Privacy policy

Who this policy covers

It covers shift supervisors, clerks, dispatchers, and drivers whose names appear on a board, and the person who sends a note through the desk form. It covers the subscriber's account owner, who decides which shifts are staffed and who may sign a release. It does not turn a casual reader of the public pages into a roster name. A visitor who only reads and does not submit a form is covered only for the limited technical data described later in this policy.

The subscriber is the desk that owns the lots. ModestGram processes slip content to provide the subscription that desk paid for. Drivers and clerks who appear on a slip usually start with their own supervisor if they want a correction, because the subscriber decides who is written on the row. They may also write to us, as set out at the end of this policy.

Information tied to a shift

When a desk uses the product we store the shift name, the kind of shift (room, arrival, or pass-down), the start and end written on the roster, and the people or units placed on each row. A row may name a clerk, a supervisor, a cold room, or a reefer unit. We store the time shown on the left of that row because the board is a shift record. We do not build a free-form chat beside it. If a shift is canceled before it starts, we keep the cancellation long enough to show it was not invoiced, then it follows the retention rules below.

Temperature and exceedance records include room identifiers, probe identifiers, the limit the desk set for that lot or that room, the reading, the time of the reading, and how long the reading stayed outside the limit. For a reefer we store the unit identifier, the setpoint, the return-air reading, and the arrival window the dispatcher attached. We store these values so a later shift can see why a lot was held. We do not sell thermometer streams, and we do not turn a reading into an advertisement.

A quarantine slip stores the lot identifier, a plain description of the goods, the pallet count the clerk entered, the cage or lane where the goods sit, the room or unit that went out of range, and the exceedance that prompted the slip. It stores the clerk's name and the time the slip was opened. It stores the driver's name, the unit number, and the mark the driver made: accept or refuse. It stores the supervisor's name and the time of a release, or the fact that release has not been signed. If the desk attaches a short note, such as a door left open during a count, we store that note on the slip. A signature image, if the dock captures one, is stored as part of that mark and not in a separate album.

A handover stores the outgoing name, the incoming name, the time of the handover, and the text of what is still held, what was refused, and what the next shift must not release. Equipment notes, such as a probe battery swapped at a stated time, stay on that same record. We store the handover so the morning does not depend on a sentence spoken in a doorway.

Account and billing information includes the account name for the desk, the login email for each person who signs in, a salted password hash, and the role on the roster, such as clerk, dispatcher, or supervisor. We store which shifts were staffed in a billing period and the rate that applied. We store invoice status and a payment reference from the payment provider. We do not store a full payment card number on ModestGram systems. The provider processes the card or the transfer under its own terms.

If you write to the desk from the site, we store the name you typed, the reply address you typed, the room or unit you named, the shift you selected, and the note. We use that only to answer. The only address we publish for a reply is support@modestgram.com. Please do not send a medical file or a government identity number in the note. A lot code and a room name are enough for us to understand the question.

When you load the marketing pages or the product, our hosting provider may log an IP address, a user agent, and the time of the request. We use those logs to keep the service available and to investigate abuse, such as repeated login failures or attempts to read another desk's slips. We do not use them to build a profile of which public page you lingered on.

How we use information

We use shift, temperature, slip, and pass-down records to provide the subscription: to show the board, to keep one slip for a held lot, to record an accept or a refuse, and to show the next shift what is still isolated. We use account data to authenticate the person at login and to keep a clerk from releasing a lot they are not assigned to sign. A driver token can write a mark on an open slip. It cannot sign the release. We use billing data to invoice the shifts that were actually rostered and that started. A dark room is not invoiced, and the absence of a shift is itself a billing fact we have to store briefly.

We use messages sent to support@modestgram.com to answer the desk, including password resets for a roster name that already has an account. We use technical logs to investigate abuse. We do not use hold records to build advertising profiles. We do not train public models on your lot notes. If a processor hosts the application, that processor acts on our instructions and may not use the slips for its own marketing.

Where a law requires a ground, we rely on the contract with the subscriber to keep the board and the slips, on legitimate interests that do not override the person's rights (to secure logins and to prevent a forged release), and on steps you ask us to take before a contract exists, such as answering a desk note. If a separate consent is required for a cookie that is not strictly necessary, we will ask before setting it. We do not currently set non-essential cookies.

Sharing

We share information with infrastructure providers who host the application, store backups, and carry mail when we reply from support@modestgram.com. We share a payment reference with the payment provider so the invoice for staffed shifts can be collected. We share information if a competent authority requires it under applicable law, and we limit the share to what the request lawfully covers. We do not sell personal information. We do not rent lists of warehouses or of drivers.

We share a slip with another user on the same subscriber account when their role allows it. A driver mark is visible to the dispatcher and the supervisor on that desk, because that visibility is the product. A supervisor's release is visible to the clerk who opened the slip. We do not show one subscriber's lots to another subscriber. A bearer token for one desk cannot read another desk's holds.

If the subscriber asks us to send a slip or a pass-down to a person the subscriber names, we send only what the subscriber asked to send. We do not add our own commentary about the goods. We do not post slips to a public page.

Providers in more than one region

Providers may process data in more than one region. When they do, we use contractual terms with those providers that require a comparable level of protection. We describe those places as regions, not as our place of business. The subscriber remains the desk that owns the lots. A transfer to a provider is for hosting, backup, mail, or payment, and not for a new use of the slip.

Retention

We keep slip, exceedance, and pass-down records for the life of the subscription and then for twenty-four months, unless the subscriber deletes a record sooner from the product or asks us to delete it, or unless the subscriber has set a longer retention on the account for its own hold history. We do not decide the subscriber's food-holding rule. We keep the record the desk asked to keep, within the cap the account set, and we say what that cap is on the account.

We keep invoices for the period applicable law requires for accounting. We keep security logs for up to ninety days unless a longer period is needed to investigate an incident that has already started. Desk-form notes are kept until we have answered and for up to twelve months after the last reply, then deleted. Backup copies fall away on the backup cycle, which completes within thirty days of a deletion in the live store. A password hash is deleted with the account. A reset token expires on its own and is not kept as a slip.

Security

Access to a desk is limited by account and by role. A driver sign-off is an append to the slip, not a silent overwrite of the clerk's reading. Release is a separate signature. Passwords are stored only as salted hashes. Sessions expire. Transmission uses industry-standard encryption in transit. Backups are encrypted at rest. No method of transmission or storage is perfect, and we do not claim that a determined intruder cannot succeed.

If we confirm a breach that affects slip data or account credentials, we will notify the subscriber's account owner without undue delay and describe what we know, consistent with applicable law. We will not describe a probe reading as untouched if we know the record was altered. The subscriber remains responsible for the probes and for who is handed a login.

Your rights

Depending on applicable law, a person whose name is on a slip may have the right to access the record, to correct a wrong name, to delete a note, to restrict a use, or to receive a copy in a portable form. Drivers and clerks should usually start with the subscriber, because the subscriber decides who is on the roster and how long a hold must remain readable. You may also write to support@modestgram.com. We may need to confirm that you are the person named on the row before we act. We will not release another desk's lots to you.

If we deny a request, we will say why, unless the law forbids that explanation. You may lodge a complaint with a supervisory authority that has jurisdiction over you. We do not name that authority here, because it depends on you. We will not require you to create a new slip in order to ask about an old one. Name the slip identifier if you have it, or the room and the night, and we will look it up on the desk you name.

Cookies

The session cookie is strictly necessary for a signed-in board, so a clerk stays on the correct desk and does not see another shift's holds. A strictly necessary cookie also stops a desk-form note from being applied twice if the page is submitted again. Both are first-party. You can block cookies in your browser. If you block the session cookie, login will not keep you on the shift, and you will have to sign in again for each action.

We do not set advertising cookies. We do not load third-party media widgets. We do not respond to a do-not-track signal with a special mode, because we do not track you across other companies' sites in the first place. If that changes, we will update this policy and the date at the top before a non-essential cookie is set.

Children

The product is for working desks. It is not directed at children, and we do not knowingly collect information from children. A roster name is expected to be a person assigned to a shift by the subscriber. If you believe a child's data was submitted in a note or placed on a slip by mistake, write to support@modestgram.com and we will delete it from the live store and allow the backup cycle to finish.

Changes

If we change this policy, we will update the date at the top. If a change materially alters how we use slip content, we will notify the account owner at the login address on the account, or by a notice on the board, before the change takes effect. Continued use after the effective date is acceptance of the updated policy where applicable law allows that form of notice. A change will not quietly turn a hold record into something we sell.

Reach the desk

The only contact address for privacy questions is support@modestgram.com. Write Privacy in the subject and name the desk or the slip if you have one. We do not offer a separate postal address on this page. For a question about putting a shift on the board, you can also use the desk form. That form is answered from the same address.