Privacy Policy for LastCall

Effective Date: December 26, 2024

Last Updated: August 20, 2026

1. Introduction

LastCall ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application for employee scheduling and shift management.

2. Information We Collect

2.1 Personal Information

We collect the following personal information when you create an account:

Email Address: Used for account creation, authentication, and important notifications about schedule changes
Phone Number: Used for account identification and optional contact by organization managers
First and Last Name: Used for identification within organizations and on schedules
Password: Securely hashed and stored via Supabase authentication service

2.2 Usage Data

Schedule Data: Work schedules, shifts, and availability preferences you create or are assigned to
Organization Membership: Information about organizations you join or create, your role within them
Device Information: Push notification tokens (Expo Push Token) for sending schedule update notifications
Availability Preferences: Your general availability and organization-specific availability settings

2.3 Automatically Collected Information

Log Data: Error logs and performance metrics for app improvement
Usage Patterns: How you interact with the app (anonymized where possible)

3. How We Use Your Information

We use collected information for the following purposes:

Account Management: Create and authenticate your account via Supabase
Schedule Coordination: Enable managers to create schedules and assign shifts
Notifications: Send push notifications when schedules are published (when enabled by you)
Email Communications: Send schedule updates via email (when enabled by you)
Team Coordination: Display your information to organization managers and colleagues for scheduling purposes
Service Improvement: Analyze usage patterns to improve app functionality and user experience
Support: Respond to your questions and provide customer support

4. Third-Party Services

4.1 Supabase (Authentication & Database)

We use Supabase for authentication and data storage. Your data is stored securely on Supabase's cloud infrastructure with industry-standard encryption. Supabase complies with GDPR and SOC 2 Type II standards.

Organization documents (Enterprise plans): Files uploaded to an organization's document library — for example blank tax forms, menus, price lists, and handbooks — are stored in a private Supabase storage bucket, encrypted in transit and at rest. They are not publicly accessible: a document can be downloaded only through a short-lived link that our backend issues to members of the organization the document belongs to, so its contents are visible only to that organization's members. Only the Organization Owner can upload, rename, or delete documents; other members have download-only access. LastCall stores and serves these documents on the organization's behalf and does not use them for any other purpose. We keep a record of upload, rename, and delete events so that we can investigate abuse reports, copyright notices, and legal requests. Documents are retained until the Organization Owner deletes them or the organization is deleted. Organization Owners are responsible for what they upload, including any personal information a document contains — see our Terms of Service for the rules that apply to uploaded content.

Review Supabase's privacy policy: https://supabase.com/privacy

4.2 Expo Push Notifications

We use Expo's push notification service to send schedule updates. Your push token is stored securely and used only for sending notifications you've enabled. Expo does not use your data for advertising.

Review Expo's privacy policy: https://expo.dev/privacy

4.3 Render (Backend Hosting)

Our backend API is hosted on Render. Render provides secure cloud infrastructure with encryption in transit and at rest.

Review Render's privacy policy: https://render.com/privacy

4.4 No Analytics or Tracking

We do not use third-party analytics services, advertising networks, or tracking services. Your data is used solely for the functionality described in this policy.

5. Privacy Controls

You have granular control over your data and privacy:

Email Visibility: Toggle whether organization managers can see your email address (default: visible to managers for scheduling communication)
Phone Visibility: Toggle whether organization managers can see your phone number (default: hidden from managers)
Push Notifications: Enable or disable push notifications for schedule updates in app settings (default: enabled)
Email Notifications: Enable or disable email notifications for schedules (default: disabled)

Note: Organization owners and managers always have access to contact information for employees within their organization for legitimate scheduling purposes.

6. Data Sharing and Disclosure

6.1 Within Your Organizations

We share your information with:

Organization owners and managers within organizations you join (name, role, schedule data, contact info based on your privacy settings)
Other employees in your organization (name, assigned shifts, availability status)

6.2 Service Providers

Supabase: Database hosting and authentication
Expo: Push notification delivery
Render: Backend API hosting

6.3 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, or to protect the rights, property, or safety of LastCall, our users, or others.

6.4 We Never Sell Your Data

We never sell, rent, or trade your personal information to third parties for marketing purposes.

7. Data Retention and Deletion

7.1 Active Accounts

We retain your data as long as your account is active and for a reasonable period afterward to comply with legal obligations.

7.2 Account Deletion

When you delete your account through app settings:

All your personal information is permanently deleted from our systems
Your organization memberships are removed
Your schedules, shifts, and availability data are deleted
Your push notification token is removed
This action is permanent and cannot be undone

7.3 Data Retention Period

After account deletion, some data may be retained in backup systems for up to 30 days before permanent deletion. Anonymized usage statistics may be retained indefinitely for app improvement.

8. Your Rights (GDPR/CCPA Compliance)

You have the following rights regarding your personal data:

Right to Access: Request a copy of all personal data we hold about you
Right to Rectification: Update or correct your personal information through app settings
Right to Erasure: Delete your account and all associated data permanently
Right to Data Portability: Request your data in a machine-readable format (JSON export)
Right to Object: Object to processing of your data for specific purposes
Right to Restrict Processing: Request limitation of how we process your data
Right to Withdraw Consent: Withdraw consent for data processing at any time

To exercise these rights, contact us at: support@lastcall.app

9. Children's Privacy

LastCall is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at support@lastcall.app and we will delete the information promptly.

10. Security Measures

We implement industry-standard security measures to protect your data:

Encryption in Transit: All data transmitted between your device and our servers uses HTTPS/TLS encryption
Encryption at Rest: Database is encrypted at rest via Supabase's security infrastructure
Authentication: Secure JWT-based authentication via Supabase
Password Security: Passwords are hashed using bcrypt and never stored in plain text
Rate Limiting: API rate limiting to prevent abuse and brute-force attacks
Access Controls: Role-based access control (RBAC) for organization data

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:

We will update the "Last Updated" date at the top of this policy
For material changes, we will notify you via email or in-app notification
Your continued use of LastCall after changes constitutes acceptance of the updated policy

We encourage you to review this policy periodically.

12. International Data Transfers

Your data may be transferred to and processed in the United States and other countries where our service providers (Supabase, Expo, Render) operate. By using LastCall, you consent to this transfer and processing.

We ensure that international transfers comply with applicable data protection laws through:

Standard contractual clauses
Privacy Shield frameworks (where applicable)
Ensuring service providers meet GDPR and privacy standards

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

Right to know what personal information is collected, used, shared, or sold
Right to delete personal information
Right to opt-out of sale of personal information (we don't sell your data)
Right to non-discrimination for exercising CCPA rights

To exercise these rights, contact us at: support@lastcall.app

14. Contact Us

For privacy-related questions, concerns, or to exercise your data rights, please contact us:

Email: support@lastcall.app
GitHub: https://github.com/FrankieSoltero/LastCall
Response Time: We aim to respond within 48 hours

15. Consent

By using LastCall, you consent to this Privacy Policy and agree to its terms. If you do not agree, please do not use the app.