Privacy Policy

StaffHub is a staff operations platform used by schools. Accounts on StaffHub are organization-managed: a school administrator provisions each staff member's account, not the individual themselves. This policy describes how information is collected and used when a school uses StaffHub, and applies to staff, administrators, and other authorized users acting on behalf of a school ("Organization").

Depending on how your school configures StaffHub, the following information may be collected:

• Account identity: your work email address and sign-in activity, used to authenticate you.
• Staff profile: name, job title, employee code, phone number, and role, set up by your school administrator or edited by you where your school allows it.
• Profile photo, if you or your school administrator uploads one.
• Operational assignments: your schedule, duties, cover assignments, tasks, and exam assignments, as configured by your school.
• Attendance and location information: when your school requires app-based check-in, tapping Check In or Check Out captures a single, precise GPS location at that moment, along with the distance calculated from your school's configured checkpoint. Location is never collected in the background or continuously — only at the moment you tap Check In or Check Out, and only if your school has enabled this requirement.
• HR records where your school uses StaffHub for documents, contracts, or leave requests — visibility of these records is restricted to staff with HR or document-management permissions at your school.
• Notifications and device information: a device token is registered with your device so StaffHub can deliver push notifications through Apple/Google's standard push infrastructure.
• Import data: if your school bulk-imports staff or schedule information from a spreadsheet, that data is processed to create or update the relevant records.
• Security and technical logs: a record of certain actions (who changed what, and when) is kept for accountability and troubleshooting.

If your school requires app-based attendance check-in, StaffHub requests your device's precise location only when you actively tap Check In or Check Out — never on app launch, never in the background, and never continuously while the app is open. The coordinates captured at that moment, along with the distance to your school's configured checkpoint, are stored so your check-in can be verified. There is currently no automatic deletion schedule for this information — it is retained as part of your school's attendance records, in the same way as other operational data described below, unless your school administrator removes it. Location data is visible only to you and to staff at your school with attendance management permissions — never to staff outside your school, and never to anyone outside your school regardless of role.

Information collected through StaffHub is used solely to operate the service for your school: authenticating you, showing you your own schedule and assignments, enabling your school's administrators to manage staffing and operations, verifying attendance where your school requires it, and delivering notifications relevant to your role. We do not use your information for advertising, and StaffHub does not include any advertising or cross-app tracking technology.

Access is scoped to your own school and governed by role-based permissions your school administrator configures. In general: you can see your own records; school administrators and staff with the relevant permission (for example, attendance management or HR/document access) can see records within the scope their role is granted. StaffHub is architected so that one school's data is never visible to another school.

StaffHub relies on infrastructure providers to operate the service. As of this policy's effective date, these are Supabase (database, authentication, and file storage) and, for mobile devices, push notification delivery infrastructure (Apple Push Notification service / Firebase Cloud Messaging). These providers process information only as necessary to deliver StaffHub's functionality — we do not use analytics or advertising SDKs of any kind. We do not sell your information to anyone.

Most operational records (schedules, attendance, tasks, HR documents) are retained for as long as your school's account remains active, reflecting the institutional and compliance reasons schools generally need to keep employment-related records. Some record types support administrator-driven correction or removal; others do not yet have a dedicated deletion mechanism. We do not claim automatic deletion of any category unless it is actually in place.

Because StaffHub accounts are organization-managed, most changes to your account — corrections to your profile, role changes, or account deactivation — are made by your school administrator, and this remains the fastest path for those requests. For StaffHub-level privacy requests (for example, asking what information StaffHub holds about you), contact privacy@staff-hub.app. The StaffHub mobile app also offers an in-app "Account & privacy" screen where you can submit an account removal request, a correction request, or a privacy request directly — each is reviewed by your school administrator rather than acted on automatically, since some institutional records may need to be retained. See our Support page for the current options.

We may update this policy as StaffHub's functionality changes. Material changes will be reflected by updating the "Last updated" date above.

Questions about this policy can be sent to privacy@staff-hub.app.

This document is a factual draft grounded in StaffHub's current implementation and is intended for legal review before formal publication; it does not yet name a legal entity, registered address, or governing jurisdiction, which remain to be finalized.