Privacy Policy

People who enroll or are added by an organization:

• name, mobile phone number, and, if provided, email address;
• depending on the product, company, trade, job title, or department;
• emergency contact details: name, phone, email, and relationship;
• notes an organization’s administrators add to your record.

Students and guardians (SafeCampus): the student’s name, graduation year, and homeroom or group; optionally a student phone number and email; and up to two guardians’ names, phone numbers, and email addresses. See “Children and students” below.

Visitors: name, phone number, email, company, who or which student you’re visiting, the day you said you’d visit if you pre-registered, and when you arrived and signed out. If the organization requires it, a photo of you taken when you check in (see “Visitor photos” below).

Alert activity: the messages sent to you, whether they were delivered, your replies (such as SAFE or HELP) and when you replied, and use of the response links in alert emails. If you text in a report, we keep your name, number, and message, along with notes administrators add about how it was handled.

Consent records: when and how you agreed to receive messages and accepted our Terms of Service and this Privacy Policy (which versions, and the wording shown), and when you opted out or back in.

Administrators and integrators: name, email, phone number, sign-in information, a record of actions taken in the Service (audit logs), and push-notification subscriptions on devices where they turn notifications on. When an administrator creates an account, we also keep a record that they accepted our Terms of Service and this Privacy Policy: which versions, the date and time, and the IP address and browser used.

Technical information: when you request a verification code, we record the phone number and your IP address to prevent abuse. We use cookies only to keep administrators signed in. We don’t use advertising or analytics trackers.

• to deliver alerts, all-clear notices, and safety updates by text and email on behalf of your organization;
• to show your organization who has responded, who needs help, and who hasn’t answered;
• to verify your phone number when you enroll and send you a confirmation;
• to notify your organization’s administrators when someone replies HELP or texts in a report;
• to let the person you’re visiting know you’ve pre-registered or arrived, and to show your organization who is on site;
• to keep the records and audit logs your organization relies on after an incident;
• to secure the Service, prevent abuse, and provide support; and
• to meet legal obligations.

We don’t sell personal information, and we don’t use it for advertising.

You receive texts because you, or your organization with your consent, enrolled you. Reply STOP to opt out and START to opt back in. Message and data rates may apply. See the text message program section of our Terms of Service for details.

We do not share mobile phone numbers or text message consent with third parties or affiliates for marketing or promotional purposes. Phone numbers are shared only with the service providers that deliver messages for us, as described below.

SafeCampus information about students is provided by the school or by a parent or guardian, who enrolls together with their child. Alerts about a student go to that student’s guardians. A student’s own phone number or email is optional and is added only by the school or a guardian. We don’t knowingly collect personal information directly from children under 13.

Parents and guardians can review, correct, or delete their child’s information by contacting the school or emailing us at anthony.carvel@axisrecruits.com.

Some organizations require visitors to have their photo taken when they check in, with the tablet camera at the front desk or a selfie on their own phone. You’re told this before the photo is taken.

• Why: so the organization’s staff can recognize who is on site, including during an emergency roll call, and for visitor badges. The organization collects it for the security of its premises (in GDPR terms, its legitimate interests).
• Who sees it: only that organization’s administrators and staff, and the person you’re visiting, who receives it in their arrival email. It is stored privately and is never public.
• How long: photos are deleted automatically 30 days after they’re taken. Links to your photo, including the one in the host’s email, stop working at the same time.
• No face recognition: we don’t analyze photos or use them to identify people automatically.
• You can ask for your photo and visitor records to be deleted sooner; see “Your choices.” The organization decides whether a photo is required; if you don’t want a photo taken, speak to the front desk.

• Your organization and its authorized administrators, and a security integrator the organization works with to set up and support its account.
• Service providers that run parts of the Service for us: Twilio (text messages), Resend (email), Supabase (database and administrator sign-in), Railway (hosting), and browser push services such as those run by Apple, Google, Microsoft, and Mozilla (notifications for administrators who turn them on). They may use the information only to provide their services to us.
• Systems your organization connects. If your organization sets up a webhook, the Service sends alert details (the alert message, who sent or resolved it, the number of recipients, and the site or event name) to the system it chooses. Webhooks don’t include individual recipients’ contact information.
• When required by law, or to protect the safety, rights, or property of any person.
• In a business transfer, such as a merger or acquisition, subject to this policy.

We keep information while your organization uses the Service and as long as it needs the records, for example for incident reports and audit logs. Visitor passes expire after 12 hours, but check-in records remain in your organization’s reports. Visitor photos are deleted after 30 days. Organizations can remove people from their member lists at any time. When an organization stops using the Service, or a valid deletion request is received, we delete or de-identify the information unless we must keep it to meet a legal obligation.

• Stop texts at any time by replying STOP. Alert emails include an unsubscribe link.
• Ask to see, correct, or delete your information by contacting your organization or emailing anthony.carvel@axisrecruits.com. We may need to confirm your identity, and where your organization controls the information, we’ll work with it on your request.

We protect information with encryption in transit, access limited to authorized administrators, automatic sign-out of idle administrator sessions, and signed webhook deliveries. No system is perfectly secure, but we work to protect your information and will notify affected organizations as required by law if a breach occurs.

We may update this policy as the Service changes. We’ll change the date at the top of this page, and for material changes we’ll let organization administrators know.

For privacy questions or deletion requests, email anthony.carvel@axisrecruits.com.

SafeAlert Labs Inc. · Acworth, Georgia