Privacy notice

Last updated: September 10, 2026 (version 2026-09-10). The applicable law is the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) published on March 20, 2025.

This is a translation. The Spanish notice is the governing text.

Who answers for which data

RepseShield is a platform operated by ByShovel LLC, with address at 3916 N Potsdam Ave, PMB 2219, Sioux Falls, South Dakota 57104, United States of America. ByShovel LLC is the controller for the data of the people who use the platform: those who create an account, those who receive an invitation and those who write to us.

For the worker data that companies upload to the platform, the controller is the company that uploads it and ByShovel LLC acts as processor (article 2, section XII of the Law): we handle it on that company's behalf and under this notice, not for our own purposes. This does not depend on any data processing agreement a client company and its provider sign with each other: that document governs the relationship between those two companies, not ours.

Personal data we handle

About the person using the platform: full name, email address, phone number when a company administrator records one, the company they belong to and their role in it, language preference, and technical session data (IP address, access logs and the audit trail of the actions they take inside the platform).

About the workers of the companies that use the platform, uploaded by them: full name, CURP, NSS, RFC, daily contribution base salary, specialization or position, assignments to projects and sites, hires and terminations, training certificates, and payroll CFDIs with their earnings, deductions, periods and payment dates. The site access module also records entries and exits and, when the device supplies it, an approximate location of the scan.

In addition, the documents companies upload (compliance opinions, ICSOE and SISUB acknowledgements, contracts, agreements, IMSS and INFONAVIT acknowledgements, invoices and payment receipts) may contain further personal data we do not control, because whoever issues the document decides what it says.

We do not ask for sensitive personal data as defined in article 2, section VI of the Law, and the platform uses neither facial recognition nor fingerprints. Workers' financial data (salary, earnings) is handled by their employer, which is the party whose employment relationship with them makes that data necessary.

What we use it for

To create and administer your account and authenticate you through emailed sign-in links; to operate the REPSE compliance file between your company and its counterparties; to classify and review uploaded documents; to compute deadlines, status indicators and reminders; to generate the reports and defense bundles the user company requests; to support you; and to keep the platform and its audit trail secure. We do not use your data for advertising and we do not sell it.

Automated document review

The platform submits uploaded PDF and image documents to an automated review by language models: to classify which document it is and what date it states, to check whether a contract contains the clauses article 14 of the Federal Labor Law (Ley Federal del Trabajo) requires, to review monthly evidence and training certificates, and for the proof-of-service analysis. The full content of the file, including any personal data it contains, is sent for that purpose through OpenRouter, Inc., which delivers it to the provider of the chosen model: Anthropic PBC (Claude models) or Google LLC (Gemini models). If the user company registers its own Anthropic or OpenRouter key in the platform, its documents are sent on that key, under its own contract with that provider. Transcription of the voice notes the founders send to the internal assistant also uses OpenRouter, with a Google model.

Spreadsheet and CSV files are stored for a person to read and are not sent to any model. No decision with legal effects is taken solely by automated means: the model's output is a signal that a person at the user company reviews and accepts or rejects, and it is recorded with the model, the prompt version and the date. Under article 26, section II of the Law, you may object to your data being processed by automated means when that produces unwanted legal effects for you or significantly affects your interests.

Who sees what inside the platform

A document is uploaded once and is visible to the company that uploaded it and to the counterparty of each relationship in which that company shares it. A provider serving several clients does not expose one client's documents to another: each client sees the document only through its own relationship. A company that is not a direct counterparty never sees the file. When a relationship ends, the counterparty's access is bounded to the recorded termination date.

The user company can generate a defense bundle for an inspection and CSV exports, and can issue keys for a query interface for its own system. Those files may include workers' names, CURPs and payroll receipts, and they are under the control of the company that generates them from the moment it downloads them.

Processors and transfers

To run the platform we use providers that handle data on our behalf: Supabase (database and document storage), Fly.io (application hosting), Cloudflare (network and site protection), Mailgun (sending and receiving email), OpenRouter, Inc. (routing of the automated document review and transcription of internal voice notes), Anthropic PBC and Google LLC (the models that perform that review) and Telegram (the founders' internal assistant). Beyond these processors we do not transfer your personal data to third parties, except by legal obligation or a competent authority's order.

The application and the database are hosted in the United States. The other processors operate global networks and may handle the data from other locations; we do not guarantee that processing happens in one country only.

Retention

The platform does not delete documents on its own. When a company archives a document it stops counting toward its current file, but the record is kept, because it is the evidence of what was on file on each date. The audit trail is never edited or erased.

We keep the information for as long as the relationship with the user company lasts and afterwards for as long as the legal retention periods run: five years for payroll records (article 15, section II of the Social Security Law (Ley del Seguro Social), and article 8 of the Regulation on Mandatory Social Security for Construction Workers (Reglamento del Seguro Social Obligatorio para los Trabajadores de la Construcción)) and five years for tax documentation (article 30 of the Federal Tax Code (Código Fiscal de la Federación)). After that period, deletion proceeds under article 10 of the Law, with the prior blocking article 24 requires. Each user company can review this and give instructions on it from its company's Personal data section.

One exception runs by itself: the approximate location recorded when a badge is scanned at a site is erased after twelve months, without touching the entry or exit record.

Security

We maintain administrative, technical and physical measures to protect personal data against damage, loss, alteration, destruction or unauthorized access, as article 18 of the Law requires: encryption in transit, access by authenticated session and by role, separation of each company's information in every query, and an audit trail of the actions taken. Everyone involved in the processing is bound to confidentiality, including after their relationship with us ends (article 20).

If a security breach occurs that significantly affects your financial or moral rights, we will inform you immediately so that you can take measures, under article 19 of the Law. When the breach affects worker data uploaded by a user company, we will inform that company, which is the controller toward those people.

ARCO rights and withdrawal of consent

You may exercise your rights of access, rectification, cancellation and objection (ARCO), and withdraw your consent or limit the use or disclosure of your data, by writing to hello@repseshield.com. Include your name and a means to receive notices, a document proving your identity or the capacity in which you act, and a description of the data and of the right you want to exercise (article 28 of the Law). We will communicate our determination within a maximum of twenty working days from the date we receive the request and, if it is granted, make it effective within the following fifteen working days; both periods may be extended once by an equal period when the case justifies it, and we will tell you if that happens. Exercising these rights is free, except for the reproduction or delivery costs article 34 contemplates.

If the data you want to act on was uploaded by a company as part of its file, we will route your request to that company, which is the controller of that data, and we will tell you where we routed it. In that case we do not decide on its behalf.

If you believe your right was not honored, you may go to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Government), the authority the 2025 Law designates for the protection of personal data held by private parties.

Cookies

The platform uses only essential cookies: the session cookie that keeps you signed in, and the one that stores your language preference. We use no advertising or tracking cookies.

Changes to this notice

We may update this notice. Each version is published on this page with its date, and relevant changes are announced inside the platform to account holders, as article 15, section VI of the Law requires.