Privacy Policy

1. Information we collect

1.1 Account information

When an account is created on OnPost, we collect:

• Full name

• Email address

• Phone number

• Role designation (administrator, liquidator, regional manager, sign waver)

• Password (stored in encrypted/hashed form only — we never store or have access to your plain-text password)

1.2 Shift and verification data

OnPost is a workforce verification platform. When workers use the Service to check in and check out of shifts, we collect:

• GPS coordinates (latitude and longitude) at sign-in and sign-out

• Photographs taken at sign-in and sign-out

• Timestamps of sign-in and sign-out events

• Calculated distance between the worker's location and the assigned store location

• Duration of time on post

This data is the core function of the Service and is collected with the knowledge of the worker at the time of each sign-in and sign-out action.

1.3 SMS and communication data

We use Twilio, a third-party communications provider, to send SMS messages. When SMS is used, we process:

• Phone numbers (validated and formatted via Twilio's Lookup API)

• Message content related to shift assignments, reminders, sign-in/sign-out notifications, and approval requests

We do not use SMS data for marketing purposes. All SMS messages are operational and directly related to shift management.

1.4 Location and address data

We use Google Maps services to:

• Verify and geocode store addresses

• Display maps within the Service

• Calculate distances for verification purposes

Google's privacy policy applies to data processed by Google Maps: https://policies.google.com/privacy

1.5 Website analytics and cookies

We use Google Analytics 4 (GA4) to understand how visitors interact with getonpost.com. GA4 collects:

• Pages visited and time spent on each page

• Device type, browser type, and operating system

• Screen resolution and language settings

• Referring website or source

• General geographic location (city/region level, derived from IP address)

• IP address (anonymized by GA4 by default)

GA4 uses cookies and similar technologies to collect this data. Cookies are small text files stored on your device by your web browser.

Google Analytics opt-out: You can prevent Google Analytics from collecting your data by installing the Google Analytics Opt-Out Browser Add-On, available at: https://tools.google.com/dlpage/gaoptout

For more information on how Google uses data from sites that use its services, visit: https://policies.google.com/technologies/partner-sites

1.6 Cookies we use

Essential/session cookies: Used for authentication, session management, and security. Expire when you close your browser or after session timeout.

Analytics (GA4) cookies: Used for website usage statistics and performance. Duration up to 2 years (set by Google Analytics).

We do not use advertising cookies. We do not use cookies for behavioral targeting or ad retargeting.

2. How we use your information

We use collected information for the following purposes:

• Service delivery: Processing shift verifications, sending SMS notifications, managing user accounts, and generating reports for authorized administrators

• Service improvement: Analyzing website usage patterns through Google Analytics to improve site performance and user experience

• Communication: Sending operational SMS messages related to shift assignments and verifications

• Security: Protecting accounts, detecting unauthorized access, and maintaining the integrity of verification data

• Compliance: Meeting legal obligations and responding to lawful requests from authorities

We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising purposes.

3. How we share your information

We share information only in the following circumstances:

3.1 Within the Service

Shift verification data (GPS location, photos, timestamps) is visible to authorized users within the same organizational hierarchy — specifically, the administrators, liquidators, and regional managers associated with a given store or shift. This visibility is the intended function of the Service.

3.2 Third-party service providers

We use the following third-party services to operate OnPost:

• Amazon Web Services (AWS): Cloud hosting, image storage. Receives all service data (encrypted at rest and in transit).

• Twilio: SMS messaging, phone number validation. Receives phone numbers and message content.

• Google Maps / Google Geocoding: Address verification, map display. Receives store addresses and location coordinates.

• Google Analytics (GA4): Website analytics. Receives anonymized browsing data and cookies.

Each provider processes data in accordance with their own privacy policies and our data processing agreements with them.

3.3 Legal requirements

We may disclose information if required to do so by law, or if we believe in good faith that such action is necessary to:

• Comply with a legal obligation or valid legal process

• Protect and defend the rights or property of NSS

• Prevent fraud or address security issues

• Protect the personal safety of users of the Service or the public

4. Data storage and security

• All data is stored on servers hosted by Amazon Web Services (AWS) in the United States

• Passwords are hashed using industry-standard algorithms before storage

• Data is encrypted in transit (HTTPS/TLS) and at rest

• Access to production systems is restricted to authorized personnel

• Photos are stored in private AWS S3 buckets with access controls

No method of electronic storage or transmission is 100% secure. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security.

5. Data retention

We retain your information for as long as necessary to fulfill the purposes described in this Privacy Policy, including:

• Account data: Retained for as long as your account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce agreements

• Shift verification data: Retained for as long as necessary to provide the verification record to authorized parties and to meet contractual and legal obligations

• Analytics data: Google Analytics data retention is configured in accordance with Google's standard retention settings

If you wish to request deletion of your data, contact us at support@onpost.com. Deletion requests will be processed in accordance with applicable law. Note that certain data may need to be retained for legal or contractual reasons even after a deletion request.

6. Your rights and choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you

• Correction: Request that we correct inaccurate information

• Deletion: Request that we delete your personal information, subject to legal and contractual retention requirements

• Opt-out of analytics: Install the Google Analytics Opt-Out Browser Add-On (https://tools.google.com/dlpage/gaoptout)

To exercise any of these rights, contact us at support@onpost.com. We will respond to verified requests within 30 days.

California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA) provide you with additional rights, including:

• The right to know what personal information we collect, use, and disclose

• The right to request deletion of your personal information

• The right to opt out of the sale of your personal information — WE DO NOT SELL YOUR PERSONAL INFORMATION

• The right to non-discrimination for exercising your privacy rights

To make a request under California law, contact us at support@onpost.com.

7. Children's privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

8. Third-party links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policies of any third-party sites you visit.

9. Changes to this privacy policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes are posted constitutes acceptance of the updated Privacy Policy.

10. Contact us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

Email: support@onpost.com

Company: New Sign Solutions, Inc.

11. Google Analytics disclosure

This website uses Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to help analyze how visitors use this site. The information generated by the cookie about your use of this website is generally transmitted to and stored on a Google server in the United States.

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide other services related to website and internet usage to the website operator.

You can learn more about how Google uses data at: https://policies.google.com/technologies/partner-sites