Privacy Policy

Effective date: October 8, 2026. Published by GroupWork LLC · Contact: privacy@groupwork.cloud

NRO Connect (“the app”) is a workplace app for planning new restaurant openings. This policy explains what we collect, why, how long we keep it, who can see it, and the choices you have.

1. Who Is Responsible

NRO Connect is published by GroupWork LLC, a Michigan limited liability company (“we”, “us”), which is the controller responsible for your personal data. It is a workplace app: an organization (a restaurant company) invites its opening teams, and the organization decides who is invited and what roles they hold. For privacy questions, contact privacy@groupwork.cloud, or write to us at 2222 W. Grand River Ave Ste A, Okemos, MI 48864, USA.

Your Sign-In

NRO Connect uses the GroupWork account system — one sign-in shared by the GroupWork family of apps (GroupWork, YourTalentPipeline, WorkKit, Design, Traffic and NRO Connect). When you are invited, the invitation links your existing GroupWork account if you already have one, or you create one.

The person who invited you can see whether your email address already had a GroupWork account (the invite shows as connected at once rather than pending), and accepting the invitation links that account to NRO Connect.

Whoever invites you can also see whether your address can be emailed. If you turned NRO Connect invitations off, or an earlier invitation to your address bounced or was reported as spam, an Admin or Manager at any organization using NRO Connect who tries to invite that address is told it will not be emailed, so they can tell you directly. Invitation emails also show the inviting Admin’s or Manager’s email address as the reply-to address, so a reply reaches them — and whoever receives the invitation, even at a mistyped address, can see that address.

2. What We Collect

• Account: your name, email address and sign-in method.
• Work profile, set by your organization: your role (Admin, NRO Manager, GM Lead or Certified Trainer), your organization and brand, and your certifications.
• Private details: your legal name, a 10-digit pay-card ID, your home store number and District Office, and how many openings you have worked. You can enter them, and so can the Admins and NRO Managers responsible for your brand; only you and they can see them. A GM Lead or CT Lead never sees them — only whether an opening is your first. When your legal name or pay-card ID changes, the change is recorded without the old or new value. NRO Connect pays nothing and records no hours. These details are erased when your account is deleted.
• What you enter: your unavailable dates, travel preferences and notification settings.
• Opening work: offers, your responses, confirmations, assignments, daily schedules and travel reference information (for example flight or hotel details entered for a trip). NRO Connect never books, changes or cancels travel.
• Communication: opening-board posts and private messages.
• Profile photo (optional): if you add a photo to your GroupWork profile, it is stored with Cloudflare Images.
• Audit record: a record of administrative changes, such as who changed a role or removed a person.
• Terms agreement: when you agree to our Terms of Service in any GroupWork app, we record which version you agreed to, in which app, and when. It is kept with your account so another GroupWork app does not ask you again, and it is deleted when you delete your account.
• Device push token: if you allow notifications, your device’s push token is stored so we can deliver them. Push messages go through Expo’s push service and then Apple’s or Google’s. The token is a device identifier, not your content. You can turn notifications off at any time in your device settings.
• Support tickets: tickets you file: your message, your name and email unless you switch them off in the form, any photos or files you attach, and a technical report about the app. Photos are re-saved without their location or camera data before they are sent. The technical report holds:
  • the app version and build, and your device type, operating system, screen size, text size, language and time zone;
  • whether you were online, and over Wi-Fi or mobile data;
  • the names of the screens you visited recently (never the data on them), recent error messages with email addresses and sign-in tokens removed, and the last crash report id;
  • a short list of the app’s most recent requests to our servers (up to 50): for each, which part of the app it touched, whether it succeeded, how long it took and, if it failed, what kind of failure it was. Never a web address, never anything you typed, never the data on your screen. The list is kept on your device and sent only inside a ticket; it covers the app’s previous session as well as the current one (up to 6 hours back), because problems are usually reported after restarting the app;
  • for changes still waiting to send from your device: how many there are and their status codes, never what they say;
  • the last sign-in event and when it happened, never a password or token;
  • if Advanced Analytics (below) is running for you, or ended in the last 15 minutes: its trace id, which links the ticket to that trace.
• Crash and diagnostic data (Sentry): crash reports, performance data and your account id, linked to your account. Sentry also derives an approximate location (city) from the IP address of a report.
• Advanced Analytics (off unless turned on): a short technical trace that NRO Connect’s support team can turn on to troubleshoot a problem you reported. It is off for everyone by default. Your organization’s Admins cannot turn it on.
  • If it is turned on for you: it runs for at most 24 hours, and you see an indicator in the app the whole time, which you can tap to turn it off yourself at once. It records only while you are in the app, for at most 30 minutes each time you open it (a new stretch also starts if support turns it on again), so it happens in short stretches, never continuously. It covers every device you are signed in on.
  • What it records: which part of the app each request touched, whether it worked, how long it took, which screens you visited, whether you were online or offline and over Wi-Fi or mobile data, and, if something failed, what kind of failure it was. It never records the contents of anything: no names, notes, messages, photos or anything you type, and never a picture of your screen.
  • On a support administrator’s own device: they can run the same trace on their own device for up to 24 hours, including while the app is closed. The trace never records a picture of the screen.
  • The trace is linked to your account and stored with our support tools (GroupWork’s shared database). Trace records are deleted after 30 days, and the record that it was turned on for you (who turned it on, when, and until when) is deleted 30 days after it ends.
• Usage data (PostHog, iPhone and Android apps only): when the app is opened, which tabs are opened, the app and device version, and your account id — so it is linked to your account. Never your name or email address. Not collected on a device set to a time zone or region in the EU, the EEA or the UK.
• App activity (every version, including the web app): while the app is open and on screen (even if you are not using it), NRO Connect’s own database notes, about every two minutes, when you were last active, along with when you first used the app and the name on your profile. Only NRO Connect’s own app administrators (the people who run the app, not your organization) can see it, to count how many people use the app. It is collected everywhere, including the EU, the EEA and the UK, and it is erased when your account is deleted.
• Approximate location (from your network, not GPS): we record the country of the network you connect from and, outside the European Union, the rest of the European Economic Area, the UK and Switzerland, also its region, city, network provider and time zone (for example “Katy, Texas · Comcast”). GroupWork’s servers and Cloudflare work it out from your connection — never from your device’s GPS. We record it with each support ticket (including automatic ones) and when you open the app or sign in, keeping at most one record a day, with the latest place that day. From these records NRO Connect’s support team can see where, and at what local time, you last signed in, and an estimated home area worked out from the days you were not travelling for an opening. It is never sold, never used for advertising or to profile you, never shown to other users or to your organization, and never sent to the AI service that sorts support tickets.

3. Why We Use It, and Our Limits

We use this information to run the service (plan openings, send offers, schedules, messages and notifications), keep it secure, fix crashes and answer support tickets.

Approximate location is used only for support and troubleshooting, account security and overall usage statistics (for example, how many people use the app in each country).

No advertising, no selling of personal data, and no profiling for marketing.

4. How Long We Keep It

• Account data: while your account exists.
• Crash data (Sentry): about 30 days.
• Advanced Analytics traces: 30 days. The record that it was turned on for you: 30 days after it ends.
• Usage data (PostHog): up to 7 years.
• App activity: until your account is deleted.
• Approximate location: region, city, network provider and time zone are deleted after 90 days; the country stays with the support ticket or daily record.
• Stopped invitation emails: if you use the “stop invitations” link, or an invitation email to your address bounces or is reported as spam, we keep a one-way scrambled form of the address (a hash, not the address itself) so NRO Connect never sends it another invitation. We keep it until you ask us to remove it at questions@groupwork.cloud.
• Opening records (staffing history, schedules and the audit record): kept by your organization as work records.
• Backups: our daily copy of the database is kept for 30 days and then deleted; OneDrive keeps a deleted copy in its recycle bin for up to 30 more days before erasing it, so copies of a deleted account in backups are gone within a further 60 days.

5. Sharing

Inside Your Organization

• Your organization’s Admins and NRO Managers see staffing, schedules and people data for the brands they manage.
• The GM Lead of an opening sees that opening’s team.
• People on an opening’s team see its board and the published team schedule.
• A CT Lead designation lets that trainer see the team’s travel reference information.
• Private messages are seen by the two people in the conversation. If one of them reports a message, that one message (never the rest of the conversation) is shown to the Admins and NRO Managers of your brand so they can review it. Because only the other person could have reported it, the author may be able to tell who did.
• Reports: you can report a board post or a private message. Leaders who review it see the reported text, who wrote it and how many people reported it, never who reported it. Reports are deleted one year after they are resolved; a leader who removes the content removes its text for everyone (the organization’s change history keeps a copy of a removed board post, as it does for any post a leader removes, and the report itself keeps a copy of the reported text until the report is deleted).
• Blocks: you can block someone. They are not notified, but they will find they can no longer message you. If the person you block is above you, the next level up in your organization, or GroupWork support, is told who blocked whom. Your blocks are deleted with your account.
• Language filter: board posts, messages and notes are checked against a list of offensive words when they are saved, and matching words are masked.
• Profile photos: if your GroupWork account has a profile photo and you are a member of an organization on NRO Connect (your organization can add you by your email address, without any step from you), people in that organization see it beside your name, and you see theirs. Because the GroupWork family shares one account, they can also see it in the other GroupWork-family apps you both use. Remove the photo from your profile to stop sharing it.

Support Tickets

Tickets, with their technical reports and attachments, are read by the GroupWork team that builds the app, to answer them and fix problems. Your organization’s Admins and NRO Managers do not see them.

To help us answer faster, each ticket — its text, category, your account id, the technical report and any photos you attach — is also read by Anthropic’s Claude AI, which sorts the report and drafts an internal summary for us. It receives only the ticket, never your openings, schedules, messages or other content, and never the approximate location described in Section 2, which we store separately where it cannot read it.

Service Providers

We share data only with the providers that help us run the service: Supabase (database and sign-in), Cloudflare (website hosting and delivery, profile photos, and the approximate location of your network), Sentry (crash reports), PostHog (usage data), Anthropic (sorting support tickets), Microsoft OneDrive (our daily database backup), Expo (app updates and push delivery) and, when turned on, an email delivery provider for invitation emails and Apple and Google push services for notifications.

Legal Requirements

We may also share information where the law requires it.

6. Your Rights

• You can see and correct your profile in the app.
• For work records, ask your organization’s Admin.
• You can delete your account in the app — see Delete Your Account. This removes your entire GroupWork login, not just NRO Connect.
• Depending on where you live you may have further rights (access, correction, deletion, objection). Ask at privacy@groupwork.cloud.

7. Children

NRO Connect is a workplace tool for adults. It is not directed to children, and children should not use it.

8. Security

Connections are encrypted (HTTPS). Access to each record is limited by role at the database. The app keeps each account’s unsent changes separate on the device.

Copies kept on your device. So that screens you have opened stay readable without a connection, the app keeps a copy of them on your phone, or in your browser’s storage on the web: your schedule and itinerary, your team’s published schedule, and the boards, messages and notifications you have opened. For Admins and NRO Managers this also includes the Openings and People lists, which show people’s names, roles and email addresses. The copies are kept separately for each account, are protected only as well as the device itself is, and are deleted when you sign out. On a shared computer, sign out when you finish.

9. Changes

This policy may change. The effective date at the top changes with it, and when the change matters we also tell you in the app: “We’ve updated our Privacy Policy.”

10. Contact

Questions or requests: privacy@groupwork.cloud. See also Support.