Review draft — not legal advice. This document is a generated draft pending CWA review by qualified counsel. It is not counsel-reviewed and must not be presented as such. Do not rely on it as a final legal commitment until approved.
Privacy Policy
Last updated: October 2026 (draft)
1. What we collect
Account information (verified email, password — stored hashed, never plaintext), company and billing configuration, employee records, shift and punch records, location evidence captured only at punches, optional punch selfies, messages, attachments, credentials, invoices, and audit records.
2. How location works
GuardTrack requests device geolocation only during Time In and Time Out, with a stated purpose and explicit permission. It does not run background tracking, route history, or collect location from chats or reports. Location is device-reported evidence and can be inaccurate or spoofed.
3. Tenant isolation
Every record and file carries a tenant ID derived from authenticated membership. One tenant cannot read or reference another tenant's clients, guards, sites, conversations, or invoices through guessed IDs, search, nested relationships, realtime, or cached responses.
4. Roles and least privilege
Access is gated by role and capability and enforced at the database, server, storage, export, search, and realtime layers. A guard sees only their own permitted operational timesheet and never invoices, bill rates, earnings summaries, or other employees' private records.
5. Sensitive data
Attachments, signatures, and restricted facility fields are kept out of analytics, application logs, and marketing systems. Public branding assets are separated from private records. We never expose stack traces, inmate information, or attachment links in public errors.
Optional punch selfies are captured without face recognition, biometric matching, or identity-verification claims. Unnecessary EXIF location metadata is stripped where possible while the separate punch location record is preserved.
6. Retention and deletion
Retention of time, signature, invoice, location, selfie, message, and upload records is governed by tenant-approved retention settings. We do not invent universal statutory periods. Legal-hold controls and documented deletion/export workflows apply; pending approval never triggers automatic destruction.
7. No silent data loss
We do not delete records because a user seat is removed or an account downgrades. Soft-deactivation preserves signed records and revokes access; downgrades block new premium operations while retaining authorized historical read and export access.
8. What this draft does not claim
This policy does not claim compliance with any specific legal regime, an uptime guarantee, or cryptographic immutability. A database with an audit trail is not a cryptographically immutable ledger. Final commitments require CWA approval.