Privacy Policy

Last updated: October 16, 2026 · Version 1.4

This Privacy Policy explains how AECO, a crew scheduling, time clock, and job-tracking service operated by Albrik Electric Co. (“AECO,” “we,” “us”), handles personal information. It covers the AECO website at aecoteam.com, the AECO web and mobile apps, and related services (together, the “Service”).

1. Information we collect

We collect only what the Service needs to run. The categories below use the labels from the California Consumer Privacy Act, as amended by the CPRA (“CCPA”).

We collect this information when an owner signs up, when a crew member uses the app, and automatically as the app runs (for example, a device type from your browser). We do not buy personal information about you from data brokers.

2. Precise geolocation (sensitive personal information)

Precise geolocation is treated as sensitive personal information under the CPRA. Because of that, we handle it with extra care:

• It is opt-in for each worker. The mobile app tracks location in the background only after the worker turns on “auto clock-in” on a screen that explains exactly what is tracked. The worker can turn it off at any time. Each on/off is recorded on our servers with the version of the notice shown at the time.
• It is collected only while clocked in. Positions are saved only during a shift, for automatic clock-in, to check whether the worker is inside the job-site geofence, and to show the live crew map to owners and foremen.
• We use it only for those purposes. We do not use or disclose precise geolocation to infer characteristics about you, and we do not use it for advertising. This matches the CPRA’s limit on using sensitive personal information.

An owner can erase a worker’s location history at any time (see Your privacy rights). GPS points are also cleared automatically after a retention period (see Section 7).

3. How we use information

• Provide and operate the Service — scheduling, time clock, job tracking, timesheets, and payroll support.
• Authenticate users, keep accounts secure, enforce company-to-company data isolation, and detect and prevent abuse.
• Support payroll and wage-and-hour features, such as overtime and meal-period flags (these are tools, not legal or payroll advice).
• Process subscriptions and billing, and meet legal obligations such as auto-renewal disclosures and record-keeping.
• Respond to support requests and send service-related messages about your account.

4. Cookies & similar technology

AECO uses one strictly necessary cookie — the session cookie that keeps you signed in. It is marked Secure and HttpOnly with SameSite=Lax, and it carries only a random token (we store only a hashed form of it). We set no advertising cookies, no analytics cookies, and no third-party tracking cookies. The app also uses your device’s local storage to make offline time-punches work; that data stays on your device and is not a cookie. Full details, and how to control cookies, are in our Cookie Policy.

Do Not Track and Global Privacy Control. We do not track you over time or across other websites, and no third party collects personally identifiable information about your online activities across different websites through the Service. There is no tracking to switch off, so we treat a browser’s “Do Not Track” or Global Privacy Control signal as already honored.

5. How we share information

We do not sell your personal information. We share it only as needed to run the Service:

• Service providers who process data on our behalf under contract:
  • Stripe — subscription billing and card processing.
  • Anthropic — reading receipt photos, only if a company turns on AI receipt reading.
  • Google / Microsoft — only if a company connects Google Drive or OneDrive.
  • Gusto — only if connected; hours are sent for payroll.
  • Intuit QuickBooks — only if connected; hours, job names, receipt totals, and store names are sent to the books.
  • OpenStreetMap — map tiles for the live map (the provider sees the viewer’s IP address); and Nominatim/OpenStreetMap — turning typed addresses into coordinates.
  • Our hosting and infrastructure provider, which stores the data for us.
• Between companies: never. Each Employer-Customer’s data is isolated from every other’s.
• Legal and safety: when required by law, to respond to lawful requests, or to protect rights, safety, and the integrity of the Service.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy.

6. Sale & sharing (we do neither)

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. Because we do not, there is nothing to opt out of for sale or sharing, and we honor browser Global Privacy Control signals as consistent with that position.

7. How long we keep it

• Account and company data — kept while the account is active and until the company deletes it or closes the company.
• Hours and payroll records — kept as long as required by law (California requires employers to keep payroll records at least three years). After a worker is erased, their hours remain but carry no name, only “Former employee #ID.”
• Precise geolocation — GPS points are cleared automatically after a configurable retention window (default three years, the period California requires payroll records to be kept); the in/out-of-geofence result and the hours themselves are kept.
• Login sessions — expire after 30 days of inactivity.
• Failed-login IP addresses — kept about 24 hours for rate-limiting.

8. Your privacy rights

Depending on where you live, you may have the right to know what personal information we hold, to get a copy of it, to correct it, to delete it, and to not be discriminated against for exercising these rights. California residents also have the right to limit the use of sensitive personal information; as explained in Section 2, we already limit precise geolocation to providing the Service.

If you are a worker on a company’s account

Your employer controls your information, so send requests to your employer. Within AECO:

• Get a copy of your data — Account → Download My Data downloads everything we hold about you, including your GPS history.
• Delete your data — Account → Delete my account erases your name, contact details, home address, notes, login, and every GPS point, and signs you out. An owner can do the same from your employee profile. Your hours stay as a nameless record because payroll records must be kept by law.

If you are an account owner

You can download all of your company’s data (Account → Download all company data), erase individual workers, and close the company, which cancels billing and deletes all of its data and files.

Making a request directly to us

You or your authorized agent can also contact us using Section 12. We will verify your request against the information we hold before acting on it. If we act as a service provider for your employer, we will direct your request to them or act on their instructions.

Other states

Residents of states with their own privacy laws (for example Virginia, Colorado, Connecticut, Utah, and others) have similar rights to access, correct, delete, and obtain a copy of their information, and to appeal a decision. Contact us as described below and tell us your state of residence.

9. How we protect information

We use layered safeguards, including company-to-company isolation enforced at the database level, encryption of integration tokens and customers’ own AI keys at rest, CSRF protection and a content security policy, login rate-limiting, an audit log of sensitive actions, a firewall, automatic security updates, SSH-key-only server access, and tested nightly backups. No method of transmission or storage is perfectly secure, but we work to protect your information and will notify affected users and authorities of a breach as required by law.

10. Children

AECO is a business tool and is not directed to children. Account owners confirm they are 18 or older. Workers are added by their employer. We do not knowingly collect personal information from children under 13.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above and, for material changes, provide a more prominent notice. Continued use of the Service after an update means you accept the revised policy.