Privacy Policy

1. Who we are and what this covers

Gravitas is an operations platform that small businesses use to run their day-to-day work: writing and running standard operating procedures (SOPs), tracking employee time and attendance, scheduling jobs, managing projects, invoicing, and communicating with staff. It includes a web application and a native mobile app.

This policy applies to the Gravitas product — the application your business logs in to use. It does not cover the public InfiniDev marketing website, which has its own separate data practices. Throughout this policy, a “Customer” is a business that subscribes to Gravitas, and an “end user” is a person — typically an owner, manager, or employee of that business — who uses the application under the Customer’s account.

2. Who controls your data: controller vs. processor

This is the most important thing to understand about how Gravitas handles data, so we state it plainly.

When a business uses Gravitas to run its operations, that business decides what data goes into the platform and why. In privacy law that makes the business the “data controller” for the information its team generates — most importantly, its employees’ time and attendance records, schedules, SOPs, and job data. InfiniDev acts as the “data processor”: we store and process that data on the Customer’s behalf and under the Customer’s instructions, to provide the service. We do not use a Customer’s business or employee data for our own purposes.

InfiniDev is a controller in its own right for a narrower set of information: the account and billing data we need to create and manage the Customer’s subscription, and the technical data we collect to keep the platform secure and running. The rest of this policy is explicit about which role we are in for each category of data, because it determines who you contact to exercise your rights (see Section 11).

3. What we collect

Gravitas collects the following categories of information. Which of these apply depends on how a Customer configures the product and which modules it uses.

Account data

Names, email addresses, phone numbers, roles and permissions, passwords (stored only as salted hashes, never in plain text), and profile details for the people a Customer invites into its Gravitas account.

Business content

The operational data a Customer creates in the product: SOPs and procedure runs, schedules and calendars, jobs and tasks, projects, documents and certifications, inventory and asset records, invoices, leads, and internal chat messages. This content belongs to the Customer; we process it as a processor on the Customer’s behalf.

Time and attendance records

Because this is core to what Gravitas does, we call it out on its own. When employees clock in and out — including via a QR code scanned on site — the platform records timestamps, the job or shift the time is attributed to, and the associated employee. These records are created by the Customer’s employees and belong to the Customer, who is the controller for them. InfiniDev stores and processes them to provide time-tracking and timesheet features.

Location data (conditional)

Depending on how a Customer configures QR clock-in and its mobile deployment, Gravitas may capture location information at the moment of a clock-in or clock-out — for example, to confirm that a shift started at a job site. Whether location is captured, and how precisely, is a setting the Customer configures, and location is only collected where a Customer enables location verification and where the end user’s device permits it. Where location is captured, it is used to attribute and verify attendance events, not to track an employee’s continuous movements.

Push notification tokens

If an end user enables push notifications in the mobile app, we store the device push token needed to deliver schedule changes, new assignments, and similar alerts. Tokens are used only to route notifications and can be revoked by disabling notifications on the device.

Device and usage data

Technical information generated as the application runs: device type and operating system, app version, IP address, log and diagnostic data, and basic usage events. We use this to operate, secure, and improve the service. Gravitas also supports offline use; data entered while a device is offline is stored locally on that device and synced to our servers when connectivity returns.

Payment data (via Stripe)

Subscription payments are processed by Stripe. When a Customer pays for Gravitas, card details are entered directly into Stripe and never pass through or get stored on InfiniDev servers. We receive from Stripe only limited billing information — such as a billing contact, the last four digits and brand of the card, and subscription and payment status — which we use to manage the subscription. Stripe processes payment data under its own privacy policy.

4. How we use information

We use the information above to:

• Provide, operate, and maintain Gravitas and its modules for the Customer;
• Record and attribute time and attendance, and generate timesheets and reports the Customer relies on;
• Authenticate users, enforce roles and permissions, and keep accounts secure;
• Deliver push notifications and other alerts an end user or Customer has enabled;
• Process subscription payments and manage billing through Stripe;
• Provide the optional AI features described in Section 6, when a Customer uses them;
• Diagnose problems, prevent abuse and fraud, and improve reliability and performance;
• Communicate with Customers about their account, service changes, and support requests; and
• Comply with legal obligations.

For data where InfiniDev is a processor (business content, time and attendance, and the like), we act only on the Customer’s instructions and do not sell it or use it for unrelated purposes.

5. Subprocessors

To run Gravitas we rely on a small number of third-party service providers (“subprocessors”) that process data on our behalf. Each receives only the data it needs for its role.

We may add or change subprocessors as the service evolves. When we do, we will update this policy; material changes are handled as described in Section 12.

6. AI processing

Gravitas offers optional AI features — for example, drafting or suggesting SOP content. When a Customer or end user uses one of these features, the relevant customer content is sent to an external, third-party AI model provider, Anthropic (Claude API), to generate a response. That means the specific data submitted to the feature — such as the text of a procedure being drafted or summarised — leaves InfiniDev’s infrastructure and is processed by that provider.

We send the provider only the content needed to fulfil the request. Anthropic’s handling of data submitted through the Claude API — including whether that content is retained and whether it is used to train Anthropic’s models — is governed by Anthropic’s Commercial Terms of Service and its Privacy Policy. We describe those terms by reference to Anthropic’s published documents rather than restating them here, so that this policy stays accurate if they change.

AI features are optional. A Customer that does not want its content sent to an external model should not use them; where configurable, they can be left disabled.

7. Data retention

We retain business content, time and attendance records, and account data for as long as the Customer’s account is active and as needed to provide the service. When a Customer’s subscription ends, data is handled as described in the Gravitas Terms of Service: we retain it for two years after termination and then delete or de-identify it, except where we are required to keep certain records (for example, billing records) longer to meet legal, tax, or accounting obligations.

Because the Customer is the controller for its business and employee data, the Customer may set its own, shorter retention requirements, and we will honour a Customer’s documented deletion instructions for data we process on its behalf ahead of that two-year default.

8. Security

We take reasonable technical and organisational measures to protect the data in Gravitas, including encryption of data in transit, role-based access controls within the application, and hosting on established infrastructure providers (Supabase and Vercel). Passwords are stored only as salted hashes.

No system is perfectly secure, and we do not claim any specific security certification. We describe only the safeguards we actually have in place.

9. Your California privacy rights (CCPA/CPRA)

This section applies to California residents and describes rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). Where InfiniDev processes employee or business data as a service provider on a Customer’s behalf, the Customer is responsible as the business under the CCPA, and a California resident who is that Customer’s employee should direct requests to their employer (see Section 11). This section describes the personal information InfiniDev handles as a business in its own right.

Categories of personal information we collect

In the twelve months before the date of this policy, we may collect the following CCPA categories:

• Identifiers — name, email address, phone number, account identifiers, and IP address;
• Customer records / commercial information — subscription and billing details (payment card data is collected directly by Stripe, not by us);
• Internet or network activity — log, device, and usage data generated as the application runs;
• Geolocation data — where a Customer enables location capture on clock-in (see Section 3);
• Professional or employment-related information — roles, schedules, and time and attendance records, processed on the Customer’s behalf.

Your rights

Subject to the CCPA’s limits, you have the right to:

• Know what personal information we collect, use, and disclose about you;
• Delete personal information we hold about you;
• Correct inaccurate personal information; and
• Exercise these rights without being discriminated against for doing so — we will not deny service, charge a different price, or provide a different quality of service because you exercised a privacy right.

Sale or sharing of personal information

InfiniDev does not sell your personal information, and does not share it for cross-context behavioural advertising, as those terms are defined under the CCPA. We disclose personal information only to the subprocessors listed in Section 5 to provide the service.

To make a request, contact us using the details in Section 13. We will verify your request as required by law before acting on it.

10. Children's data

Gravitas is a workplace product for businesses and their staff. It is not directed to children, and we do not knowingly collect personal information from anyone under the age of 13 (or the minimum age required in their jurisdiction to use a workplace service). If you believe a child has provided personal information through Gravitas, contact us and we will delete it.

11. If your employer uses Gravitas

If you are an employee or team member of a business that uses Gravitas, most of the data about you in the platform — your time and attendance records, schedules, and job data — belongs to and is controlled by your employer, not InfiniDev. We process that data as a service provider on your employer’s behalf.

That means requests to access, correct, or delete that data, and questions about why it is collected or how it is used, should go to your employer as the data controller. If we receive such a request directly from an end user, we will generally refer it to the relevant Customer, or act only on that Customer’s instructions, except where the law requires us to respond directly.

12. Changes to this policy

We may update this policy as Gravitas changes or as our practices evolve — including if we add or change a subprocessor or an AI provider. When we make a material change, we will update the “last updated” date at the top and, where appropriate, notify Customers through the service. Continued use of Gravitas after a change takes effect means you accept the updated policy.

13. Contact us

For questions about this policy or to exercise a privacy right, contact:

• Privacy contact: privacy@infinidev.company
• InfiniDev LLC, 825 Town and Country Ln, Suite 1200, Houston, TX 77024