Privacy Policy

1. Who this policy covers

This policy explains how Safetrac Software, Inc(“Safetrac”, “we”, “us”) handles personal information. It applies to:

• visitors to safetrac.io;
• people at our customer organisations who administer a Safetrac account;
• security officers and other staff who use the Safetrac mobile app because their employer requires it;
• people whose information is captured in reports submitted through Safetrac — for example someone photographed during a patrol.

Safetrac is offered in the United States and is intended for use by organisations operating there. It does not cover the practices of any other company; our customers, and any third-party site or service you reach through ours, have their own policies.

2. Our two roles: when we decide, and when your employer decides

This distinction determines who you go to about your information, so it is worth understanding.

Where we are the business

For our website visitors, prospective customers, billing contacts and our own personnel, we decide what is collected and why. This policy governs that information in full, and you can exercise your rights directly with us.

Where we are a service provider

For everything submitted through the Safetrac platform by a customer organisation — guard locations, patrol records, checkpoint scans, reports, photographs, audio — the customer is the business and Safetrac processes it only on their documented instructions, under a written agreement.

In that role we do not, and are contractually prohibited from:

• selling or sharing that information;
• using it for our own commercial purposes, including advertising or profiling;
• combining it with information from other sources except as permitted by law to provide the service;
• disclosing it outside the direct business relationship.

If you are a guard and want your data corrected or deleted, your employer controls that decision. See section 14.

3. Location, photographs and audio

Audio recording and the consent of others. Some jurisdictions, California among them, require the consent of every party to a confidential communication before it may be recorded. If your employer has enabled audio capture, you are responsible for using it lawfully: do not record a conversation without the knowledge and consent of everyone taking part, and follow your employer’s instructions and local law. Safetrac provides the capability; the decision to enable it and the manner of its use rest with your employer and with you.

If you do not consent.You may uninstall the app using the standard process for your device or app marketplace. We recognise this is not a meaningful choice if your employer requires the app for your job — in that situation the decision is your employer’s, and you should raise it with them. We will support any lawful instruction they give us.

4. Information we collect

From the mobile app

• precise GPS location, recorded continuously while on shift;
• date and time stamped photographs you capture;
• voice audio recordings, where enabled by your employer;
• text notes and messages you write within a report or issue;
• checkpoint scans, with time and location;
• device information — unique device identifier, device phone number, make and model, operating system version;
• your user account name and how you use the app.

From customer administrators

• name, work email, telephone number, job title;
• account credentials;
• billing contact and payment details, handled by our payment processor — we do not store full card numbers;
• the property, post and patrol configurations you create.

From website visitors

• information you submit through forms — name, company, email, telephone;
• IP address, browser and device type, pages viewed, referring page, and approximate location derived from IP;
• cookie and similar identifiers — see section 18.

About third parties appearing in reports

Reports submitted by guards may contain information about other people, including photographs. That information is collected at our customer’s direction and under their responsibility. If you believe a report contains your information, contact the security company operating at the location; we will assist them in responding.

5. Sensitive personal information

California law and several other state laws treat some categories as sensitive. We collect the following:

• precise geolocation, continuously during shifts;
• the contents of audio recordings, where your employer has enabled that feature;
• account credentials permitting access to an account.

We use sensitive personal information only to provide the service our customer has asked for, to keep it secure, and as otherwise permitted without a right to limit under applicable law. We do not use it to infer characteristics about you, and we do not sell or share it.

6. How we use information

• to deliver the service — live tracking, reports, alerts, portal access;
• to generate Daily Activity Reports and incident reports and deliver them to the recipients our customer designates;
• to run the AI report-writing feature, which sends report text you write to Anthropic to be rewritten and returned — see section 7;
• to authenticate users and secure accounts;
• to provide support, and to communicate about the service;
• to bill customers and manage accounts;
• to maintain, debug and improve the product, using aggregated or de-identified data wherever it will serve;
• to detect and prevent fraud, abuse and security incidents;
• to comply with law and to establish, exercise or defend legal claims.

We do not use personal information for advertising, and we do not build advertising profiles.

7. When we disclose information

To the customer organisation

Information collected through the platform is disclosed to the customer organisation whose account it belongs to, and to the recipients that organisation designates — which may include its own clients, property owners and managers. Your employer’s system administrator controls who has access.

To our subprocessors

We use vendors to operate the service. Each is bound by contract to process personal information only on our instructions and to protect it.

We additionally use vendors for application hosting, email delivery, SMS delivery and payment processing. The complete and current subprocessor list is available on request from support@safetrac.io.

For legal reasons

We may disclose information where we believe in good faith that it is required by subpoena, court order, or other legal process, or where necessary to protect the rights, property or safety of Safetrac, our customers or the public. Where we act as a service provider and are legally permitted to do so, we will notify our customer before disclosing their data, so they may seek protective relief.

Business transfers

If Safetrac is involved in a merger, acquisition, financing, sale of assets, or insolvency, personal information may be transferred as part of that transaction. We will require the recipient to honour this policy, and will give notice before your information becomes subject to a materially different policy.

8. We do not sell or share your personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by California law. We have not done so in the preceding twelve months, including for anyone under 16.

We honour the Global Privacy Control (GPC) and similar browser signals as a valid opt-out request for the browser that sends them.

9. How long we keep information

We keep personal information only as long as needed for the purpose it was collected, or as required by law. Where we act as a service provider, our customer sets the retention period within the limits below and can delete data at any time.

We do not retain location data indefinitely. When we dispose of personal information we use commercially reasonable measures to erase it or render it unreadable. We may retain information longer where a legal hold, dispute or regulatory obligation requires it, and only for as long as that requires.

10. Security

We maintain administrative, technical and physical safeguards designed to protect personal information, including encryption in transit using TLS, encryption at rest, access controls limiting internal access to personnel who need it, logging, and regular review of our practices.

No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential and for notifying us promptly of any unauthorised use of your account.

To report a security vulnerability, email support@safetrac.iowith “Security” in the subject line. We will acknowledge and investigate, and we will not pursue action against good-faith research conducted without harming users or data.

11. California privacy rights

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the rights below. These apply to information for which we are the business; where we are a service provider, direct your request to the customer organisation and we will assist them.

• Know the categories and specific pieces of personal information we have collected, the sources, our purposes, and the categories of recipients.
• Delete personal information we collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing. We do neither, so there is nothing to opt out of — but the right stands.
• Limit the use of sensitive personal information. We use it only for permitted purposes such as providing the service and keeping it secure.
• Non-discrimination. We will not deny service, charge a different price, or provide a different quality of service because you exercised a right.

Categories collected in the last twelve months

California’s “Shine the Light” law also permits residents to request details of personal information disclosed to third parties for their own direct marketing. We make no such disclosures.

12. Other US state privacy rights

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire and New Jersey — have comparable rights to access, correct, delete and obtain a portable copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising, sale, or profiling that produces legal or similarly significant effects.

Several of these laws classify precise geolocation as sensitive data requiring opt-in consent. Where that applies, the customer organisation deploying Safetrac is responsible for obtaining that consent from its personnel; we process the data on their instruction.

If we decline your request you may appeal by replying to our response or writing to support@safetrac.iowith “Appeal” in the subject line. We will respond within the period your state’s law allows.

13. How to exercise your rights

Email support@safetrac.io or write to the address in section 20, describing the right you wish to exercise.

• Verification. We will take reasonable steps to confirm your identity before acting, which may mean asking you to confirm details we already hold. We will not use that information for anything else.
• Authorised agents. An agent may submit a request with written permission signed by you; we may still ask you to verify your identity directly.
• Timing. We aim to acknowledge within 10 business days and respond within 45 calendar days, extendable once by a further 45 days where reasonably necessary, and will tell you if we need the extension.
• Cost. Free, unless a request is manifestly unfounded or excessive, in which case we will explain before charging anything.

14. If you are a security guard using Safetrac at work

Your employer decides what Safetrac records about you, who sees it, and how long it is kept. We hold that information on their behalf and cannot change or delete it without their instruction.

So:

• To see, correct or delete your data, ask your employer. They can act directly in the platform.
• If you contact us instead, we will forward your request to your employer and help them respond, but we cannot decide it ourselves.
• To question whether the monitoring itself is appropriate or lawful, raise it with your employer — that is their decision, not ours.

Nothing in this policy limits any right you have under employment or labour law, and we will not retaliate against anyone who raises a privacy concern with us.

15. Children

Safetrac is a workplace product and is not directed at children. We do not knowingly collect personal information from anyone under 16. We do not sell or share the personal information of anyone under 16 under any circumstances. If you believe a child has provided us information, contact support@safetrac.io and we will delete it.

16. Where we process information

Safetrac is based in the United States and we and our subprocessors process personal information there. The service is offered to organisations operating in the United States and is not directed at individuals in the United Kingdom or the European Economic Area. If you access Safetrac from outside the United States, your information will be transferred to and processed in the United States, where data protection law may differ from the law of your own country.

17. Data breach notification

If we determine that unencrypted personal information has been acquired by an unauthorised person, we will notify affected individuals and, where required, regulators, in the most expedient time possible and without unreasonable delay, consistent with the needs of law enforcement and any measures necessary to restore the integrity of our systems. Where we act as a service provider, we will notify the affected customer without undue delay so they can meet their own obligations.

18. Cookies and website analytics

safetrac.io uses cookies and similar technologies that are strictly necessary for the site to function, and analytics cookies that help us understand how the site is used. We do not use advertising or cross-site tracking cookies.

Most browsers let you refuse or delete cookies; the site will still work, though some preferences may not persist. We honour Global Privacy Control signals as described in section 8.

19. Changes to this policy

This policy has been in effect since July 1, 2024. We revise it from time to time; the version dated July 30, 2026supersedes all previous versions from that date, and the “Last updated” date at the top always reflects the current revision.

If a change materially affects how we handle personal information for which we are the business, we will give notice — by email or in-product — before it takes effect, and where the law requires it we will obtain your consent. Continuing to use Safetrac after a change takes effect means the updated policy applies. Previous versions are available on request.

20. How to contact us

For any privacy question, request or complaint, including a belief that we have not complied with this policy, contact our privacy agent. Please describe the issue in as much detail as you can, and we will investigate and respond.

See also our Contact & Support page, or manage your account at mysafetrac.app.