Privacy Policy

RapidReady Command — Effective October 12, 2026 · Last updated October 18, 2026 (location when an SOS is pressed; previous versions: October 13, October 12 and October 7, 2026)

This Privacy Policy describes how RapidReady Command ("the Platform," "we," "us," or "our"), operated by RapidReady Dispatch, collects, uses, stores, and protects information about users of this application. By using the Platform, you agree to the practices described in this policy.

Who We Are and Our Two Roles

Who we are. RapidReady Command is operated by RapidReady Dispatch, a California business (San Francisco Bay Area). Privacy contact: nick@rapidreadycommand.com.

When we decide how information is used (we are the "business" / "controller"). For people who visit our website, send us a form, ask for a demo, sign up for a trial, or hold an account for their company, and for the contacts at our customers, RapidReady Dispatch decides why and how the information is used. The sections "Personal Information We Collect as a Business", "Your Privacy Rights", "EU and UK Residents" and "Residents of Other Countries" apply to this information.

When we act for our customers (we are a "service provider" / "processor"). Security companies use RapidReady to run their operations. The information they put into the Platform about their officers, staff, applicants, clients and members of the public (schedules, clock records, location, incident reports and so on) is processed by us on their behalf and under their instructions, as set out in our Data Processing Addendum. The security company is responsible for that information. If you work for one of our customers, see "Location Data of Officers and Other Workers" and "Information We Process for Our Customers" below; requests about that information go to your employer, and we help them answer.

Customer Data Ownership First

All uploaded contracts, post orders, client records, site documentation, billing data, officer records, and operational information remain the property of the customer. RapidReady is a tool you use to run your security operations — we do not own your data.

Our AI Promise

Trust-First AI — your data is still your data

Your customer data belongs to you.

RapidReady does not train global AI models on your company data unless you explicitly choose to participate.

Your data remains private.
Your contracts remain private.
Your schedules remain private.
Your client information remains private.

"We use AI aggressively. We automate aggressively. But your data is still your data."

Three-Tier AI Training Policy

RapidReady uses AI aggressively and automates aggressively — but with a clear, tiered consent model. Here is exactly what we learn, what stays private, and what requires your explicit permission.

1

Private Learning

DEFAULT — no action required

DEFAULT

Customer data stays inside their environment. RapidReady learns their company, contracts, staffing, and operations — but knowledge never leaves that tenant.

✓ WHAT RAPIDREADY LEARNS

Their company structure and organizational hierarchyTheir contracts and client relationshipsTheir staffing patterns and coverage modelsTheir operational procedures and post ordersTheir incident history and compliance requirements

✗ WHAT STAYS PRIVATE

All customer documents (contracts, schedules, payroll)All officer information and personnel recordsAll client lists and client communicationsAll incident data and evidenceAll post orders and site-specific procedures

Hospital A uploads data. RapidReady becomes smarter for Hospital A only. Hospital B sees none of Hospital A's data, patterns, or intelligence.

Your data remains private. Your contracts remain private. Your schedules remain private. Your client information remains private.

2

Anonymous Pattern Learning

OPT-IN — customer explicitly agrees

OPT-IN

Customer explicitly agrees. RapidReady extracts patterns, structures, relationships, and operational models — but never names, contracts, customers, payroll, or personally identifiable data.

✓ WHAT RAPIDREADY LEARNS

Industry-wide operational patterns (e.g. "healthcare facilities typically require 24/7 coverage models")Structural relationships (e.g. "contracts with >50 officers typically have dedicated account managers")Coverage model archetypes (e.g. "mobile patrol companies use 3-shift rotation patterns")Compliance pattern correlations (e.g. "sites with weekly cert audits have 40% fewer incidents")

✗ NEVER EXTRACTED

Company names, client names, officer namesContract terms, rates, financial detailsPayroll information, pay ratesPersonally identifiable information (PII)Site addresses and specific locationsIncident details and evidence

Instead of learning "ABC Hospital requires 24/7 coverage," RapidReady learns "Healthcare facilities typically require 24/7 coverage models." That's much safer.

No names. No contracts. No customers. No payroll. No personally identifiable data. Only patterns and structures.

3

Contribute To Industry Brain

EXPLICIT OPT-IN — very clear permission

OPT-IN

Customer explicitly agrees to contribute anonymized data to the Security Industry Brain. In return they receive industry benchmarks, insights, staffing models, contract intelligence, and best practices.

✓ WHAT RAPIDREADY LEARNS

Anonymized operational metrics for industry benchmarkingAnonymized staffing models and coverage patternsAnonymized contract intelligence and renewal patternsAnonymized compliance and certification trendsAnonymized incident frequency and response patterns

✗ NEVER SHARED

Anything from Tier 1 (all private data stays private)Anything that could re-identify a specific customer, client, or officerContract terms, rates, or financial detailsPayroll informationIncident details or evidence

↔ CUSTOMER RECEIVES

Industry Benchmarks — "Your coverage reliability is 94% vs industry average 87%"Industry Insights — "Companies your size typically staff 1 supervisor per 12 officers"Staffing Models — "Healthcare security programs average 4.2 officers per 24/7 post"Contract Intelligence — "Contracts with quarterly QBRs renew at 91% vs 67% without"Best Practices — "Top-quartile companies audit certifications every 30 days"

A hospital security program contributes anonymized staffing metrics. In return, they see how their coverage reliability compares to similar healthcare security programs nationwide — without anyone seeing their specific data.

Anonymized only. No re-identification possible. Customer receives industry intelligence in return for contributing patterns.

Trust-First AI Policy — Summary

✓ BY DEFAULT

  • Tenant-private learning
  • Customer-owned data
  • No cross-customer training
  • No customer-content sharing

◐ OPTIONAL (OPT-IN)

  • Anonymous pattern learning (opt-in)
  • Industry benchmarking (opt-in)
  • Industry Brain participation (explicit opt-in)

✗ NEVER

  • Train global models on customer data without consent
  • Share customer operational data
  • Share contracts
  • Share client lists
  • Share payroll information
  • Share incident data

Sensitive Industries — Why Default Privacy Matters

In these industries, training on customer data without explicit permission would destroy trust immediately. Many customers will outright refuse. That is why Tier 1 (Private Learning) is the default — no action required, no risk assumed.

HealthcareCritical InfrastructureGovernmentCorporate SecurityData Centers

The Real Training Opportunity

Customer documents (contracts, schedules, payroll) are NOT the biggest training opportunity. User behavior data is.

✓ WHAT WE LEARN (user behavior)

  • What screens users use
  • What information they need
  • What actions they take
  • What recommendations they accept
  • What searches they perform

✗ NOT WHAT WE LEARN (customer content)

  • What contracts they have
  • What their payroll details are
  • What their client lists contain

RapidReady notices Account Managers repeatedly look at Coverage, Staffing, and Client Health before renewals. The system learns. Future version: Renewal Dashboard generated automatically. That's where psychology and AI become powerful together — not because we learned their contract, but because we learned how humans solve problems.

The biggest moat isn't "we secretly train on everyone's data." The bigger moat is: we understand security operations better than anyone else. And you can achieve that through security-industry research, operational models, user-behavior patterns, ontologies, and opt-in anonymized benchmarking — without risking customer trust.

No Customer Data Model Training

RapidReady does not use customer contracts, customer rates, client information, site addresses, post orders, or customer operational data to train third-party AI models.

We do not sell your data. We do not share your data with third-party AI providers for training purposes. Your operational information is never used to improve models that benefit other customers.

Privacy-Preserving Intelligence: The Three-Layer Model

RapidReady uses a three-layer intelligence model to provide operational guidance while protecting customer data. Here is exactly how it works, in plain English:

1

Customer Data

Private to the customer. Never shared. Never sold. Never reused for other customers.

ContractsRatesClient namesAddressesContactsAccess codes
2

Operational Metadata

Anonymized operational patterns — no identifying information.

Apartment CommunityVehicle PatrolPool ChecksNight Coverage
3

Industry Intelligence

Aggregated trends and operational learnings — no customer attribution, no recoverable customer data.

Lockup procedures are common at apartment sitesDe-escalation training is common at healthcare facilities

RapidReady may derive anonymized operational patterns (Layer 2) after personally identifiable information, customer identifiers, locations, rates, contacts, access codes, and sensitive details have been removed. These patterns may be used to improve recommendations, workflows, and operational guidance (Layer 3). No customer-specific data ever leaves Layer 1.

What RapidReady Stores, Never Stores, and Never Trains On

✓ WE STORE (to operate your account)

  • Account information (name, email, role)
  • Operational records you create (patrols, incidents, schedules, timesheets)
  • Documents you upload (contracts, post orders) — for your use only
  • GPS data from clock-in/out and patrol runs (for your operational verification)
  • Media uploads attached to reports

✗ WE NEVER STORE

  • Raw customer documents after anonymized patterns are extracted
  • Customer identifiers attached to extracted operational patterns
  • Access codes, passcodes, or alarm credentials beyond your own account

✗ WE NEVER TRAIN ON

  • Customer contracts or scope-of-work documents
  • Customer billing rates or pricing
  • Client names, addresses, or contact information
  • Site-specific post orders or procedures
  • Officer personal information

Customer Data Promise

If you leave RapidReady, your operational data remains yours.

  • You may export your data at any time.
  • RapidReady will not retain customer-specific operational knowledge for future customer use after your subscription ends.
  • Anonymized operational patterns already contributed to industry intelligence (Layer 3) are not reversible to your identity — they contain no customer attribution.

We reduce vendor lock-in by making your data portable and your exit clean.

Information We Collect

We collect the following categories of information:

  • Account information: Name, email address, and role assigned during registration or invitation, and — if you choose one on your profile — your preferred language, used to show post orders, emergency phrases and report translations in that language.
  • Location data: GPS coordinates captured during clock-in/out, patrol runs, and checkpoint scans for operational verification purposes.
  • Activity records: Patrol reports, incident reports, dispatch logs, timesheet entries, and audit trail events generated during platform use.
  • Uploaded documents: Contracts, scopes of work, post orders, and site documentation you upload for analysis. These are processed to generate operational guidance and are not used to train AI models (see Three-Layer Model above).
  • Device information: Browser type, operating system, IP address, and device fingerprint used for security monitoring and access logging.
  • Media uploads: Photos and files attached to reports or incidents.
  • Contact and sign-up details: Company name, your name, work email and phone number when you sign up, request a demo, or send a form on our website.
  • Mobile numbers and text preferences: For people who agree to receive text messages (see Text Messages below).
  • Usage information: Pages and features used, time spent, errors and slow screens, collected to run and improve the Platform. For signed-in users these usage statistics are kept on our servers, with no cookies or other storage on your device for them; you can turn them off with the "Usage statistics" switch in your Profile. See our Cookie Policy.
  • Bot-check signals: On sign-up and public forms, Cloudflare Turnstile reads signals such as your IP address and browser details to tell people from bots.

How We Use Your Information

  • To operate and deliver the features of the Platform (scheduling, reporting, dispatch, payroll, etc.).
  • To verify guard attendance and location compliance with site geofencing rules.
  • To generate operational reports for security managers and authorized client viewers.
  • To analyze uploaded contracts and generate security program drafts for your use — using only your data, never to train models shared with other customers.
  • To detect and flag suspicious login activity or unauthorized access attempts.
  • To send automated email notifications and, to people who agree to receive them, text messages (e.g., missed check-ins, incident alerts, shift reminders).
  • To derive anonymized operational patterns (Layer 2) that improve recommendations for all customers — after all identifying information has been removed.
  • To improve platform reliability, performance, and security.

Data Sharing

We do not sell your personal data. Information may be shared in the following limited circumstances:

  • Within your organization: Supervisors, managers, and authorized client viewers may access records relevant to their role and assigned sites.
  • Service providers (subprocessors): these companies process data only to run the Platform:
    • Base44 — hosting, database, sign-in, file storage, AI features and platform email (servers in the United States)
    • Twilio — text messages and emergency calls (most organizations connect their own Twilio account)
    • Resend — outgoing email notifications
    • Google — alert email and calendar features
    • Microsoft — single sign-on, for organizations that turn it on
    • Intuit QuickBooks — invoice sync, for organizations that connect it
    • Wix Payments — subscription billing (card details stay with Wix)
    • OpenStreetMap tile servers (and CARTO on the demo dispatch map) — map images when a signed-in user opens a map screen (they receive your device's IP address and the map area shown; needed to show the map — our legitimate interests)
    • Cloudflare — Turnstile bot check on sign-up and public forms (it receives your IP address and browser details)
  • Legal obligations: We may disclose data if required by law, court order, or regulatory authority.

RapidReady never uses customer data to train AI models, and never sells it. AI features send only the text and files needed for that request to the AI service run by our hosting provider.

Text Messages

If you give your mobile number and agree to receive texts, we use it to send safety alerts, shift and schedule notices and sign-in codes. Reply STOP to opt out or HELP for help; message and data rates may apply. We do not sell, rent or share mobile numbers or text-message opt-in information with third parties or affiliates for their marketing or promotional purposes. Numbers are shared only with the companies that deliver the messages. Full terms: Text Message Terms.

Cookies and Similar Technologies

We use browser storage (local storage, session storage and IndexedDB) to keep you signed in, protect your account, remember your settings and let officers work offline. Our own code sets no cookies; our hosting provider and Cloudflare may set their own. We don't use analytics or advertising cookies, or tracking pixels. Our typeface and map marker icons are served from our own site (no Google Fonts or file-server CDN).

Usage statistics: on our public pages they run only if you choose "Accept" on the notice at the bottom of the screen ("Essential only" keeps them off). For signed-in users, we record which pages and features are used on our own servers, without storing anything on your device for it; you can turn this off at any time with the "Usage statistics" switch in your Profile, and "Essential only" on a device also turns it off there. Our hosting provider's visit-analytics script is switched off; as part of hosting, Base44 may still record basic page views and sign-ins in its logs to run and secure the service, not for marketing. The full list, and how to change your choice, is in our Cookie Policy.

Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, we treat it as a request to opt out: our own usage statistics stay off in that browser (on public pages unless you choose "Accept"; when signed in, unless you switch "Usage statistics" on in your Profile), and we would treat it as an opt-out of any sale or sharing of your personal information (we do neither). We do not track you across other companies' websites over time, and we do not allow other companies to do so on our Platform for advertising. The service providers listed under Data Sharing receive your IP address and browser details only to provide their services.

No Sale or Sharing of Personal Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising (targeted ads based on activity across other websites), as those terms are used in the California Consumer Privacy Act. We have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.

Location Data of Officers and Other Workers

Security companies (our customers) use the Platform to manage their own officers and staff. When an officer uses the app, we collect device location on behalf of, and under the instructions of, that officer's employer: when they clock in or out, while they are clocked in on patrol or checkpoint rounds, and at moments they start themselves (for example "On my way", an incident report, a lone-worker check, or an SOS or emergency button). The app does not track officers while they are clocked out, apart from those moments. Before location is first used, the app shows each officer a notice explaining what is collected, when and why, and records that they saw it. The officer's profile says the same in one line: "We only use your location while you're on shift." When there is no phone signal, a checkpoint scan or report (with the time and location captured at that moment) is kept on the officer's phone, encrypted, and sent automatically when signal returns; once sent, it is removed from the phone.

Location when an SOS is pressed. When an officer presses SOS (or another emergency button), the app tries for a moment to read the phone's location; if the phone does not give it in time, the alert is sent without it. The location is saved with that SOS record in the employer's account and is sent, as a map link, in the alerts to the managers and dispatchers the employer set up (in the app, by email, and by text where they agreed to texts). It is not sent to 911 or any public safety agency: RapidReady does not contact 911. It is kept with the employer's other records under the employer's instructions.

The employer decides how this information is used and is responsible for giving any notice and getting any consent the law requires for monitoring its workers (some states, for example New York, Connecticut and Delaware, require written notice of electronic monitoring). For these records we act as the employer's service provider. Officers with questions or requests about their data should contact their employer; we will help the employer respond.

Automated indicators and decisions about workers

Who decides. Security companies (our customers) use RapidReady to run their workforce. They are responsible for the data about their officers and applicants and for every decision about them. RapidReady does not make decisions about anyone's hiring, pay, shifts, discipline or employment. Nothing in RapidReady hires, rejects, disciplines, demotes or ends anyone's employment automatically.

Workforce AI indicators (off unless your employer turns them on). If an owner of your employer turns them on, RapidReady can compute these indicators about individual officers, each shown to managers with the label "Indicator — a person decides":

  • Retention (resignation) risk — from pay rate, tenure, overtime and sites worked in the last 30 days, and training status.
  • Missed-shift risk for the next 48 hours — from your past shifts and clock-ins at that employer.
  • Burnout, resignation and supervisor-load predictions — from scheduled hours, call-offs, leave requests, sites, start times and reporting lines.
  • A suggested category for a coaching explanation — your written explanation is analysed by an AI language model; a supervisor reads it and decides.
  • A termination-risk readout shown beside a documentation checklist when a manager considers ending employment.

These indicators never use race, colour, national origin, sex, age, religion, disability, genetic information, union membership or other sensitive characteristics, and RapidReady does not do emotion recognition or biometric categorisation. RapidReady does not score or rank job applicants.

Always-on scheduling and attendance tools. To fill open shifts, RapidReady ranks available, qualified officers (site training, hours, rest periods and the employer's own scheduling rules) and sends offers; officers accept or decline. If the employer chose "management" scheduling mode, a shift may be assigned to the top-ranked officer directly. RapidReady also records late arrivals, missed shifts and early departures from clock records and asks the officer to explain a pattern before a supervisor reviews it.

Your rights. When your employer has these indicators on, the RapidReady app shows you a notice listing them and a Request a human review button that goes to your employer's owners and HR. Depending on where you live and work you may also have the right to: be told before such tools are used; get meaningful information about the logic involved and how an output was used (GDPR Art. 15(1)(h); 11 CCR §7222; EU AI Act Art. 86); not be subject to a decision based solely on automated processing that significantly affects you, and to obtain human intervention, express your view and contest the decision (GDPR Art. 22; UK GDPR Art. 22C); opt out of, or appeal to a human about, automated decisionmaking technology used for significant employment decisions (California, 11 CCR §7221); and receive an explanation and correct your data after an adverse decision (Colorado SB 26-189). Ask your employer first, since they decide; you can also write to nick@rapidreadycommand.com and we will pass your request to your employer and help them answer. Using these rights will not be held against you.

Records. Each indicator is stored with the date, the version of the logic that produced it and a summary of what it read, so a person can review or correct it. Turning the indicators on or off, and every review request and answer, is recorded in the employer's audit log.

Personal Information We Collect as a Business (Last 12 Months)

This is the notice the California Consumer Privacy Act requires (Cal. Civ. Code §1798.100, §1798.110 and §1798.130(a)(5); Cal. Code Regs. tit. 11 §7011), and it also covers what other state privacy laws ask a privacy notice to say. In the last 12 months we collected the categories below about website visitors, people who sent us a form, and users and contacts of customer accounts. We collected it from you, from your device, and from the company that invited you to its account.

Identifiers

Examples
Name, email address, phone number, account ID, IP address
Sources
You; your device; the company that invited you
Why we use it
Create and run your account; sign-in; support; service emails and texts; security and fraud prevention; answer your requests
Disclosed for a business purpose to
Service providers: Base44 (hosting), and as needed Resend (email), Twilio (texts), Cloudflare (bot check), Wix (payments)
How long we keep it
While the account is active, then as described under Data Retention; form and sales leads: until 24 months after our last contact
Sold or shared?
No

Customer records (Cal. Civ. Code §1798.80(e))

Examples
Name, company address, phone, billing contact; we do not receive full card numbers (Wix handles payment)
Sources
You
Why we use it
Billing, account administration, tax and accounting records
Disclosed for a business purpose to
Service providers: Base44 (hosting), and as needed Resend (email), Twilio (texts), Cloudflare (bot check), Wix (payments)
How long we keep it
Billing records: 7 years (tax record keeping); other details as for identifiers
Sold or shared?
No

Commercial information

Examples
Plan, trial dates, subscription and payment status, invoices
Sources
You; Wix Payments
Why we use it
Provide the subscription; billing; accounting
Disclosed for a business purpose to
Service providers: Base44 (hosting), and as needed Resend (email), Twilio (texts), Cloudflare (bot check), Wix (payments)
How long we keep it
7 years after the transaction (tax record keeping)
Sold or shared?
No

Internet or other electronic network activity

Examples
Sign-in times, browser and device type, pages and features used (only after you choose "Accept"), error reports
Sources
Your device
Why we use it
Security (suspicious sign-in alerts); fixing errors; with your consent, improving the product
Disclosed for a business purpose to
Service providers: Base44 (hosting), and as needed Resend (email), Twilio (texts), Cloudflare (bot check), Wix (payments)
How long we keep it
Sign-in network details and usage statistics: 1 year; error reports: 90 days (once automatic clean-up is on — until then kept)
Sold or shared?
No

Professional or employment-related information

Examples
Your company, job title and role in the app
Sources
You; the company that invited you
Why we use it
Run the account and its permissions; support
Disclosed for a business purpose to
Service providers: Base44 (hosting), and as needed Resend (email), Twilio (texts), Cloudflare (bot check), Wix (payments)
How long we keep it
While the account is active
Sold or shared?
No

Inferences

Examples
Only product-usage signals such as which features you have not tried yet
Sources
Derived from your use of the app (after "Accept")
Why we use it
Show tips and suggestions in the app. Never advertising, never decisions with legal or similarly significant effects
Disclosed for a business purpose to
Not disclosed
How long we keep it
1 year
Sold or shared?
No

Sensitive personal information: account log-in credentials (sensitive)

Examples
Sign-in email with password (held by our hosting provider's sign-in service), two-step login secrets, site-phone PINs (stored only as salted hashes)
Sources
You
Why we use it
Only to sign you in and keep your account secure (a purpose allowed by 11 CCR §7027(m))
Disclosed for a business purpose to
Base44 (sign-in service)
How long we keep it
Until you change them or the account is closed
Sold or shared?
No

Categories we do not collect as a business: biometric information (face or fingerprint unlock happens on your own device; we store only a credential ID), Social Security numbers, financial account or full card numbers, health information, and characteristics of protected classifications.

Business and commercial purposes (Cal. Civ. Code §1798.140(e)): providing and supporting the Platform; security and integrity; debugging and repair; short-term transient use; services on behalf of our customers; internal research to improve the Platform; quality and safety; billing; meeting legal obligations. Recipients: only the service providers listed under Data Sharing and in our subprocessor list, bound by contracts that limit their use; and authorities where the law requires.

No sale, no sharing, no targeted advertising. In the last 12 months we have not sold personal information, shared it for cross-context behavioral advertising, or used it for targeted advertising, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. We offer no financial incentives or price differences in exchange for personal information.

Information We Process for Our Customers

Our customers (security companies) decide what they record about their people. Depending on the features they use, the Platform may hold the following on their behalf:

  • Identifiers and contact details: Officer, staff, applicant and client-contact names, emails, phone numbers.
  • Employment information: Schedules, clock-in/out records, timesheets, pay rates, training, certifications, coaching and leave records, hire and separation dates.
  • Precise geolocation (sensitive): Device location at clock-in/out, while clocked in on patrol or checkpoint rounds, and at moments the officer starts (On my way, incident, lone-worker check, SOS).
  • Government-issued numbers (sensitive): State security-guard licence / registration numbers and expiry dates; ID numbers (driver's licence or passport) that a customer chooses to record in its site visitor log.
  • Account log-in credentials (sensitive): Site-phone PINs (salted hashes), two-step login secrets.
  • Personal details kept by the employer: Home address, date of birth, emergency contact, photo.
  • Health information (sensitive): Only if a customer records it — for example injuries described in an incident report or injury documentation.
  • Audio, electronic, visual information: Photos and videos attached to reports.
  • Information about members of the public: Names and descriptions in incident reports, dispatch callers, visitors signed in at a site.
  • Background check records (sensitive): The conditional job offer, the applicant's signed authorization (name, time, network address), background reports the employer uploads or orders from its screening company, pre-adverse and adverse action notices, the employer's written assessment and the applicant's response. Only the employer's owners and HR can open a report; the applicant sees every step on a private page.
  • Social Security numbers for employment (sensitive): The SSN a new hire enters on Form W-4, stored encrypted and shown only as the last 4 digits; only the employer's payroll file contains the full number. Not collected until encryption is set up.
  • Bank details for payroll (sensitive): Routing and account numbers a new hire gives for direct deposit (optional — a paper check is always offered), stored encrypted and shown only as the last 4 digits.
  • Tax withholding and new-hire forms: Form W-4 and state withholding choices, emergency contact, signed acknowledgments (handbook, post orders, pay notice), and the date the new hire completed Form I-9 Section 1 on the official form. No I-9 answers, immigration documents or document images are stored.

We use this information only to provide the Platform to that customer, as our Data Processing Addendum requires: we do not sell or share it, do not use it for our own marketing, and do not combine it with information from other customers except to provide the service (for example, de-identified patterns described above). Some features give the employer indicators about its officers (for example attendance, no-show or retention risk). They are aids for supervisors: the Platform makes no automatic decision about anyone's job, pay or discipline — a person at the employer decides. Requests about this information should go to the employer; if you send one to us, we pass it on to the employer and help them answer it.

Sensitive Personal Information

As a business, the only sensitive personal information we collect is account log-in credentials, used only to sign you in and protect your account. As a service provider, the Platform also holds sensitive information our customers record (precise location of officers while on duty, guard licence numbers, visitor ID numbers if a customer records them, any health details in incident reports, background check records, and — for new hires — Social Security and bank numbers for payroll, which are stored encrypted and shown only as the last 4 digits), used only to provide the service to that customer.

We use and disclose sensitive personal information only for purposes the California regulations allow without offering a right to limit (Cal. Code Regs. tit. 11 §7027(m)): to provide the services you or your employer asked for, to keep the Platform secure and prevent fraud, and to keep people safe. We do not use it to infer characteristics about anyone. That is why we do not show a "Limit the Use of My Sensitive Personal Information" link; you can still send a request to limit, and we will record it. Under the Virginia, Colorado, Connecticut, Texas, Oregon and similar laws, we process sensitive data as a controller only where it is needed to secure your account; we do not process any other sensitive data about you as a controller, and would ask for your consent before doing so.

Data Retention

Nothing is deleted automatically. Records are kept while your organization's subscription is active. When an organization leaves, its account is suspended and access is closed; its owner can still ask us for an export. Once automatic retention is switched on (it is waiting for legal review; until then these details are kept), personal and location details are blanked, and the rest of the record kept, after these periods: clock records (name, email, clock-in and clock-out locations) and shift assignments after 4 years; the worker's identity on workforce indicators (for example retention, termination or missed-shift risk scores, where the employer has turned them on) and on requests for a human review of them after 4 years; patrol assignments, location-tracking events, incident staff names and witness notes, and officers' own statements in coaching cases after 3 years; checkpoint scans (officer and scan location) after 2 years; dispatch caller and staff details, sign-in network address, device and location, AI assistant questions and answers, and usage telemetry after 1 year; error reports after 90 days. Hours worked, timesheets and the security audit trail are kept and never altered. You may ask your organization's administrator for a copy of your personal data, or for its deletion. A deletion request is decided by your organization's owner, an executive or HR (or by RapidReady for accounts with no organization). If it is granted, your personal phone, emergency contact, photo and PIN are blanked and your access is closed; your home address and date of birth are kept until 4 years after your last shift, because payroll law requires employers to keep them, and are blanked after that; records the law or security operations require (shifts worked, clock records, timesheets, incidents, dispatch logs, the audit trail) are kept, and records under a legal hold are not changed. Requests are answered within 45 days.

Information we hold as a business. Account and contact details: while the account is active, then as above. Sign-up, demo, early-access and contact-form details from people who do not become customers: until 24 months after our last contact with you, then deleted or de-identified. Billing and payment records: 7 years, for tax record keeping. Usage statistics and sign-in network details: 1 year; error reports: 90 days. Records of privacy requests and our answers: 24 months, as Cal. Code Regs. tit. 11 §7101 requires. We may keep information longer only where the law requires it, to resolve a dispute, or under a legal hold.

Security

Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting provider. Each organization's records are separated from every other organization's by database access rules that we test from real customer logins. Other protections include role-based access, two-step login (required for the platform owner, and configurable by each organization), automatic sign-out after inactivity, suspicious sign-in alerts, and a tamper-evident audit trail. No system is completely secure; we cannot guarantee absolute security of your data.

Your Privacy Rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data. You also have the right to export your operational data. If you use RapidReady through your employer, requests about the records your employer keeps should be directed to your organization's administrator (we help them answer). An organization's owner can download a full export of its data at any time from Settings.

Rights we honor for everyone, wherever you live. We apply the rights in the California Consumer Privacy Act (as amended by the CPRA), the comprehensive privacy laws of other US states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island) and the GDPR to everyone, whether or not a particular law applies to us yet. You have the right to:

  • Know and access — the categories and specific pieces of personal information we hold about you, the sources, why we use it, and who we disclosed it to (Cal. Civ. Code §1798.110, §1798.115).
  • Delete — personal information we collected from you, subject to legal exceptions (§1798.105). We tell our service providers to delete it too.
  • Correct — inaccurate personal information (§1798.106).
  • Data portability — a copy in a portable, machine-readable format (JSON) (§1798.130(a)(3)(B)(iii)).
  • Opt out of sale or sharing, targeted advertising and profiling for decisions with legal or similarly significant effects (§1798.120). We do none of these, so there is nothing to switch off, but you may still send an opt-out and we will record it.
  • Limit the use of sensitive personal information (§1798.121) — see "Sensitive Personal Information" above.
  • Rights about automated indicators and decisions: see Automated indicators and decisions about workers.
  • Non-discrimination and no retaliation — we will not deny you service, charge a different price, give a different quality of service, or retaliate against an employee, applicant or contractor for using these rights (§1798.125).

How to make a request — two ways: (1) our online privacy request form (no account needed), or (2) email nick@rapidreadycommand.com. Signed-in users can also download their own data or ask for deletion at once on the Privacy Requests page. We operate exclusively online and have a direct relationship with the people whose information we hold as a business, so an email address is the method the law asks of us instead of a toll-free number (Cal. Civ. Code §1798.130(a)(1)(A)).

How we verify you. We email a 6-digit code to the address you give, and match the information you provide against what we already hold (Cal. Code Regs. tit. 11 §7060–7062). For a copy of specific pieces of information or for deletion we may ask for one or two more details we already have (for example, the company name on the account) or ask you to reply from your account email. We use what you give us only to verify you and handle your request. We never ask for a password, Social Security number or ID document. Requests to opt out or to limit do not need verification.

Authorized agents. Someone you authorize (including a registered business entity) can make a request for you. We will ask the agent for your signed permission and may ask you to confirm your identity with us directly, unless the agent has a valid power of attorney (Cal. Code Regs. tit. 11 §7063). On the form, tick "I am an authorized agent".

Timelines. We confirm receipt within 10 business days (our form and email confirm it at once) and answer within 45 calendar days of receiving the request. If we need more time, we may extend once by up to another 45 days and will tell you why within the first 45 days (Cal. Civ. Code §1798.130(a)(2); Cal. Code Regs. tit. 11 §7021). Opt-out and limit requests are completed within 15 business days. Requests under the GDPR or UK GDPR are answered within one month (see below). Answers to access requests cover at least the 12 months before your request, and earlier information we hold unless that is impossible or would involve disproportionate effort. Requests are free; we may refuse or charge a reasonable fee only for requests that are manifestly unfounded or excessive, and will explain why.

If we cannot do what you asked, we explain why (for example, we could not verify you, or the law requires us to keep the record — such as payroll records) and tell you how to appeal.

Requests about your employer's records. If you are an officer or other worker of one of our customers, your employer controls those records. Send your request to your employer, or send it to us and we will forward it to your employer, tell you we have done so, and give your employer the tools to answer (data export and deletion).

Global Privacy Control. We treat a GPC signal from your browser as a valid request to opt out of sale, sharing and targeted advertising for that browser (Cal. Code Regs. tit. 11 §7025; Colorado and other state "universal opt-out mechanism" rules), without asking you to sign in. Because we do none of those, honoring it changes nothing you can see, and our own usage statistics already stay off in a browser that sends it (unless you turn them on yourself).

How to review and request changes: signed-in users can see and edit their profile details in the app, and can download their personal data or ask for its deletion on the Privacy Requests page. Anyone (including people without an account, such as website visitors who filled in a form) can email nick@rapidreadycommand.com. We will not treat you differently for making a request. We may need to confirm your identity before acting on it.

Other US State Privacy Laws: Appeals and Complaints

Right to appeal. If we decline to act on your request, in whole or in part, you may appeal: use the privacy request form and choose "Appeal", or email nick@rapidreadycommand.com with the subject "Appeal". Someone other than the person who made the first decision reviews it where possible. We answer appeals within 45 days (the shortest period any of these laws allows: Va. Code §59.1-577(C) allows 60 days; Colo. Rev. Stat. §6-1-1306(3) allows 45 days; Conn. Gen. Stat. §42-518 allows 60 days) and tell you in writing what we decided and why. If we deny your appeal, you may contact the Attorney General of your state (for example, the Virginia, Colorado, Connecticut, Texas or Oregon Attorney General); our answer will say how.

Our practices under these laws. We do not sell personal data, process it for targeted advertising, or profile people in furtherance of decisions that produce legal or similarly significant effects. We honor universal opt-out signals such as GPC. We process sensitive data as a controller only to secure your account (see above). We do not knowingly process personal data of children under 13 (or under 16/18 where state law sets a higher age).

Nevada. We do not sell covered information as defined in Nev. Rev. Stat. §603A.300; you may still email us an opt-out request and we will record it.

EU and UK Residents (GDPR and UK GDPR)

We are a US business. We are preparing to offer our services in the EU and UK. Before we accept customers there, we will appoint representatives under Article 27 GDPR / UK GDPR and list their details here. If you are in the EU or UK and use our website or the Platform, this section gives you the information required by Articles 13 and 14 of the GDPR and the UK GDPR.

Controller: RapidReady Dispatch, California, USA — nick@rapidreadycommand.com — for the information described under "Personal Information We Collect as a Business". For records a security company keeps about its people, that company is the controller and we are its processor. We have not appointed a data protection officer because the GDPR does not require one for our activities (Art. 37); privacy questions go to the email above.

Purposes and legal bases (Art. 6):

  • Providing your account and the Platform, support, and service messages — contract (Art. 6(1)(b)), or our legitimate interests in serving the company you work for (Art. 6(1)(f)).
  • Answering forms, demo and trial requests — steps you asked for before a contract (Art. 6(1)(b)) and legitimate interests in answering you.
  • Security, fraud and abuse prevention (sign-in records, bot checks), debugging — legitimate interests in keeping the Platform and its users safe.
  • Usage statistics on our public pages (signed-out visitors), and text messages — consent (Art. 6(1)(a)); you can withdraw it at any time (cookie choice on the Cookie Policy page; reply STOP to texts) without affecting earlier processing.
  • Usage statistics inside the signed-in app (pages and features used, time spent) — legitimate interests (Art. 6(1)(f)) in finding friction, fixing problems and improving the Platform. Nothing is stored on your device for them, they are never used for advertising or sold, and you can object at any time (Art. 21) with the "Usage statistics" switch in your Profile — we then stop.
  • Our hosting provider's (Base44) basic page-view and sign-in logs, and map images loaded from OpenStreetMap when you open a map — legitimate interests in running, securing and displaying the service (not used for marketing).
  • Billing, tax and accounting records, and answering lawful requests — legal obligation (Art. 6(1)(c)).
  • Establishing or defending legal claims — legitimate interests.

Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details. Giving us your information is voluntary, but without an email address we cannot create an account or answer you.

Recipients: the service providers (processors) in our subprocessor list, and authorities where the law requires. Retention: as set out under "Data Retention".

International transfers: we and our main providers store and process data in the United States. Where the GDPR or UK GDPR requires a safeguard for a transfer, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) and the UK International Data Transfer Addendum in our providers' data processing terms, or on a provider's certification under the EU-U.S. Data Privacy Framework and its UK Extension. You can ask us for a copy of the relevant safeguards.

Your rights (Art. 15–22): access; rectification; erasure; restriction of processing; data portability; objection to processing based on legitimate interests (and an absolute right to object to direct marketing — we do not send marketing without consent); and to withdraw consent at any time. Use the privacy request form or email us. We answer within one month, extendable by two further months for complex or numerous requests, and will tell you within the first month if we need to (Art. 12(3)).

Automated decisions: we do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you (Art. 22).

Complaints: you may complain to the data protection authority where you live or work — in the EU, see the list of EU authorities; in the UK, the Information Commissioner's Office. We would appreciate the chance to address your concern first.

Residents of Other Countries

RapidReady Dispatch is a US business and stores information in the United States. This section adds what the privacy laws of other countries ask us to tell you. It covers information we hold as a business (controller). For records your employer keeps about you in the Platform, your employer is responsible: send requests to your employer, or to us and we will pass them on and help your employer answer.

How to use your rights, wherever you live: our online privacy request form or email nick@rapidreadycommand.com. Requests are free. We verify your identity as described under "Your Privacy Rights" and answer within the time your law sets, as listed below (and never later than 45 days unless your law allows an extension and we tell you why). You may complain to your local authority at any time; we would appreciate the chance to put things right first.

Local representatives. Where the law requires, we will appoint a local representative before offering services in that country; representative details will be listed here. We have not appointed any representative yet.

United Kingdom

Law
UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025
Your rights
The rights and legal bases in the EU and UK section above apply. You may also complain to us first: we acknowledge a data protection complaint within 30 days, take appropriate steps to look into it, and tell you the outcome without undue delay (Data Protection Act 2018 s.164A). Use the privacy request form, or email us with the subject "Complaint".
Transfers
UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or a provider's certification under the UK Extension to the EU-U.S. Data Privacy Framework.
Authority
Information Commissioner's Office (ICO)

Switzerland

Law
Federal Act on Data Protection (FADP, in force 1 September 2023)
Your rights
Access (free, normally within 30 days), correction, deletion, objection, data portability, and the right to ask that an automated individual decision be reviewed by a person (FADP art. 21, 25–28). Use the form or email below.
Transfers
EU Standard Contractual Clauses with the Swiss adaptations recognised by the FDPIC, or a provider's certification under the Swiss-U.S. Data Privacy Framework (recognised by the Federal Council from 15 September 2024).
Authority
Federal Data Protection and Information Commissioner (FDPIC)

Canada (outside Québec)

Law
Personal Information Protection and Electronic Documents Act (PIPEDA), and Alberta and British Columbia PIPA where they apply
Your rights
Access to your personal information and correction of inaccurate information; we answer within 30 days (PIPEDA s.8(3)). You may challenge our compliance by writing to us first.
Transfers
Your information is stored and processed in the United States by us and our service providers, under contracts that require comparable protection. While it is there, it may be accessible to courts, law-enforcement and national-security authorities of the United States under US law.
Authority
Office of the Privacy Commissioner of Canada

Québec

Law
Act respecting the protection of personal information in the private sector (as amended by Law 25)
Your rights
Access, correction, withdrawal of consent, data portability (a copy in a structured, commonly used technological format), and, where a decision about you is made solely by automated processing, to be told so and to have it reviewed by a person (we make no such decisions). We answer within 30 days (s.32). Person in charge of the protection of personal information: see "Who to contact" below.
Transfers
Before personal information leaves Québec, we assess the protection it will receive (s.17) and protect it by written agreement with each service provider. The information is stored in the United States.
Authority
Commission d'accès à l'information du Québec (CAI)

Australia

Law
Privacy Act 1988 and the Australian Privacy Principles (APPs)
Your rights
Access and correction (APP 12 and 13); we answer within 30 days. Complain to us first; if you are not satisfied with our answer within 30 days, you may complain to the OAIC. We apply the APPs even where the small business exemption might apply to us.
Transfers
Personal information is disclosed to, and stored in, the United States (APP 1.4(f) and APP 8), with the service providers listed in our subprocessor list.
Authority
Office of the Australian Information Commissioner (OAIC)

New Zealand

Law
Privacy Act 2020
Your rights
Access (IPP 6) and correction (IPP 7); we answer as soon as reasonably practicable and within 20 working days (s.44).
Transfers
Information is stored in the United States. Where we hold your employer's records only as its agent (s.11), your employer remains responsible for them; for our own records we disclose information overseas only with comparable safeguards (IPP 12).
Authority
Office of the Privacy Commissioner

Brazil

Law
Lei Geral de Proteção de Dados (LGPD, Lei 13.709/2018)
Your rights
Confirmation and access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent, and review of automated decisions (LGPD art. 18 and 20). A complete access reply is given within 15 days (art. 19). Our encarregado (data protection officer): see "Who to contact" below.
Transfers
International transfers to the United States rely on the standard contractual clauses approved by the ANPD (Resolução CD/ANPD nº 19/2024), or another mechanism allowed by LGPD art. 33.
Authority
Autoridade Nacional de Proteção de Dados (ANPD)

Mexico

Law
Ley Federal de Protección de Datos Personales en Posesión de los Particulares (2025)
Your rights
Access, rectification, cancellation and opposition (ARCO rights), and to limit use or disclosure and revoke consent. Send your request using the form or email below, saying which right you are exercising.
Transfers
Information is processed in the United States by service providers acting on our instructions under contract.
Authority
Secretaría Anticorrupción y Buen Gobierno (successor to INAI for data protection)

India

Law
Digital Personal Data Protection Act 2023 and Digital Personal Data Protection Rules 2025 (most obligations apply from May 2027)
Your rights
Access to a summary of your data, correction, completion, updating and erasure, grievance redressal, and nominating another person to act for you. Raise a grievance with us first; you must use our grievance process before approaching the Board.
Transfers
Information is processed in the United States, which is not a country restricted under section 16 of the Act.
Authority
Data Protection Board of India (Ministry of Electronics and Information Technology)

Japan

Law
Act on the Protection of Personal Information (APPI)
Your rights
Disclosure, correction, and cessation of use or provision to third parties, including of records of provision to third parties (APPI art. 33–35).
Transfers
Information is provided to service providers in the United States. The US has no comprehensive federal privacy law; state laws such as the California Consumer Privacy Act apply. Our providers are bound by contract to measures equivalent to those the APPI requires (art. 28). Ask us for details.
Authority
Personal Information Protection Commission (PPC)

Singapore

Law
Personal Data Protection Act 2012 (PDPA)
Your rights
Access and correction (PDPA s.21–22), and withdrawal of consent (s.16). Our data protection contact is the email below.
Transfers
Transfers to the United States are protected by legally enforceable contractual obligations of a comparable standard (s.26 and the Personal Data Protection Regulations 2021).
Authority
Personal Data Protection Commission (PDPC)

South Africa

Law
Protection of Personal Information Act 2013 (POPIA)
Your rights
Access, correction and deletion, objection, and to complain to the Information Regulator (POPIA s.5, 11, 23–25).
Transfers
Transfers to the United States are made under binding agreements that give adequate protection (s.72(1)(b)).
Authority
Information Regulator

United Arab Emirates

Law
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (implementing regulations not yet issued); DIFC and ADGM have their own laws
Your rights
Access, correction, deletion, restriction, objection and portability, as the law provides. Use the form or email below.
Transfers
Information is processed in the United States under contractual safeguards.
Authority
the UAE federal data protection authority (ask us for current details)

Saudi Arabia

Law
Personal Data Protection Law and its Implementing Regulations and Transfer Regulations
Your rights
Information about processing, access and a copy, correction, completion and updating, and destruction of data no longer needed.
Transfers
Information is processed in the United States under safeguards allowed by the Regulations on Personal Data Transfer outside the Kingdom (such as standard contractual clauses).
Authority
Saudi Data and Artificial Intelligence Authority (SDAIA)

Who to contact. Nicholas Nevala, Founder and Privacy Officer, RapidReady Dispatch, California, USA — nick@rapidreadycommand.com. He is the person in charge of the protection of personal information under Québec law, our encarregado (data protection officer) under Brazil's LGPD, and our contact for privacy questions and grievances in every other country. He is not a data protection officer designated under Article 37 of the GDPR (see the EU and UK section above).

Countries we do not serve yet. We do not offer the Platform in countries that require personal data to be stored locally or need local approval for transfers we cannot yet provide (for example Russia and mainland China).

Children's Privacy

This Platform is intended for use by adults employed in professional security roles. We do not knowingly collect data from individuals under the age of 18.

RapidReady Command is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, email nick@rapidreadycommand.com and we will delete it.

Changes to This Policy

We may update this Privacy Policy periodically. Continued use of the Platform after changes constitutes acceptance of the revised policy. The effective date at the top of this page will reflect the most recent update.

For material changes, we will also tell account owners by email or with a notice in the app before the change takes effect (as our Terms of Service describe), and, if the change affects your cookie choices, the cookie notice will appear again.

Contact

For privacy-related questions, contact your organization's administrator or reach out to RapidReady Dispatch support through the Help section of the Platform.

Email: nick@rapidreadycommand.com · RapidReady Dispatch, San Francisco Bay Area, California, USA.

Privacy requests: online form or the email above. Customers: our Data Processing Addendum and subprocessor list.

© 2026 RapidReady Dispatch. All rights reserved.