SHOOT PRIVACY POLICY

Last Updated: January 7, 2026

This Privacy Policy explains how Shoot Software Corporation (Shoot Software, Inc.), a Georgia company ("Shoot," "we," "us," or "our") collects, uses, discloses, and otherwise processes information when you access or use our Services, including https://www.trustshoot.com and related applications.

This Privacy Policy also explains privacy rights and choices that may be available to you.

If you do not agree with this Privacy Policy, do not use the Services.

1. CONTACT US

Privacy email: privacy@trustshoot.com

Legal email: legal@trustshoot.com

Legal Mailing Address:

Shoot Software Corporation (Shoot Software, Inc.)

1799 Briarcliff Rd.

#133237

Atlanta, GA 30333

United States

2. HOW THIS POLICY WORKS WITH OUR TERMS AND DPA

Your use of the Services is governed by our Terms of Service. Where Shoot processes personal data on behalf of a Customer (for example, an employer using the Services for workforce monitoring), the Shoot Data Processing Addendum ("DPA") may apply between Shoot and that Customer.

If a separate HIPAA Business Associate Agreement ("BAA") is executed, it governs PHI to the extent applicable.

3. WHO IS WHO: CUSTOMER VS. END USER

The Services are typically used by organizations (each, a "Customer"). Individuals who use the Services under a Customer's account (including employees and contractors) are "End Users."

3.1 When Shoot acts as a processor/service provider

When a Customer configures the Services to collect or generate information about End Users (including monitoring outputs), the Customer typically determines the purposes and means of processing. In those cases:

Customer is the controller (or business), and
Shoot is the processor (or service provider), processing Customer Content on Customer's instructions.

If you are an End User, your privacy questions about what is enabled and how your employer uses data should generally be directed to your employer/Customer first.

3.2 When Shoot acts as a controller/business

Shoot acts as a controller/business for information we process for our own purposes, such as:

Website visitor analytics,
Marketing and sales communications,
Account administration and billing,
Security and fraud prevention.

4. INFORMATION WE COLLECT

We collect information in several ways: (a) you provide it, (b) we collect it automatically, and (c) we receive it from third parties (e.g., integrations) at your direction.

The specific data collected depends on your role (Customer admin vs. End User), the device or app used, and which features a Customer enables.

4.1 Information you provide

Account and profile information: name, email address, phone number, username, role/permissions, team/department identifiers.
Customer administration: organization name, admin contacts, user roster data uploaded by Customer.
Billing and subscription information: billing contact info, invoices, payment status, and subscription entitlements. Payment card data is typically processed by a payment processor and not stored by us in full.
Communications: support tickets, emails, chat messages with us, and other communications and attachments you submit.

4.2 Information we collect automatically (website/app/device)

Device and network data: IP address, device identifiers, operating system, browser type, app version, language/time zone, and related technical identifiers.
Usage and log data: pages/screens viewed, features used, timestamps, referring URLs, error logs, diagnostic logs, and performance data.
Cookies and similar technologies: see Section 8.

4.3 Monitoring, productivity, and security telemetry (as configured by Customer)

Depending on features enabled by Customer, the Services may collect or generate:

Time tracking and attendance: time entries, start/stop times, duration, breaks, shifts, approvals, and related metadata.
Activity signals: indicators derived from device input activity (e.g., mouse/keyboard activity levels and idle time detection). The Services are designed to measure activity signals and are not intended to capture the content of what is typed.
Application and system context: active application/window context, application usage, running process/application metadata, and related system events needed to provide monitoring and reporting features.
Website/URL activity: visited domains/URLs and related timestamps (where enabled), and optional browser-related activity data depending on configuration and device/app capabilities.
Screenshots/screen capture: images of an End User's screen captured at intervals or events configured by Customer, with associated metadata (time, device, user, project/job context). Screenshots may incidentally capture sensitive information displayed on-screen.
Location and job site data: GPS coordinates, routes, job site visits, geofence events, and related timestamps where enabled (e.g., mobile features).
Unusual activity/security insights: signals, rules, alerts, and analytics intended to help Customers understand unusual patterns or potential risks (as configured).

CUSTOMER RESPONSIBILITY: Customers are responsible for providing any required workplace notices and obtaining any required consents or authorizations for monitoring, consistent with applicable law.

4.4 Information from integrations and third parties

If a Customer connects third-party services (such as SSO, HR/payroll, ticketing, messaging, or project systems), we may receive information from those systems as authorized by Customer and the integration settings.

5. HOW WE USE INFORMATION

We use information for purposes such as:

Providing and operating the Services, including authentication, account management, and feature delivery.
Processing Customer Content on Customer's instructions (including workforce monitoring outputs where enabled).
Customer support, troubleshooting, and responding to inquiries.
Billing, invoicing, subscription management, and contract administration.
Security, fraud prevention, abuse detection, and protecting rights and safety.
Improving and developing the Services, including analytics and performance monitoring.
Communicating about the Services, including service notices, updates, and (where permitted) marketing messages.

6. HOW WE DISCLOSE INFORMATION

We may disclose information as follows:

6.1 To Customers and their admins

If you are an End User, Customer admins and other authorized roles may access Customer Content, including monitoring outputs, depending on Customer's configuration and permissions.

6.2 To service providers (subprocessors)

We use service providers for hosting, infrastructure, analytics, customer support tooling, communications delivery, and payment processing. They may process information only to provide services to us under contractual safeguards.

6.3 At your direction (integrations)

We may disclose information when Customer enables integrations or requests we share data with a third party.

6.4 For legal and safety reasons

We may disclose information to comply with law, respond to lawful requests, enforce our agreements, protect rights and safety, and investigate fraud or security incidents.

6.5 Business transfers

Information may be transferred in connection with a merger, acquisition, reorganization, or sale of assets, subject to applicable law.

6.6 Aggregated or de-identified information

We may disclose aggregated or de-identified information that does not reasonably identify you.

7. DATA RETENTION (PLAN-BASED)

We retain information as long as necessary to provide the Services and for the purposes described in this Policy, unless a longer period is required or permitted by law.

Because the Services involve monitoring and historical reporting, retention depends on the Customer's subscription plan, configuration, and any retention add-on(s). Customers should export or retrieve data they wish to keep before retention limits expire.

7.1 Retention schedule (typical plan-based structure)

Unless otherwise agreed in writing, Customer data is retained according to a plan-based schedule similar to the following (retention periods are "full historical periods," not necessarily a rolling day-by-day window):

A) Detailed activity and screenshots (where enabled)

Free: 2 weeks
Starter: 1 month
Grow: 3 months
Team: 6 months
Enterprise: 6 months
Retention add-on: 6 months

B) App and URL activity metadata

All standard plans: 1 month
Retention add-on: 1 year

C) Location and job site visits (if enabled)

All standard plans: 1 month
(May be configurable by Customer where supported)

D) Core operational records (commonly needed for payroll/accounting/audit)

Examples: daily activity summaries, notes, time logs, invoices, approvals, time off, attendance shifts, expenses, work breaks, past payments, budget history, achievements

All standard plans: 3 years
Retention add-on: 6 years

7.2 Backups and legal holds

We may retain limited copies in backups for a reasonable period, and may retain data longer if required by law, legal process, or legal hold.

8. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies (pixels, SDKs, local storage) to:

Provide core site functionality,
Remember preferences,
Understand usage and improve performance,
Measure marketing effectiveness where enabled.

Your choices:

You can control cookies through browser settings.
Where required by law, we provide choices for non-essential cookies.

Do Not Track: Some browsers offer "Do Not Track" signals. There is no uniform standard; we respond to such signals as required by applicable law.

9. SECURITY

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No system is completely secure. You are responsible for protecting credentials and using the Services securely.

10. INTERNATIONAL TRANSFERS

We are based in the United States and may process and store information in the U.S. and other locations where we or our service providers operate. Where required, we use appropriate safeguards for cross-border transfers (for example, Standard Contractual Clauses, where applicable).

11. YOUR PRIVACY RIGHTS AND CHOICES

Rights vary by location and context.

11.1 End Users under a Customer account

If you use the Services through an employer/Customer, that Customer controls most Customer Content. Many requests (access, deletion, correction) must be handled by the Customer. We will assist Customers as required by law and contract.

11.2 Requests to Shoot

Where Shoot acts as a controller (e.g., marketing or account admin data), you may request access, correction, deletion, or other rights by emailing privacy@trustshoot.com. We may need to verify your identity and authority.

12. U.S. STATE PRIVACY DISCLOSURES (INCLUDING CALIFORNIA)

If applicable law provides rights (such as the right to know/access, delete, correct, or opt out of certain disclosures), you may exercise them by emailing privacy@trustshoot.com.

We do not sell personal information in the ordinary sense. If we use cookies or similar technologies for analytics/marketing, some jurisdictions may treat certain disclosures as "sharing" for targeted advertising. You may request to opt out by contacting privacy@trustshoot.com, and where available, by using cookie controls.

13. CHILDREN

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from children under 13 (or under the minimum age required by applicable law).

14. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will update the "Last Updated" date at the top. If changes are material, we will provide additional notice where required by law.

15. CONTACT

Privacy: privacy@trustshoot.com

Legal: legal@trustshoot.com

Mail: