Authority All Access (AAA) Privacy Notice

Version 1.0. Effective Monday, October 19, 2026.

Authority All Access ("AAA") is a system owned and operated by Fireplace and Chimney Authority, Inc., an Illinois corporation ("FPCA"). This Privacy Notice explains what information about you AAA collects, why it is collected, who can see it, how long it is kept, how it is protected, and what rights you have. The current version is always available at https://timeclock.fpcail.com/privacy, and this version is kept at https://timeclock.fpcail.com/privacy/v1.0. The Authority All Access (AAA) Terms and Conditions (the "Terms") are available at https://timeclock.fpcail.com/terms.

The Short Version

This summary is here to help you read the Privacy Notice. The full Privacy Notice below controls.

• What AAA collects. Your account details, your PIN and password in protected form, your punches and punch photos, the kiosk tablet's approximate location, network and device information, job photos, documents and receipts you submit, and activity and audit logs.
• Why. To pay you accurately, keep the time records the law requires, confirm who made each punch, run the business, and keep AAA secure.
• No biometrics. Photos do not collect biometric data. There are no fingerprints, face scans, or face analysis of any kind.
• Your phone and vehicle are not tracked. Only the kiosk tablet's location is used. No audio is recorded.
• Who can see time clock data. Only administrators, the Employer's payroll provider (ADP), and the Employer's outside CPA firm may access punch data and punch photos.
• How long it is kept. Punch photos are deleted after 90 days. Punch, pay, and audit records are kept for 3 years.
• No sale of your data. Neither FPCA nor your Employer sells your personal information.
• Company systems may be monitored. Your personal accounts are not.
• You can see your records. Ask Adam McMahon at adam@authorityhearth.com or 630-279-8500.

1. Who This Notice Covers and Who Is Responsible

1.1 Owner and operator. AAA is owned and operated by FPCA. AAA is a product of FPCA. It is not a separate company.

1.2 Your Employer. In this Privacy Notice, "Employer" has the same meaning as in the Terms: the company that employs you, which is FPCA or one of the affiliated companies of Fireplace and Chimney Authority. Your Employer is responsible for your pay, your timekeeping records, and your personnel records. FPCA operates the AAA system on your Employer's behalf.

1.3 Who this notice covers. This Privacy Notice covers information about current and former employees of FPCA and of the affiliated companies of Fireplace and Chimney Authority who use AAA. AAA users work in Illinois.

1.4 Employees of affiliated companies. If your Employer is one of the affiliated companies of Fireplace and Chimney Authority, you use only the AAA time clock, and only the time clock parts of this Privacy Notice apply to you. Your time clock records are kept separate from FPCA's records. Payroll reports for your Employer go only to the people who handle your Employer's payroll, and they never include another company's employee data.

1.5 What AAA includes. This Privacy Notice applies to every part of AAA described in Section 1.4 of the Terms: the employee portal and dashboard, the field scheduler, the estimate tools and product catalog, the time clock at timeclock.fpcail.com (including the kiosk and the administrator dashboard), the job photos app, the Document Submission Form, and the links in AAA that open the Operations Center.

1.6 Customer information. AAA also holds information about the Employer's customers, such as names, addresses, phone numbers, job notes, and photos of customer homes. That information is confidential and is handled as described in Section 11 of the Terms. This Privacy Notice covers information about you as an employee.

2. Information AAA Collects

2.1 Account details. Your name, employee ID, Employer, department, job role, company email address, AAA access role (for example, employee, kiosk user, or administrator), work schedule, pay type, and pay rate. Your Employer enters most of this information when your account is set up.

2.2 PIN and password. Your time clock PIN and, if you sign in to AAA with a password, your password. AAA stores PINs and passwords in hashed form, which means they are scrambled in a way that is designed not to be reversed.

2.3 Punch records and time records. Each punch, including the action you selected (such as punch in, start lunch, end lunch, or punch out) and the date and time. The time comes from the AAA server, not from the tablet's clock. Time records also include PTO, sales calls, holidays, corrections and the notes explaining them, and lunch approvals.

2.4 Punch photos. An ordinary photo taken by the kiosk tablet's camera during a short countdown at each punch. If the camera fails, the punch is still recorded and an administrator is notified. Punch photos are described further in Section 3.

2.5 Approximate kiosk location. The approximate location of the kiosk tablet at the time of a punch or kiosk sign-in, as reported by the tablet's browser. This includes how accurate the reading is and its distance from the approved Company location. It is used to confirm that the punch was made at an approved Company location, sometimes called a geofence. Only the kiosk tablet's location is used.

2.6 Network, device, and browser information. The network (IP) address of the device used to reach AAA, the general location of that network, the kiosk session, and device and browser information, such as the type of browser and operating system. AAA uses this information for security, including to block access from networks outside the expected area.

2.7 Job photos. If you use the job photos app, the photos you upload and the job details you enter with them, such as your name, the job date, the customer, the city, and the job type. Photos you upload through the job photos app or the Document Submission Form may include information your phone's camera adds automatically, such as the date and location the photo was taken. You can control this in your phone's camera settings.

2.8 Document Submission Form documents and receipts. If you use the Document Submission Form, the expense receipts and other documents you submit, such as job photos, notes, job instructions, and other job documents, the information you enter with them (such as the vendor on a receipt), and your name, which is added to the file title.

2.9 Activity and audit logs. Records of activity in AAA, such as sign-ins, failed sign-in and PIN attempts, sign-outs, changes made to records and who made them, alerts, and the records you create in the portal, scheduler, and estimate tools.

2.10 Acceptance records. When you accept or decline the Terms, AAA records your name or employee ID, the version you were shown, a digital checksum that identifies the exact text of that version, the date and time, where you accepted, and the device and network information of the device used.

2.11 Messages and alerts. Email alerts the time clock sends to administrators, such as alerts about late punches, a punch out without a punch in, camera failures, and attempts to punch from outside an approved Company location, and the nightly summary of those alerts.

3. No Biometric Data

3.1 Photos do not collect biometric data.

3.2 AAA and the time clock do not collect, capture, store, use, or share biometric identifiers or biometric information. There are no fingerprints, no face scans, no face geometry, no face recognition or face matching, no face analysis of any kind, no iris or retina scans, no voiceprints, and no hand scans.

3.3 Punch photos are ordinary photographs. They are not analyzed by any software. They are used only so that a person can look at them to confirm who made a punch and to look into time clock problems. Punch photos are never used for marketing.

3.4 If the Employer ever decides to collect biometric identifiers or biometric information, it will first publish a written retention and destruction policy, give you written notice of what will be collected, why, and for how long, and obtain your separate written release, as required by the Illinois Biometric Information Privacy Act. That would be done in a separate document, not through a change to this Privacy Notice or the Terms.

4. What AAA Does Not Collect

• Your personal phone's location is not tracked by the time clock. Only the kiosk tablet's location is used.
• Your vehicle is not tracked.
• No audio is recorded by the time clock or any other part of AAA.
• No biometric data is collected.
• The Employer does not install device management software on your personal phone and does not track your phone's location.
• The Employer will not access your personal content, such as personal photos, messages, or accounts.
• The Employer will never ask you for the username, password, or other access to your personal online accounts.

5. Why the Information Is Collected

The Employer and FPCA use the information described in Section 2 to:

• record your time and pay you accurately for all time you actually work;
• keep the time and pay records required by the Illinois Minimum Wage Law, the federal Fair Labor Standards Act, and other laws;
• confirm that each punch was made by the right person at an approved Company location, and prevent one person from punching for another;
• run payroll through ADP and support accounting, tax, and audit work by the Employer's outside CPA firm;
• schedule work, prepare estimates, document jobs, and run the Employer's business;
• process documents and receipts, including reimbursement of expenses under Section 13.4 of the Terms;
• keep AAA, company accounts, and customer and employee information secure, and investigate suspected misuse;
• keep a record of who accepted the Terms and which version they accepted;
• respond to your requests, including requests for your records; and
• comply with the law and respond to legal process.

AAA information is not used for advertising. The Employer does not use artificial intelligence to make or assist with decisions about hiring, discipline, discharge, promotion, scheduling, pay, or any other term or condition of employment (see Section 13).

6. Who Can See Your Information

6.1 Time clock data. Only the following may access punch data and punch photos:

• Administrators. Administrators are the owners and the people your Employer has authorized to manage the time clock. Each administrator can see only the companies they are authorized to manage.
• The Employer's payroll provider. Your Employer uses ADP to process payroll.
• The Employer's outside CPA firm. The Employer's accounting firm may access this data for accounting, tax, and audit purposes.

6.2 Other AAA information. Other information in AAA is available as follows:

• Portal, scheduler, and estimate records are available to employees and administrators whose AAA role allows it.
• Job photos are available to employees and administrators who need them for work. Job photos may be used by your Employer for business and marketing purposes, in a way that respects customer privacy, as described in Section 15 of the Terms.
• Expense receipts submitted through the Document Submission Form are available only to the owner, Adam McMahon, and the Employer's designated accounting administrator.
• All other Document Submission Form documents, such as job photos, notes, job instructions, and other job documents, are stored in job folders. Administrators and office employees with access to those job folders can see them. Documents you submit include your name in the file title.

6.3 Service providers. AAA runs on technology service providers that host, store, secure, and deliver AAA and its data on the Employer's behalf. They may access data only as needed to provide those services.

6.4 Legal requirements. The Employer may also disclose information when required by law, subpoena, or court order, or to a government agency with authority to request it.

6.5 Rules for administrators and supervisors. Anyone with administrator or supervisor access in AAA must follow Section 16.4 of the Terms. Among other things, they may access employee information, including pay rates and punch photos, only as needed for their job and only for the companies they are authorized to manage, and must keep pay data, punch photos, and personal information confidential.

7. No Sale of Personal Information

Neither FPCA nor your Employer sells your personal information. Neither FPCA nor your Employer shares your personal information with anyone for their own advertising or marketing. Your personal information is shared only as described in Section 6.

8. Monitoring of Company Systems

8.1 Company systems may be monitored. The Employer may monitor, log, review, and keep records of activity on all company systems, accounts, and devices for legitimate business purposes. This includes AAA, company email and other company accounts (including @fpcail.com accounts), company files and shared folders, and company-owned devices. Business purposes include security, payroll accuracy, compliance with law, investigations, and protecting customer and company information.

8.2 No expectation of privacy on company systems. You should not expect privacy in anything you create, send, receive, or store using company systems or accounts.

8.3 What is not monitored. The Employer does not monitor your personal accounts or the personal content on your personal phone. The Employer does not gather or keep records of your associations, political activities, or non-employment activities, except as permitted by the Illinois Personnel Record Review Act. Nothing in this Privacy Notice or the Terms limits your lawful off-duty use of lawful products.

8.4 Cookies and browser storage. AAA uses cookies and similar browser storage to keep you signed in, remember your settings, and secure your session. Service providers that host parts of AAA may use cookies needed to operate their services. AAA does not use cookies to show you advertising.

9. How Long Information Is Kept

9.1 Retention periods.

• Punch photos are deleted 90 days after the punch.
• Punch records, pay records, and the time clock audit log are kept for 3 years after the end of the pay period they relate to, and then deleted.
• Acceptance records are kept for the length of your employment plus 3 years.
• Other records in AAA, including account details, job photos, Document Submission Form documents and receipts, and other activity logs, are kept according to your Employer's record retention practices and applicable law.

9.2 Longer retention when required. Any of these records may be kept longer when the law requires it or when the Employer must preserve them for an investigation, legal claim, or government inquiry. In that case, they are deleted when the requirement ends.

9.3 When your employment ends. Your access to AAA ends when your employment ends. Records about you are then kept and deleted on the schedule in Section 9.1.

10. How Information Is Protected

10.1 The Employer and FPCA use reasonable security measures to protect personal information in AAA, as required by the Illinois Personal Information Protection Act. These measures include:

• encrypted connections whenever information is sent between your device and AAA;
• PINs and passwords stored in hashed form;
• access limited by role, with each administrator limited to the companies they are authorized to manage, and those limits checked by the AAA server;
• temporary lockouts after repeated wrong PINs or passwords, and automatic sign-out after inactivity;
• punch photos kept in private storage that is not publicly accessible;
• audit logs that record changes to time records and who made them; and
• service providers that are permitted to access data only as needed to provide their services.

10.2 Your part. You help protect your information and other people's information by following Section 5 of the Terms. Use only your own account and PIN, never share your PIN or password, and tell Adam McMahon right away if you think someone else knows your PIN or password, if a device you use for work is lost or stolen, or if you see anything that looks like unauthorized access.

10.3 No system is perfectly secure. No security measure can guarantee that information will never be accessed without authorization. If that happens, the Employer will follow Section 11.

11. Data Breach Notice

11.1 If a security breach involves your personal information, the Employer will notify you as required by the Illinois Personal Information Protection Act. Notice will be given in the most expedient time possible and without unreasonable delay, except where a delay is needed for a law enforcement investigation or to determine the scope of the breach and restore the reasonable integrity of the system.

11.2 The notice will include the information that law requires, including contact information for the major consumer reporting agencies and the Federal Trade Commission and information about fraud alerts and security freezes.

11.3 If a single breach affects more than 500 Illinois residents, the Employer will also notify the Illinois Attorney General as that law requires.

12. Your Rights to Your Records

12.1 Your personnel records. Punch history, time corrections and their notes, and punch photos tied to you may be part of your personnel records.

12.2 Inspecting and copying your records. Under the Illinois Personnel Record Review Act, you may ask to inspect or receive a copy of your time records and personnel records by sending a written or emailed request to Adam McMahon at adam@authorityhearth.com. You may do this at least twice in each calendar year. This right also applies to former employees who were separated within the past year and to employees on layoff with recall rights or on leave with the right to return.

12.3 Response time and cost. Your Employer will respond within 7 working days after receiving your request. If your Employer cannot meet that deadline despite good faith efforts, it may take up to 7 more working days and will tell you. If you ask for copies, your Employer may charge only the actual cost of duplicating them.

12.4 Disagreeing with a record. If you believe a record is wrong, you may ask Adam McMahon to review it at any time. If you and your Employer cannot agree on removing or correcting the information, you may submit a written statement explaining your position, and it will be kept with the record, as the Illinois Personnel Record Review Act provides.

12.5 Your time records. If you believe your recorded time is wrong for any reason, report it right away as described in Section 6.5 of the Terms. All time you actually work will be paid as required by law.

13. Use of Artificial Intelligence

13.1 The Employer does not use artificial intelligence to make or assist with decisions about hiring, discipline, discharge, promotion, scheduling, pay, or any other term or condition of employment.

13.2 If the Employer decides to use artificial intelligence for any of those purposes, it will give you notice before that use begins, as required by the Illinois Human Rights Act.

14. How This Notice Relates to Other Documents

14.1 This Privacy Notice describes how information in AAA is handled. It is not a contract of employment, does not change at-will employment, and does not create any contractual right to a particular job, schedule, pay rate, benefit, or disciplinary process. Statements in this Privacy Notice about how AAA works and how data is handled describe the Employer's current practices and are accurate as of the effective date.

14.2 This Privacy Notice and the Terms are meant to be read together. Your Employer's timekeeping and pay rules are set by the Employer's Employee Handbook and Workplace Policies and other written policies, as described in Section 3 of the Terms. If anything in this Privacy Notice appears to conflict with applicable law, the law controls.

14.3 Nothing in this Privacy Notice limits your rights described in Section 12 of the Terms, including your right to discuss your wages, hours, and working conditions and to report possible violations of law to a government agency.

15. Changes to This Notice

15.1 Versions. Each version of this Privacy Notice has a version number and an effective date. A published version is never edited. Changes are made by publishing a new version. Earlier versions are kept and remain available at https://timeclock.fpcail.com/privacy followed by the version number, for example https://timeclock.fpcail.com/privacy/v1.0.

15.2 Material changes. If the Employer makes a material change to this Privacy Notice, such as collecting a new type of information, using information for a new purpose, sharing it with a new type of recipient, or shortening a retention period stated here, you will be notified at your next sign-in or PIN entry with a summary of what changed and a link to the new version. Where practical, the Employer will also give advance notice by email to your company email address or by notice in AAA. A material change applies only to information collected after the change takes effect, unless you agree otherwise or the law requires it.

15.3 Non-material changes. Changes that do not affect how your information is collected, used, shared, or kept, such as fixing typos, improving formatting, or updating a web address, may be published as a new version without separate notice. They are posted at the current Privacy Notice address.

15.4 Change of web address. The Employer plans to move AAA, including this Privacy Notice, to aaa.fpcail.com. When that happens, the Employer will give notice in AAA, and the same Privacy Notice will be available at https://aaa.fpcail.com/privacy, with earlier versions at the same path followed by the version number. Moving the address alone is a non-material change.

15.5 Biometrics. A change to this Privacy Notice will never be used to begin collecting biometric data. Any such collection would require the separate written notice and release described in Section 3.4.

16. Help and Contact

16.1 Help reading this notice. If you would like help reading or understanding this Privacy Notice, or a translation into another language, contact Adam McMahon. If you need a disability-related accommodation to use AAA or to review this Privacy Notice, contact Adam McMahon.

16.2 Contact. For any question about this Privacy Notice, your information, your records, or a security concern, contact:

Adam McMahon

Email: adam@authorityhearth.com

Phone: 630-279-8500

Authority All Access (AAA) Privacy Notice, Version 1.0, effective October 19, 2026. Owned and operated by Fireplace and Chimney Authority, Inc., an Illinois corporation.