Privacy Policy

LotHours (“we”, “us”) provides a workforce management platform for car dealerships. This policy explains what data we collect, how we use it, and the rights you have over it. For details specific to text messaging, see our SMS & Messaging Policy.

What we collect

• Account info — name, email, phone, role, employer. Provided by you or your employer.
• Location — geofence entry/exit and clock events captured by the mobile apps. Used to determine when an employee is on premise. We store latitude, longitude, accuracy, and battery state at the moment of each clock event.
• Messages — internal team messages and employee-initiated SMS exchanges with site managers, stored to enable conversation history.
• SMS data — for employees who opt in, your mobile number, the content of workforce text messages, opt-in/opt-out (STOP/START) status, and message delivery metadata. Used only to operate the transactional SMS program described below.
• Email — your email address and the transactional emails we send you (invites, authentication, account notices), used to operate the account and deliver those notices.
• Device info — push tokens, app version, OS version, used for notifications and product analytics.
• Usage events — anonymized product analytics (page views, signup funnel) via PostHog.

How we use it

• Operating the timecard, team-messaging, and employee-SMS features you sign up for.
• Sending product communications: invites, account notices, occasional product updates.
• Diagnostic and security monitoring: error logs, audit trail of admin actions.
• Aggregate analytics to improve the product. We do not sell personal data.

Messaging: SMS and email

SMS is transactional and per-employee opt-in.LotHours sends text messages only to employees who have individually opted in — clock reminders, shift and cover alerts, and attendance coordination (sick / late / break / back-from-break). We do not use SMS for marketing. An employer cannot opt an employee in without that employee’s own consent. You can opt out of SMS at any time by replying STOP to any message, and opt back in by replying START. Full details are in our SMS & Messaging Policy.

Email is transactional. We send account email such as invites, authentication, and account notices. Where we send any non-transactional email, it includes an unsubscribe link, and unsubscribing stops those messages. Critical transactional and security emails tied to your account may still be sent.

We do not sell your data, and we do not share your mobile number, message content, or contact details with third parties for their own marketing. Mobile opt-in consent and phone numbers are never shared with third parties for marketing purposes.

Who can see your data

• Your employer’s authorized administrators and managers (within department scope) see your time-tracking and messaging data tied to your role.
• Our small team can access data for support and security.
• Subprocessors: Supabase (hosting + database), Stripe (billing), Twilio (SMS), Resend (email), Vercel (hosting), Sentry (error tracking), PostHog (analytics).

Data retention

Time events and audit logs are retained for the active period of your employer’s account plus 7 years to support payroll dispute resolution. Employee SMS retained for 2 years unless your employer configures a shorter window. Account info retained for as long as your account is active.

Your rights

You can request access, correction, or deletion of your data by emailing privacy@lothours.com. Some data — like time events that the employer relies on for payroll compliance — may be retained even after deletion of identifying fields.

Children

The product is not directed at anyone under 16.

Changes

We’ll post any updates to this page and notify the org owner of material changes 30 days before they take effect.

Contact

LotHours — privacy@lothours.com. Mailing address: contact us for the current address.

Note: This policy is provided as a starting point. Have your legal counsel review it before launch — we are not lawyers.