Batten
Contents

Contents

  1. 1. Two roles
  2. 2. What is collected
  3. 3. Why
  4. 4. Who sees it
  5. 5. How long
  6. 6. Your choices
  7. 7. California
  8. 8. Nevada and other states
  9. 9. Security
  10. 10. Children
  11. 11. Where data lives
  12. 12. Payments
  13. 13. Language
  14. 14. Changes
  15. 15. Contact

Privacy Policy

Metron Adaptive Society — Batten and WorkShieldAI · Version 3 · Effective September 18, 2026

This policy explains what the Service collects, why, who sees it, how long it is kept, and what you can do about it. Plain words on purpose. It covers the Batten and WorkShieldAI web apps and the Batten mobile app for iPhone and iPad.

Batten is a product of Metron Adaptive Society.

1. Two roles

When your employer uses the Service, your employer is in charge of your records. It decides what is collected, the rules applied, who in the company can see it and how long it is kept. We process those records for your employer as its service provider. Questions about your pay, hours, corrections or records go to your employer.

We are in charge of the account and login itself, the website, support conversations, and how the Service is used and kept secure.

2. What is collected

Account. Name, e-mail, phone, employer, role and permissions, language, login events, password hash (never the password), passkey or device-login public keys.

Employer records (entered by you or your employer): time punches; hours, pay periods, cost codes, quantities; pre-task plans and acknowledgements; incidents, hazards, near-misses, permits, daily logs, workplace-violence-prevention reports; injury and medical records where your employer files them; billing documents; documents uploaded to jobs.

At a punch, when your employer turns it on:

  • Position — your device's location at the moment you clock in, take a break or clock out, and the distance to the site. Only while the app is open and in use. Never in the background. Never between punches. Never when the app is closed.
  • Photo — a photograph taken by you at the moment of a punch. It is a photograph. Nothing measures your face, and nothing compares it to any other photo.
  • Site code — the code scanned or tapped at the site, to show you were there.

You are shown a notice before the first such punch and asked to accept it; nothing is captured before you do, and you are asked again if the notice changes.

On the mobile app. The camera and your photo library, only when you choose to attach a photo or document. Notification permission and a push token from Apple or Google, so the app can alert you about work assigned to you; the token identifies the device, not the content of the message. Files you compose offline are held on your device until they sync.

Device and use. Device model, operating system, app version, a device identifier we create, time zone, IP address, pages and actions used, errors.

Support. What you send us when you ask for help.

Not collected. Fingerprints, face geometry or any biometric identifier. Background location. Contacts, messages, or files you did not upload. Precise location outside a punch. We do not track you across other companies' apps or websites, and we do not use advertising identifiers.

3. Why

To run the Service for your employer (record and compute time, keep records, route notifications, produce reports and documents); to sign you in and keep the account secure; to sync, back up and restore; to fix errors and improve the Service; to send service e-mails and notifications; to meet legal duties; and, with de-identified data only, to understand how the product is used.

We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use it to train models that would reveal your information to another customer.

4. Who sees it

  • Your employer — administrators and the people it grants access to (for example a supervisor who approves time on your job). Your employer decides this, not us.
  • Service providers that run parts of the Service under contract and only on our instructions, in the United States: hosting, database, authentication and file storage; network security and sign-up protection; e-mail delivery; payment processing (we never see full card numbers); map images when a site pin is set; app stores and push notification delivery (Apple and Google); error and uptime monitoring; AI model providers — text you enter in a report may be sent to a model as typed and is not used to train it; where we can, AI runs on our own systems. A current list of providers is available on request.
  • Systems your employer connects (payroll, time, accounting, project or fleet systems) — data flows to and from them as your employer configures.
  • Authorities and others when the law requires, to protect people or the Service, or in a merger or sale of the business (with notice).

5. How long

  • Employer records (punches, hours, positions, photos, plans, reports, medical, billing): as long as your employer keeps them. Employers are required by law to keep many of these for years after employment ends; those records stay with the employer even if you delete your account.
  • Account: while the account exists, then removed within 30 days of a completed deletion request.
  • Logs and diagnostics: up to 90 days.
  • Backups: rolled off within 35 days of deletion.
  • De-identified, aggregated data: may be kept indefinitely.

6. Your choices

  • Notices. You can withdraw acceptance of the position or photo notice in the app. From then on a positioned or photographed punch cannot be recorded for you; ask your employer how to clock in instead.
  • Access and correction. Your employer records are available to you in the app to the extent your employer allows; corrections go through your employer.
  • Delete your account. In the app: Settings → Delete my account. On the web: https://batten.build/delete-account — you can use that page whether or not the app is installed. Within 30 days your login is retired and the personal details on your profile are removed; you get an e-mail when it is done. Records your employer must keep by law stay with your employer, with your name on them, under your employer's control.
  • Permissions. Location, camera, photos and notifications are controlled in your device settings and can be turned off at any time. Turning location off means positioned punches cannot be recorded; turning notifications off means the app cannot alert you.
  • E-mail. Service messages (sign-in codes, deletion confirmation, notices) cannot be turned off while you have an account.

7. California

If you are a California worker, the notice at collection your employer must give you under the CCPA is met by Section 2 (categories), Section 3 (purposes) and Section 5 (retention). We do not sell or share personal information, we do not use sensitive personal information to infer characteristics, and we act as your employer's service provider. Rights to know, delete, correct and limit are exercised through your employer for employer records, and through the deletion path above for the account. We do not discriminate for exercising rights. Authorised agents may act for you with written permission.

8. Nevada and other states

We do not sell covered information under Nevada NRS 603A. State privacy laws with employee exemptions apply to your employer as they provide; for the account itself, use the choices in Section 6. Residents of other states with privacy laws may use the same paths.

9. Security

Data is encrypted in transit and at rest. Access is controlled per company, per job and per permission; a person sees only what their employer granted. Every change to a record keeps its history. Secrets are never stored where an application role can read them. We test access rules on every change and review them independently. No system is perfectly secure; if a breach affects you we will notify you and your employer as the law requires.

10. Children

The Service is for people working for a customer organisation and is not directed to anyone under 18. An employer that lawfully employs a minor is responsible for the notices and consents that requires.

11. Where data lives

In the United States. The mobile app is distributed in the United States only. If you use the Service from elsewhere, your data is transferred to and processed in the United States.

12. Payments

Nothing is sold inside the mobile app. Your employer pays for the Service directly under its own agreement with us; no purchase is made through the App Store or Google Play.

13. Language

This policy is written in English. A translation is for convenience; the English text controls.

14. Changes

We may update this policy. You will see the new version in the app and be asked to accept it; material changes get at least 30 days' notice to your employer.

15. Contact

Metron Adaptive Society · [email protected] · [email protected] · [email protected] · 325 E. Avenida Cordoba, San Clemente, CA 92672, United States. Your employer's contact for records questions is shown in the app under Company.