Privacy Policy

1. Who this policy applies to

This policy applies to individuals who are granted access to the Service, including contractors, approvers (supervisors), accounting users, and administrators. The Service is not open to the public and does not offer self-registration. Access is limited to authorized Agents Only personnel with approved company email addresses.

2. Information we collect

We collect and process the following categories of information to operate the Service:

Account and profile information

• Member ID, legal name, job title, and employment start date
• Work email address and, where applicable, personal email address
• Phone number
• Home or mailing address (street, city, state/province, postal code, country)
• Organizational role (contractor, approver, accounting, or admin) and reporting relationships

Payment and banking information

• Bank name, account holder name, account number, and routing or SWIFT/IBAN details
• Contract rates (base and overtime) and invoice amounts

Contract rates and invoice monetary amounts are encrypted at rest using AES-256-GCM. Other profile and banking fields are stored in our database to generate invoices and process contractor payments.

Invoice and workflow data

• Invoice numbers, billing periods, line items, status, and submission timestamps
• Overtime requests, including work dates, hours, reasons, and approver comments
• Generated invoice PDFs and related export files
• In-app notifications about invoice and overtime activity

Authentication and security data

• Hashed passwords (when password sign-in is enabled)
• Google account email and basic profile information when you sign in with Google
• Session identifiers and CSRF protection tokens
• Login attempt counters used for brute-force protection

Technical and activity logs

• IP address and browser user agent recorded on sign-in, sign-out, and certain administrative actions
• Audit records when confidential contract rates are viewed or updated
• Email submission logs, including recipient addresses and PDF filenames
• Server error logs related to application operation

Local browser storage

The Service stores your light/dark theme preference in your browser’s localStorage under the key ao-theme. This preference is not transmitted to our servers.

3. How we use your information

We use personal information for the following purposes:

• Authenticating you and maintaining your session
• Generating, reviewing, approving, and paying contractor invoices
• Managing overtime requests and supervisor approvals
• Calculating invoice totals from your profile, rates, and approved overtime
• Sending transactional emails and reminders about invoice deadlines and status changes
• Providing role-appropriate access for contractors, supervisors, accounting, and administrators
• Maintaining audit trails for security, compliance, and payment reconciliation
• Importing and synchronizing member roster data from internal company systems
• Protecting the Service against unauthorized access and abuse

We do not use the Service for advertising, behavioral profiling, or third-party marketing. We do not sell personal information.

4. Legal bases for processing

Depending on your location, we process personal information based on one or more of the following:

• Contractual necessity — to perform our contractor engagement and payment obligations
• Legitimate interests — to operate, secure, and audit an internal business system
• Legal obligations — to meet accounting, tax, and record-keeping requirements
• Consent — where required for optional features or communications, which you may withdraw by contacting us

5. How we share information

We share personal information only as needed to operate the Service:

• Within Agents Only — authorized supervisors, accounting staff, and administrators may access information required for their role, such as team invoices, rates, or member profiles.
• Service providers — we use infrastructure and tools that may process data on our behalf, including hosting providers, email delivery (SMTP), and Google services described below.
• Legal and safety — we may disclose information if required by law, regulation, legal process, or to protect the rights, property, or safety of Agents Only, our personnel, or others.

We do not share invoice or profile data with payment processors through the Service. Contractor payments are handled through our offline accounting processes.

6. Third-party services

The Service integrates with the following third parties:

• Google Sign-In (OAuth) — if enabled, you may authenticate with your Google account. Google receives authentication requests from your browser and returns your verified email address and basic profile information to us so we can match your account. Google’s privacy policy applies to that sign-in process.
• Google Sheets — we may import member roster data from an internal Google Sheet maintained by Agents Only. This import is inbound only; personal data from the Service is not written back to Google Sheets through this integration.
• Google Fonts — our web pages load fonts from Google’s servers. When your browser requests these fonts, Google may receive your IP address and basic technical information.
• Email delivery — notification and reminder emails are sent through our configured mail server or SMTP provider. Message content may include your name, invoice number, billing period, and invoice total.

The Service does not use analytics platforms such as Google Analytics, advertising pixels, or similar tracking tools.

7. Cookies and similar technologies

We use the following:

• Session cookie — a strictly necessary PHP session cookie that keeps you signed in, stores CSRF protection tokens, and supports login security controls. The cookie is HTTP-only, uses SameSite=Lax, and is marked Secure in production environments.
• Local storage — your theme preference (ao-theme) as described above.

We do not use non-essential tracking cookies.

8. Data retention

We retain personal information for as long as your Agents Only contractor or employment relationship requires access to the Service, and for additional periods needed for accounting, tax, audit, dispute resolution, and legal compliance.

Activity logs, audit records, invoice files, and related exports may be retained after account deactivation where retention is reasonably necessary for business or legal purposes. When data is no longer required, we delete or anonymize it using appropriate technical and organizational measures.

9. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

• Role-based access controls across contractor, supervisor, accounting, and admin portals
• Encryption at rest for contract rates and invoice amounts
• Password hashing using industry-standard algorithms
• HTTPS enforcement, CSRF protection, and login throttling in production
• Restricted access to uploaded invoice files and mail outbox directories

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately.

10. International data transfers

Agents Only is based in Canada. If you access the Service from another country, your information may be processed in Canada or in other locations where our service providers operate. Where required, we implement appropriate safeguards for cross-border transfers.

11. Your rights and choices

Depending on applicable law, you may have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of information, subject to legal and contractual retention requirements
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

Profile details shown in the Service are sourced from your official Agents Only member record. If information such as your legal name, address, or bank details is incorrect, update your Agents Only account profile or contact us so the source record can be corrected.

To exercise privacy rights, contact us at community@agentsonly.com. We may need to verify your identity before responding.

12. Children’s privacy

The Service is intended for authorized adult contractors and employees. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page. Material changes may also be communicated through the Service or by email where appropriate. Continued use of the Service after an update constitutes acceptance of the revised policy.

14. Contact us

If you have questions about this Privacy Policy or our data practices, contact: