Privacy Policy

1. Who we are and what this policy covers

One Flagger Inc ("One Flagger," "we," "us," or "our") is a traffic control and flagging company located at 515 W 9th St, Hazleton, PA 18201. We provide flagging and temporary traffic control services, mainly as a subcontractor to prime contractors, utilities, and municipalities.

This Privacy Policy explains how we collect, use, share, retain, and protect personal information when you visit oneflagger.com (the "Site"), request a quote, apply for a job, or contact us. It also covers information processed through The Yard app, including the Crew portal (the "App"), and The Yard admin dashboard (the "Platform"), including information about our flagger employees who use the App. Some employment records are also governed by our internal policies and employment law. This policy does not cover the privacy practices of third-party websites linked from the Site.

By using the Site, you acknowledge this Privacy Policy. Use of the Site is also governed by our Terms of Service.

2. Information we collect

We collect only the information you choose to give us through our forms or when you contact us, plus limited technical data needed to operate the Site.

Quote request form

• Your name and company name
• Phone number and email address
• The service you need (for example, flagging operations or work zone setup)
• Project details you choose to provide, such as location, dates, and scope

Career application form

• Full name, phone number, email address, and mailing address
• Whether you hold ATSSA flagger certification (or are willing to become certified)
• Whether you hold a valid driver's license (we do not ask for the license number)
• Any notes you add about experience, availability, or other qualifications
• Your resume, if you choose to upload one (PDF, Word, text, or image file up to 4 MB). A resume may include work history, education, certifications and training, references, and any other information you choose to include.

Direct communications

If you call, text, or email us, we receive your contact details and whatever information you share, which may include project information or, for applicants, details about certifications and work history.

The Yard app (including the Crew portal) accounts

• Account and profile: name, contact details, login credentials, profile photo if you add one, language preference, and emergency contact if you provide one.
• Certification and training records: flagger, ATSSA, OSHA, CPR, and other training and certifications, with issue and expiration dates, card copies, and verification results.
• Work records: jobs offered, accepted, and worked; check-in and check-out times; timesheets; messages with dispatch; and job history.
• Payroll and tax information: for employees, Social Security number, tax withholding forms (such as Form W-4 and Pennsylvania and local earned-income tax forms), direct-deposit bank details, wage rates, hours, earnings, deductions, and pay stubs. These are collected through secure onboarding and payroll systems, not through the Site's forms.
• Customer information: for contractors and agencies, business contacts, project details, contracts, and billing records, including bank account details provided on our ACH authorization form for ACH bank transfer payments.

Location data

With your permission, The Yard app (including the Crew portal) uses your device's precise location to show jobs near you and their distance, and to verify your arrival at, time on, and departure from a job site (for example, when you check in and out). We ask for location permission through your device's operating system, and you can turn it off at any time in your device settings (on iPhone: Settings > Privacy & Security > Location Services; on Android: Settings > Location, or the App's permission settings). If you turn it off, you can still use the App, but nearby-job sorting and on-site verification may not work, and dispatch may need to confirm your times another way. We do not use location data for advertising, and we do not sell it.

Device and push tokens

When you use the App, we collect device information such as device model, operating system, app version, and crash and diagnostic data, and, if you allow notifications, a push notification token that lets us send job offers and updates to your device through Apple's or Google's notification services. You can turn notifications off in your device settings.

Technical data

When you visit the Site, our hosting provider automatically processes standard technical information, such as IP address, browser and device type, the pages and files requested, referring URL, and date and time, in server and security logs. This is used to deliver the Site, keep it secure, and diagnose problems. We do not use it to build profiles of visitors.

Information we do not want

Please do not submit Social Security numbers, driver's license or ID numbers, dates of birth, bank or payment information, immigration documents, medical or disability information, or similar sensitive information through the Site. If we need that kind of information later (for example, payroll and tax information during hiring paperwork), we will collect it through the secure onboarding and payroll process described above, not through the Site's forms.

3. How we use your information

• To respond to quote requests: contacting you, evaluating your project, preparing estimates and proposals, scheduling, and performing and documenting services under a Service Agreement.
• To evaluate applicants: reviewing qualifications and certifications, contacting you about openings and interviews, making hiring decisions, and, if you are hired, beginning onboarding.
• To run the App and Platform: showing and offering jobs, dispatch, messaging, verifying on-site time, tracking certifications and training, managing projects, contracts, and invoicing, and sending push notifications.
• To pay our employees: processing payroll, tax withholding and reporting, and pay stubs, and meeting wage-and-hour and prevailing-wage recordkeeping requirements.
• To communicate in your preferred language: we have English- and Spanish-speaking staff.
• To operate and secure the Site: hosting, troubleshooting, preventing spam and abuse (for example, our forms use a hidden "honeypot" field to filter automated submissions), and protecting our systems.
• To meet legal and contractual obligations: complying with laws and regulations, recordkeeping requirements, lawful requests from authorities, and requirements in our contracts.
• To protect rights and safety: enforcing our Terms, and protecting the rights, property, and safety of One Flagger, our workers, customers, and the public.

We do not use your information for automated decision-making that produces legal or similarly significant effects, and we do not sell it or use it for targeted advertising.

4. Service providers (processors)

We use a limited number of service providers ("processors") to run the Site, App, and Platform. They may process your information only to provide services to us. By category:

• Vercel Inc. hosts the Site and runs the serverless functions that receive and validate form submissions. Vercel processes technical data and the contents of submissions in transit. The Site's quote and application form functions do not save submissions to a database.
• Resend is the email delivery service we use to send each form submission, including any resume attachment, to our business inbox.
• Our business email provider stores the emails that contain your submission.
• Database, authentication, and file storage (Supabase) stores App and Platform account, job, certification, and work records.
• Banking and ACH payments (our bank and ACH processing) receive customer payments by ACH bank transfer, using the bank account details customers provide on our ACH authorization form.
• Electronic signature (an e-signature service provider) delivers, signs, and stores contracts and other documents.
• Payroll provider (Gusto) processes employee payroll, tax withholding and filings, pay stubs, and direct-deposit information.
• Push notifications and app distribution (Apple and Google) deliver notifications and distribute the App.
• Google Fonts serves the typeface used on the Site. Your browser requests font files from Google's servers, which receive your IP address and browser information as part of that request.

These providers are located in, and process data in, the United States, and may use their own subprocessors. Their handling of data is governed by their own terms and privacy policies.

5. How we share information; no sale of data

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We share personal information only as follows:

• Service providers described above, to operate the Site, App, and Platform.
• Customers, for staffing: the name, relevant certifications, and on-site times of the flaggers assigned to a customer's project, as needed to staff, document, and invoice the work. We do not share workers' payroll, tax, or precise location history with customers.
• Government agencies, as required for payroll taxes, wage reporting, and certified payroll on public projects.
• Project parties: when needed to respond to or perform a project you asked us about, we may share relevant project details with the prime contractor, project owner, utility, municipality, or permitting authority involved.
• Screening providers: for applicants who receive an offer or advance in hiring, with consumer reporting agencies or similar providers, and only with your written authorization where required by law.
• Professional advisers, such as attorneys, accountants, and insurers, under duties of confidentiality.
• Legal and safety reasons: to comply with law, subpoena, court order, or other legal process; to respond to lawful requests from government agencies; or to protect the rights, property, or safety of One Flagger, our workers, customers, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy's protections.
• With your consent or at your direction.

6. Cookies, tracking, and Do Not Track

Cookies. The Site does not use advertising cookies, analytics cookies, social-media tracking pixels, or cross-site tracking. Our hosting provider may use strictly necessary technical mechanisms to deliver and secure the Site. If we ever add analytics or similar tools, we will update this policy before doing so.

Do Not Track and Global Privacy Control. Because we do not track visitors across websites or sell or share personal information for advertising, there is nothing for a "Do Not Track" or Global Privacy Control signal to turn off. We treat such signals as a request not to sell or share your information, which we already do not do.

Third-party sites. Links to Facebook, Google Maps, and other sites take you to services with their own cookies and privacy practices, which we do not control.

7. How long we keep information

• Quote requests are kept for as long as needed to respond and, if a project results, for as long as needed to perform the work and to maintain business, tax, accounting, insurance, and contract records required by law or our agreements.
• Applicant records (applications, resumes, and related notes) are kept for at least one year from the date the record was made or the hiring decision, whichever is later, where federal recordkeeping rules apply, such as Equal Employment Opportunity Commission regulations (29 C.F.R. § 1602.14) and Age Discrimination in Employment Act regulations (29 C.F.R. § 1627.3). Records relevant to a charge of discrimination, lawsuit, audit, or investigation are kept until the matter is finally resolved. Longer periods may apply where other laws or contract requirements apply. If you are hired, your application becomes part of your personnel file and is kept under our employee record practices.
• App and Platform account records are kept while the account is active and for a reasonable period after it closes.
• Payroll, tax, and time records are kept for at least the periods required by law, including at least three years under the Pennsylvania Minimum Wage Act and federal Fair Labor Standards Act recordkeeping rules and at least four years for employment tax records under IRS rules, and longer where prevailing-wage or contract rules require.
• Certification and training records are kept while you work with us and as long as needed to document compliance on projects you worked.
• Precise location data is kept only as long as needed for job matching and to support on-site time records for those records' retention periods; we do not keep a continuous location history.
• Server and security logs are kept by our hosting provider for a limited period under its standard retention practices.

When information is no longer needed, we delete it or make it de-identified. Because legal retention rules may apply, we may not be able to delete applicant records immediately on request (see Your rights).

8. How we protect information

• The Site is served only over encrypted HTTPS (TLS) connections.
• Form submissions are validated and passed directly to our email provider over encrypted connections. Our form functions do not store submissions in a website database.
• Access to submissions is limited to people at One Flagger who need them for business purposes.
• API keys and credentials for our service providers are stored as protected environment settings, not in the Site's code.
• App and Platform data is encrypted in transit, access is limited by role (for example, payroll and tax information is limited to people who process payroll), and sensitive tax and bank information is stored only with providers designed to protect it.

No website, email system, or method of transmission or storage is completely secure, and we cannot guarantee absolute security. Email is delivered to us over encrypted connections where supported, but please avoid including sensitive information in submissions (see Information we collect).

9. Data breach notification

If we discover a breach of the security of a system that results in unauthorized access to and acquisition of your personal information, as defined by law, we will investigate and notify affected individuals without unreasonable delay, as required by the Pennsylvania Breach of Personal Information Notification Act, 73 P.S. § 2301 et seq. (as amended), which covers information such as Social Security numbers, driver's license numbers, financial account numbers with access codes, and online account credentials, and any other applicable state or federal law. Where required, we will also notify the Pennsylvania Office of Attorney General, consumer reporting agencies, or other authorities, and provide any other remedies the law requires.

10. Your rights: access, correction, and deletion

Regardless of where you live, you may ask us to:

• Access the personal information we have about you from the Site, App, or Platform, and learn how we use and share it;
• Correct inaccurate information;
• Delete your information, including a submitted resume; or
• Withdraw a job application or opt out of further contact about openings; or
• Withdraw consent to location access or push notifications at any time in your device settings.

To make a request, email Jery@oneflagger.com or call (570) 213-3867 (office) (English or Spanish). We will verify your identity by matching information you provide with information we already have, and we will respond within 45 days. If we need more time, we will tell you why. We may decline or limit a request where the law allows or requires, for example, when we must keep applicant records for the federal retention periods described above, keep records for a pending legal matter, or protect others' rights. If we keep information for legal reasons, we will limit its use to those reasons and delete it when the period ends. We will not discriminate against you for exercising these rights. You may use an authorized agent if you provide written permission.

11. State privacy rights (including California)

Some states, such as California (the California Consumer Privacy Act, as amended), Virginia, Colorado, Connecticut, and others, give residents specific rights over personal information, such as the rights to know, access, correct, delete, and opt out of the sale or sharing of personal information, and to appeal a denied request. Many of these laws apply only to businesses that meet revenue or data-volume thresholds, and they may not apply to One Flagger.

Where a state law does apply, we will honor the rights it provides. In any event, we offer the access, correction, and deletion rights described in Your rights to everyone. In the past 12 months, we have collected the categories of information described in Information we collect (identifiers, contact details, professional or employment-related information, and internet or network activity data) from you and your devices, for the purposes in How we use your information, and disclosed them only to the recipients in How we share information. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would require offering a right to limit. If we deny your request, you may appeal by replying to our response with "Appeal" in the subject line, and we will respond as required by applicable law.

12. Children's privacy (no one under 18)

The Site, App, and Platform are intended for businesses, government agencies, and adults. No one under 18 may create an App or Platform account or apply to work through the App. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). If you believe a child under 13, or anyone under 18 through the App, has submitted information to us, contact us and we will delete it. Field traffic-control positions are also subject to minimum-age requirements under federal and Pennsylvania child labor laws.

13. Spanish-language assistance

Tenemos personal que habla inglés y español. Si tiene preguntas sobre esta Política de Privacidad, desea ver, corregir o eliminar su información, o necesita ayuda en español, llámenos al (570) 213-3867 o escriba a Jery@oneflagger.com. Si hay alguna diferencia entre una traducción y la versión en inglés, la versión en inglés prevalece.

14. Changes to this policy

We may update this Privacy Policy from time to time, for example, when we launch new App or Platform features, change service providers, or if the law changes. We will post the updated policy on this page with a new "Last updated" date. If we make material changes, such as adding analytics or using information in a materially different way, we will provide notice on the Site before the change takes effect.

15. Contact us

Questions, requests, or complaints about this Privacy Policy or our handling of personal information can be sent to: