solely to the extent mandatory United States law requires. Questions about this Supplement may be sent to [email protected]. The current Zeus legal documents are published at https://fieldzeus.com/legal, and the Privacy Policy at https://fieldzeus.com/legal/privacy.