Privacy Policy

Who we are

Spruce Technology, Inc. (“Spruce,” “we,” “us,” or “our”) provides EmployeeRoster, a company directory available as an iOS app and through a web portal at employeeroster.sprucetech.com (together, the “Service”).

This Privacy Policy explains what personal information the Service handles, how it is used, and the choices available to you. It applies to employees and other authorized people who use EmployeeRoster, and to visitors of our marketing website.

Your employer’s role and ours

EmployeeRoster is a workplace tool. Your organization (your employer) decides to use it, decides what information about its people goes into it, and controls who may access it. In privacy terms, your employer is the controller of the personal information in its directory, and Spruce is a service provider (processor) that handles that information on your employer’s behalf and according to our agreement with them.

Because of this, many questions about the information in your profile (what is collected, whether it is correct, and requests to change or remove it) are directed by your employer. Where a request should go to your employer, we say so below, and we assist our customers in responding.

Information we collect

Account and sign-in information

To create and secure your account we handle your name, your work email address, and, if provided, a work phone number. If you sign in with a password, we store it only in hashed form; we never keep your password in plain text. If your organization uses Microsoft sign-in (Microsoft Entra ID), we authenticate you through Microsoft and receive your basic profile and, where your organization permits it, your Microsoft profile photo, which we use as your directory photo.

Profile information

Your directory profile may include information provided by you or by your employer, such as job title, department, division, office location, manager, start date, skills, certifications, a profile photo, a cell number, and additional email addresses.

Sensitive information (only if your employer adds it)

Some employers maintain additional fields such as date of birth, nationality, work-authorization or immigration status, and home address. This information is provided by your employer, is not required for the Service to function, and is shown only to a limited set of authorized roles at your organization (for example HR or executives). Because some of these fields may be considered sensitive under applicable law, they are handled on your employer’s instructions and subject to their policies.

Content you create

The Service lets colleagues recognize one another (“Kudos”). Messages and recognition you post are visible to others at your organization and are associated with your name.

Usage and device information

When you use the Service we automatically record technical information needed to operate and secure it, such as IP address, device and app version, timestamps, and sign-in activity. We keep a record of authentication attempts to protect accounts against abuse.

How we use information

• To provide the directory: showing profiles, org charts, milestones, events, and recognition to people at your organization.
• To authenticate you and keep your account and your organization’s data secure, including rate-limiting and detecting suspicious sign-in activity.
• To communicate with you about the Service, for example account verification, password resets, and important service notices, sent by email.
• To provide support and to operate, maintain, and improve the Service.
• To meet legal obligations and enforce our terms.

We do not use your personal information for advertising, and we do not sell it.

How information is shared

Within your organization

Your profile is visible to other authorized users at your organization through the directory. Some fields are restricted to specific roles, as described above. EmployeeRoster keeps each organization’s data separate: users at one company cannot see another company’s directory.

With service providers

We use a small number of trusted providers to run the Service, and share only what each needs to perform its function:

• Microsoft: for organizations that use Microsoft sign-in, to authenticate users and, where permitted, retrieve a profile photo (Microsoft Entra ID and Microsoft Graph).
• Email delivery providers: to send verification, password-reset, and service emails.
• Cloudflare: to protect certain forms against automated abuse.
• Hosting infrastructure: operated by Spruce to store and serve the Service’s data.

For legal and safety reasons

We may disclose information if required by law, to respond to lawful requests, or to protect the rights, property, or safety of Spruce, our customers, or others.

In a business transfer

If Spruce is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Data location and security

The Service is hosted and stored in the United States. We protect information with measures appropriate to its sensitivity, including encryption of data in transit (HTTPS), hashed storage of passwords, time-limited sign-in sessions, and role-based access controls that limit who can see restricted fields. Spruce Technology also undergoes independent SOC 2 audits of the security controls it uses to protect customer data. No method of transmission or storage is perfectly secure, but we work to protect your information and to keep our safeguards current.

How long we keep information

We keep directory information for as long as your organization maintains its EmployeeRoster account and your profile within it, and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When your employer removes your profile or closes its account, we delete or de-identify the associated personal information within a reasonable period, except where we are required to retain it.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, or to obtain a copy of it. Because your employer controls the information in its directory, please direct requests about your profile to your employer (typically your HR or IT team). If you contact us directly, we will forward your request to the appropriate organization and assist as their service provider.

You can update much of your own profile within the app, and you can decline to provide optional information such as a work phone number.

Children

EmployeeRoster is a workplace tool intended for use by working adults. It is not directed to children, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised Policy.

Contact us

Questions about this Privacy Policy or about how the Service handles information can be sent to:

Spruce Technology, Inc.
[email protected]
sprucetech.com

If your question is about the information in your own profile, your employer’s HR or IT team is usually the fastest route.