Privacy Policy

At InstaNotified, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including the web dashboard and Employee Mobile App.

1. Information We Collect

Information You Provide

We collect information you provide directly, including:

• Name, email address, and phone number
• Company name and business information
• Billing and payment information
• Employee information you upload to our platform
• Incident reports and inspection notes submitted through the Employee App
• Time and attendance records (clock-in/out times)
• Communication preferences

Automatically Collected Information

When you use our platform, we automatically collect:

• Device information (browser type, operating system, device identifiers)
• Usage data (pages viewed, features used, time spent)
• IP address and general location data
• App version and crash reports (Employee Mobile App)
• Push notification tokens for message delivery

Location Data (Employee Mobile App)

With your consent, we collect location data from the Employee Mobile App for:

• Real-Time Monitoring: Your employer can view your location in real-time during active shifts for safety and operational management
• Clock-in Verification: To verify you are at your assigned site when clocking in/out (geofencing)
• Inspection Tracking: To record your inspection route and checkpoint visits
• Incident Location: To automatically tag incident reports with location
• Location History: Your employer can review historical location data for shift verification and incident investigation

Important: Location tracking may occur continuously during active shifts when you are clocked in. Your employer has access to real-time location data and historical location records.

You can disable location permissions in your device settings, though this may prevent you from using required work features such as clocking in at geofenced sites. Disabling location may also be a violation of your employer's policies.

NFC & QR Code Scanning Data

When employees scan NFC tags or QR codes at inspection checkpoints, we collect:

• Checkpoint identifier from the scanned tag/code
• Timestamp of the scan
• Location at time of scan (if permitted)
• Any notes or observations entered by the employee

Push Notification Data

To deliver push notifications, we collect and store:

• Device push notification tokens (provided by Apple/Google)
• Notification preferences and settings
• Delivery status and interaction data (opened, dismissed)

2. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our services
• Process transactions and send billing communications
• Send operational notifications (shift reminders, alerts, etc.)
• Provide customer support and respond to inquiries
• Analyze usage patterns to improve user experience
• Detect, prevent, and address security issues
• Comply with legal obligations

Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), we process personal data based on:

• Contract Performance: Processing necessary to provide our services to you
• Legitimate Interests: For security, fraud prevention, and service improvement
• Consent: For optional features like marketing communications and location tracking
• Legal Obligation: When required by law (e.g., tax records, labor law compliance)

3. AI Data Processing

Our platform uses AI technologies for various features:

• Voice Transcription: Voice reports are transcribed using AI and stored as text incident records
• Scheduling Assistance: AI analyzes schedules to suggest optimizations
• No Training on Your Data: We use OpenAI's API which does not use customer data to train models
• Opt-Out Available: Contact support to opt out of AI-powered features

4. Information Sharing

We do not sell your personal information. We may share your information in these circumstances:

• Service Providers: Trusted third parties who assist in operating our platform:
  • Supabase (database hosting)
  • Twilio (SMS/Voice delivery)
  • Stripe (payment processing)
  • OpenAI (AI features)
  • Vercel (web hosting)
  • Expo (push notification delivery)
  • Microsoft Clarity (public-site session replay analytics)
• Within Your Organization: Administrators can see employee data; employees can see their own data
• Legal Requirements: When required by law or to protect our rights and safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Retention

We retain your information as follows:

• Account Data: Retained while your account is active
• Billing Records: Retained for 7 years for tax/legal compliance
• Incident Reports: Retained according to your company's configured retention policy
• Location Data: Real-time location retained for 90 days; historical inspection and clock-in locations retained for 1 year for compliance
• Message Logs: Retained for 1 year for compliance and support purposes
• Time & Attendance: Retained for 7 years per labor law requirements
• Push Notification Tokens: Retained while active; deleted on account removal

After account termination, we delete or anonymize your data within 30 days, except where retention is required by law.

6. Data Security

We implement security measures to protect your data:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Row-Level Security ensuring data isolation between companies
• Secure password hashing (bcrypt)
• Regular security reviews and vulnerability assessments
• Multi-factor authentication available for admin accounts

7. Employee Mobile App Privacy

The InstaNotified Employee App collects and processes:

• Authentication Data: Email, phone number, and secure tokens
• Location (Real-Time): Continuous location tracking during active shifts for employer monitoring, geofencing, and inspection verification (with permission)
• Camera/Photos: Only when attaching photos to incident reports (with permission)
• Push Notifications: For shift reminders and alerts (with permission)
• NFC/Camera for Scanning: Only when scanning inspection checkpoints (with permission)

Employer Access: Your employer (company administrators and managers) can:

• View your real-time location on a map during your shift
• Review your location history and inspection routes
• See your clock-in/out times and locations
• Access incident reports you submit

Employees can view what data has been collected about them by accessing their profile in the app.

8. Cookies and Tracking

We use cookies and similar technologies on our web platform:

Essential Cookies

Required for the platform to function. These cannot be disabled.

• Authentication tokens to keep you logged in
• Session management and security tokens
• User preferences (theme, language)

Analytics Cookies

Help us understand how users interact with our platform. On public marketing pages, we may use session replay analytics (Microsoft Clarity) to capture page interactions such as clicks, scrolling, and navigation patterns. We do not enable session replay on authenticated dashboard, payroll, or admin routes.

• Page views and feature usage
• Performance metrics and error tracking
• Session replay on public, non-authenticated pages only

You can control non-essential cookies through your browser settings. Disabling cookies may affect platform functionality.

Do Not Track

Our platform does not currently respond to "Do Not Track" browser signals. However, we do not engage in cross-site tracking or sell your data to advertisers.

9. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to legal requirements)
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for processing where consent is the legal basis
• Opt-Out: Unsubscribe from marketing communications at any time

To exercise these rights, contact us at privacy@instanotified.com. We will respond within 30 days (or sooner if required by applicable law).

10. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: What personal information is collected, used, and shared
• Right to Delete: Request deletion of personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: Of the sale or sharing of personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

We do not sell or share personal information as defined by the CCPA/CPRA. We do not use sensitive personal information for purposes other than providing our services.

11. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• All rights listed in Section 9 above
• Right to Lodge a Complaint: With your local data protection authority
• Data Controller: CareMinder Inc. is the data controller for personal data processed through our platform
• Data Processing Agreements: We have DPAs in place with our service providers
• International Transfers: Data transferred outside the EEA is protected by Standard Contractual Clauses

For GDPR-related inquiries, contact our Data Protection Officer at dpo@instanotified.com.

12. Children's Privacy

InstaNotified is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn we have collected information from a child, we will delete it promptly. If you believe we have collected information from a child, please contact us at privacy@instanotified.com.

13. International Data Transfers

Your information may be transferred to and processed in the United States where our servers are located. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) for EEA/UK transfers
• Data Processing Agreements with all service providers
• Encryption of data in transit and at rest

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through our platform at least 30 days before they take effect. Your continued use after changes constitutes acceptance of the updated policy. We encourage you to review this policy periodically.