一、我们是谁
本隐私政策说明 {{公司法定名称}}（以下简称"我们"或"WorkOpsPilot"）在你使用 WorkOpsPilot 应用（"本服务"）时如何收集、使用和保护个人数据。除非另有说明，我们是下述个人数据的数据控制者。
注册地址：{{公司注册地址}}
注册号：{{公司注册号/KVK号}}
隐私相关问题联系邮箱：info@workopspilot.com
二、我们收集哪些个人数据
账号数据：姓名、邮箱地址、加密后的密码、角色（公司管理员或员工）、语言偏好。
公司管理员录入的用工数据：员工姓名、邮箱、排班、请假记录（系统不记录、不计算任何单个员工的时薪/工资；系统会保存公司管理员自行填写的默认时薪、税费/社保百分比、福利百分比三个数字，这三个数字仅用于给管理员可自愿选择是否打开的"人工成本计算器"预填默认值，不会被系统自动用于计算任何员工或公司的工资/利润数字）。
考勤数据：上下班打卡时间戳；仅在打卡瞬间采集你所在设备的GPS坐标，用于确认你是否在门店电子围栏范围内。
配送轨迹数据：负责配送的员工在配送进行中会被周期性记录GPS坐标和关键节点（取餐/出发/送达）时间戳。
库存与采购数据：你选择上传的供应商发票照片（用于AI自动识别录入）及识别出的结构化数据。
财务数据：录入平台的销售额、成本、预算数字。我们不存储你的银行卡信息——支付卡交易由 Stripe 直接处理。
客户数据（如果使用营销/常客模块）：你自己录入或导入的客户姓名、联系方式和消费记录。
技术数据：IP地址（用于限流与安全防护）、浏览器类型、基础使用日志。
可选集成：如果你连接了 Google Sheets，我们会在你拥有或与我们服务账号共享的表格之间同步库存数据；如果你使用AI功能，发票图片和你的业务问题可能会被发送给我们的AI服务商（Anthropic）以生成回复。
员工评分数据：系统会基于你的考勤记录（准时率、打卡是否异常），按你公司管理员在设置页配置的权重和星级门槛，计算出一个内部评分和星级，供公司管理员参考。
三、我们处理数据的依据
履行你注册使用本服务所对应的合同；保障服务安全、防止滥用、执行限流（正当利益）；发送服务相关邮件，例如试用到期或发票到期提醒（正当利益/合同履行）；遵守法律义务（如适用的税务/账务记录保存要求）。
员工评分/画像：我们会基于考勤记录自动计算上述评分和星级，处理依据是正当利益——帮助管理员更客观地了解出勤表现、辅助智能排班挑选替班人选。这一评分和星级仅供管理员参考，不会在没有人工判断的情况下自动做出解雇、降薪、不续约等对你有法律效力或类似重大影响的决定；如果你想了解自己评分的具体计算方式，或认为评分不准确，可以按下文"七、你的权利"联系我们或你的公司管理员。
下面单独说明两类GPS位置数据各自的处理依据——考虑到员工和雇主之间存在天然的地位差异，"同意"通常不足以单独作为员工位置数据处理的合法依据（因为员工很难真正自由地拒绝），所以这两类处理都以"正当利益"为依据，而不是以"同意"为依据：
① 打卡定位：仅在你点击打卡上/下班的那一瞬间采集一次GPS坐标，用于核实你当时是否在门店电子围栏范围内，处理依据是正当利益——雇主准确核算工时、防止考勤造假的必要手段（打卡工时也是管理员可自愿使用的"人工成本计算器"唯一依据的客观事实），采集范围严格限定在打卡的一瞬间，不做持续追踪；
② 配送定位：仅适用于负责外送配送的员工，从打卡上班到打卡下班期间会周期性记录位置（配送单进行中额外记录取餐/送达等关键节点），处理依据是正当利益——保障配送员的人身/财物安全、及时发现异常（长时间静止、偏离路线、超速）、处理顾客对配送时效的争议，是履行配送服务合同所必需。
无论哪种情形，我们都会在相关功能首次使用前，通过应用内的明确提示告知你具体的采集范围和用途；你也有权按下文"七、你的权利"一节所述提出异议或联系我们。
四、我们保存数据多久
打卡与配送的GPS定位坐标：由你公司管理员在设置页统一配置留存天数（最短1天、最长180天/约半年，默认30天），系统每天自动清理超过期限的坐标点，只删除具体经纬度，不影响打卡/配送记录本身（上下班时间、配送单状态等业务记录会按记账/纠纷处理所需的期限继续保留）。账号与业务记录：在公司账号有效期内保留，账号终止后仅在法律要求或纠纷处理所必需的期限内继续保留。你可以随时联系公司管理员或直接联系我们，查阅、更正或删除你的个人数据。
五、我们与谁共享数据
托管服务：我们的服务器由基础设施服务商（Railway）托管。
支付：订阅付款由 Stripe 处理，Stripe 就你的支付信息而言是独立的数据控制者，适用其自己的隐私政策。
AI功能：Anthropic（Claude）会处理你提交给AI功能（OCR识别、经营助手、AI日报）的发票图片和文字内容，仅用于生成你请求的结果。
在线客服：网站右下角的在线聊天窗口由第三方服务商 Tawk.to 提供；只有当你主动点开聊天窗口并发送消息时，你输入的姓名、邮箱（如果你填写）和聊天内容才会被发送给 Tawk.to 用于展示对话和让我们回复你，我们不会把打卡、配送、工资等经营数据发送给 Tawk.to。
地理编码：当你或你的公司填写门店地址时，我们使用 OpenStreetMap 的 Nominatim 服务查询坐标；只会发送地址文本，该服务不会在完成查询后继续保存这些数据。
Google Sheets（可选）：如果你启用了这个功能，我们的服务账号会向你拥有的、或由我们创建并分享给你的 Google 表格写入库存数据。
我们不会出售你的个人数据，也不会为第三方自己的营销目的分享你的数据。
六、跨境数据传输
需要明确说明：我们的应用服务器本身（托管服务商 Railway）位于欧洲经济区以外（美国），并非只有 Stripe、Anthropic 这类第三方服务商可能在境外处理数据——你的全部数据实际上都会经过位于美国的服务器。我们依赖标准合同条款（SCC）等 GDPR 认可的保障机制来为这类跨境传输提供合规基础，Railway 和 Anthropic 均已公开承诺以此类机制支持跨境数据处理。如果这一点对你至关重要（例如你的行业或客户对数据存储地有更严格的要求），请在订阅前联系我们确认最新情况。
七、你的权利
根据GDPR，你有权：查阅我们持有的关于你的个人数据；要求更正不准确的数据；要求删除（"被遗忘权"）；要求以可携带格式获取你的数据副本；反对某些处理活动；随时撤回同意（例如位置追踪），但这可能会限制你使用某些功能（比如打卡）。如需行使这些权利，请联系你的公司管理员或直接联系我们：info@workopspilot.com。你也有权向所在地的数据保护监管机构投诉。
八、未成年人
WorkOpsPilot 是面向成年人在雇佣场景下使用的商业工具，我们不会有意收集未成年人的数据。
九、安全措施
我们采用行业标准的安全措施（密码加密存储、限流、加密连接）保护你的数据，但没有任何系统能保证100%安全。
十、政策变更
我们可能会不时更新本隐私政策，重大变更会在应用内突出提示。联系方式：info@workopspilot.com
This page is currently available in English and Chinese only; professional translations into other languages are on the way.
1. Who we are
This Privacy Policy explains how {{Company legal name}} ("we", "us", "WorkOpsPilot") collects, uses, and protects personal data when you use the WorkOpsPilot application ("Service"). We are the data controller for the personal data described below, unless stated otherwise.
Registered address: {{Company registered address}}
Registration number: {{Company registration / KVK number}}
Contact for privacy questions: info@workopspilot.com
2. What personal data we collect
Account data: name, email address, hashed password, role, preferred language. Employment data entered by a company admin: employee names, emails, work schedules, leave requests (the Service does not record or calculate any individual employee's wage or hourly rate; the Service does store three default figures the admin optionally enters — an hourly wage, a tax/social-contribution percentage, and a benefits percentage — but these are used only to pre-fill the optional "Labor Cost Calculator" that the admin may choose to open, and are never automatically used by the Service to calculate any employee's or the company's wage/profit figures). Attendance data: clock-in/out timestamps, and — only while clocking in or out — your device's GPS coordinates. Delivery tracking data: periodic GPS coordinates and checkpoint timestamps during an active delivery. Inventory & purchasing data: invoice photos you upload for OCR, and the resulting structured data. Financial data: sales, cost, and budget figures — we never store your card details; Stripe processes payments directly. Customer data (if you use the marketing/loyalty module). Technical data: IP address, browser type, basic usage logs. Optional integrations: Google Sheets sync and Anthropic (Claude) AI features process the data you submit to them. Employee scoring data: based on your attendance records (on-time rate, clock-in irregularities), the system computes an internal performance score and star rating, using weights and thresholds your company admin sets, for the admin's reference.
3. Why we process your data
To provide the Service (contract performance); to secure the Service and prevent abuse (legitimate interest); to send service-related emails (legitimate interest/contract); to comply with legal obligations.
Employee scoring / profiling: we automatically compute the score and star rating above from attendance records, on the basis of legitimate interest — helping the admin assess attendance more objectively and assisting smart scheduling in ranking substitute candidates. This score is for the admin's reference only and never, by itself and without human judgment, triggers dismissal, a pay cut, non-renewal, or any other decision with legal or similarly significant effects on you. If you'd like to understand how your score is calculated or believe it's inaccurate, contact us or your company admin as described in Section 7 below.
The two categories of employee GPS data are each processed on their own basis, explained separately below — because of the inherent power imbalance between an employer and employee, "consent" is generally not a valid standalone legal basis for employee location tracking (an employee cannot realistically refuse), so both of the following rely on legitimate interest rather than consent:
(i) Clock-in/out location: a single GPS reading captured only at the moment you tap clock-in or clock-out, used to verify you were within the workplace geofence. Legal basis: legitimate interest — necessary for the employer to accurately calculate hours worked and to prevent falsified attendance (clocked hours are also the sole objective fact that the optional, admin-only Labor Cost Calculator relies on). Collection is strictly limited to that single moment; there is no continuous tracking.
(ii) Delivery location: applies only to employees performing delivery duties. Periodic GPS readings are recorded from clock-in to clock-out (with additional checkpoints — pickup/drop-off — while a delivery is active). Legal basis: legitimate interest — necessary to protect the courier's personal safety, detect anomalies (prolonged inactivity, route deviation, speeding), and resolve customer disputes about delivery timing, all in performance of the delivery service.
In both cases we display an explicit in-app notice before the relevant feature is first used, describing the scope and purpose of collection, and you may object or contact us as described in Section 7 below.
4. How long we keep your data
Clock-in and delivery GPS coordinates: your company admin sets a single retention period in the settings page (1–180 days, default 30), and the system automatically deletes coordinates past that period every day. Only the precise coordinates are deleted — the underlying attendance/delivery records (times, statuses) are kept for as long as needed for bookkeeping and dispute resolution. Account and business records are kept while your company's account is active, and afterward only as long as legally necessary.
5. Who we share data with
Hosting (Railway), payments (Stripe, an independent controller for your payment data), AI features (Anthropic), live chat support (Tawk.to — the chat widget in the bottom-right corner of our site; your name, email if you provide one, and chat messages are only sent to Tawk.to if you open the widget and start a conversation; we do not send your attendance, delivery, or wage data to Tawk.to), geocoding (OpenStreetMap Nominatim — address text only, not retained), and optionally Google Sheets. We do not sell your personal data.
6. International transfers
To be explicit: our application servers themselves (hosted with Railway) are located outside the EEA (in the United States) — this isn't limited to third-party providers like Stripe or Anthropic; all of your data passes through US-based servers. We rely on Standard Contractual Clauses (SCCs) and other GDPR-recognized safeguards for these transfers; both Railway and Anthropic publicly commit to supporting cross-border processing on this basis. If data residency is critical for your business, please contact us before subscribing to confirm the current setup.
7. Your rights
Under the GDPR you may access, correct, erase, or port your data, object to processing, and withdraw consent at any time. Contact info@workopspilot.com, or lodge a complaint with your local supervisory authority.
8. Children
WorkOpsPilot is a business tool for adults in an employment context; we do not knowingly collect data from children.
9. Security
We use industry-standard measures (password hashing, rate limiting, encrypted connections), though no system can be guaranteed 100% secure.
10. Changes
We may update this policy from time to time; material changes will be highlighted in the app. Contact: info@workopspilot.com