Privacy Policy

This policy explains what personal information Dandy Staffing LLC ("we", "us") collects through DandyTimesheets (the website at www.dandytimesheets.com and its mobile app), why, who can see it, how long we keep it and the choices you have. DandyTimesheets is used by our employees, supervisors and administrators to record, approve and pay working hours.

1. Information we collect

Account and employment details

• Name, email address, phone number and employee ID.
• Social Security number, used only for payroll. It is stored encrypted and is shown only to administrators, partly masked.
• Hourly rate, role (employee, supervisor or administrator), the companies and departments you work for, and your account status.
• A copy of your driver license and a profile photo, if one was uploaded.
• Your password, stored only as a one-way scrambled ("hashed") value that nobody can read.

Work records

• Each shift: date, start and end times, hours, the house and company, remarks, and who entered, approved or declined it and when.
• Issues you raise about the system or your hours, and the responses.
• Notifications sent to you and whether you have read them.

Security and usage information

• Sign-in history: when you signed in and out, your IP address and your browser or device type.
• An activity log of important actions (for example approving hours or changing an account), with the IP address and browser type.
• One-time sign-in codes, kept only in a scrambled form for 10 minutes.

2. How we use it

• To record, review and approve working hours, run payroll, and bill the care companies you work for.
• To manage accounts, send sign-in codes, password resets, pay period reminders and other notices about your work.
• To keep the system secure: preventing unauthorized access, spam sign-ups and abuse, and investigating problems.
• To meet legal, tax and record-keeping obligations.

We do not sell your personal information and we do not use it for advertising.

3. Who can see it

• You can see your own hours, issues and notifications.
• Supervisors can see and approve the hours of employees at the companies they are assigned to.
• Administrators of Dandy Staffing LLC can see all records needed to run payroll and the system.
• Care companies we bill receive billing reports with your name, approved hours and billed amounts.
• Authorities, when the law requires it (for example tax or employment authorities).

4. Service providers

We use trusted providers to run the system. They process information only on our behalf:

• Amazon Web Services (United States) hosts the system, its database and backups, and sends our emails (Amazon SES).
• OpenAI powers the optional AI assistant used by administrators and supervisors. When they ask it a question, the work information needed to answer (for example names and hours) is sent to OpenAI. Social Security numbers, passwords and driver license images are never sent.
• Google reCAPTCHA, when it is switched on, checks that sign-in and sign-up forms are used by people and not bots. Google's Privacy Policy and Terms apply to it.
• Have I Been Pwned: when you choose a new password we check, without sending the password itself, that it does not appear in known data leaks.
• Bunny Fonts provides the website's typeface.

5. Cookies

We use only the cookies needed for the website to work: a session cookie that keeps you signed in and a security cookie that protects forms against forgery. They expire after about two hours of inactivity. We do not use advertising or tracking cookies. The mobile app keeps a sign-in token on your device, which expires after 60 days or when you sign out.

6. How long we keep it

• Employment, timesheet and payroll records: for as long as you work with us and then 7 years, or longer if the law requires.
• Daily backups: 14 days, then deleted automatically.
• Report files created by the AI assistant: 30 days.
• Sign-up requests that are not approved are deleted.

7. How we protect it

• All connections are encrypted (HTTPS), and Social Security numbers are encrypted in the database.
• Every sign-in needs your password and a code sent to your email; repeated wrong attempts are blocked.
• Access is limited by role, and important actions are recorded in an activity log.
• Driver licenses and backups are stored privately and can only be downloaded by authorized staff.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify you as required by law.

8. Your choices and rights

You can see and update your name, email and password on your Profile page. You can ask us to see a copy of the information we hold about you, correct it, or delete it when we no longer need to keep it by law. Depending on where you live (including under Maryland law), you may have further rights. To make a request, sign in and use Issues → Report an Issue, or ask your supervisor or an administrator. We will respond within a reasonable time and may need to confirm your identity.

9. Children

DandyTimesheets is for our workforce and is not intended for children under 16.

10. Changes to this policy

We may update this policy as the system or the law changes. The date at the top shows the latest version, and we will tell users about important changes in the app.

11. Contact

For questions about this policy, sign in and use Issues → Report an Issue, or ask your supervisor or an administrator.