Privacy Policy

This explains what GuardPostSync collects, why, and what you can do about it. It is written to be read, not to be survived.

---

The one thing to understand first

Most people whose information is in GuardPostSync are not our customers.

Our customers are security firms. They subscribe, they pay, and they decide what goes into the system. The security officers on their rosters — whose names, dates of birth, addresses, phone numbers and state licence cards are in there — work for those firms, not for us.

This matters for your rights. If you are a security officer, your employer decides what is collected about you, how long it is kept, and who inside the company can see it. We hold that information on their instructions and we do not use it for our own purposes. If you want your information corrected or deleted, ask your employer first — they can do it directly in the product. If you cannot reach them, write to privacy@guardpostsync.com and we will pass the request on and tell you what happened.

In legal terms: for officer data the security firm is the controller and we are the processor. For our own customers' account and billing data, we are the controller.

What we collect

About officers, entered by their employer or by the officer

• Identity — legal name, preferred name, date of birth, home address
• Contact — mobile phone number, email address, emergency contact
• Licence — state security licence number, class (for example Texas Level II,

III or IV), issuing state, expiry date, and a photograph of the physical licence card

• Work — employment status at that firm, schedules, assignments, availability,

time off, hours worked

• Messaging — whether the officer agreed to receive text messages, the exact

wording they agreed to, the version of that wording, and when they agreed

• App notifications — if an officer turns on notifications on a device, that

device's push address, the keys that encrypt messages to it, and its browser type

An officer may enter or update some of this themselves through a link their employer sends them.

About our customers' staff

Account holders' names, work email addresses, roles, and sign-in records.

Billing

Company name, billing contact email, plan and subscription status. Payment card details go directly to Stripe and never reach us. We hold an identifier Stripe gives us, not a card number.

Technical

IP address, browser type, timestamps, and records of actions taken — who approved a credential, who assigned an officer to a post. These audit records exist because a licensing question a year from now needs an answer.

What we deliberately do not collect

We are specific about this, because it is what people actually ask:

• No Social Security numbers. Anywhere. There is no field for one.
• No tax forms — no I-9, no W-4, nothing.
• No bank account details and no payroll. The hours export is a spreadsheet with

no dollar amounts in it. We never generate a paycheck.

• No card numbers.
• No background check results. A vendor that needs an SSN collects it directly

from the officer, not through us.

• No location tracking. No GPS, no geofencing, no guard tour checkpoints, no time

clock. We do not know where an officer is.

• No health information.

Why we collect it

We do not sell personal information. We do not share it with advertisers. We do not use it to train machine learning models.

Who else sees it

We use these service providers, each listed below with exactly what it can see.

• Vercel — runs the application. Sees data in transit.
• Neon — the database. Holds everything stored.
• Vercel Blob — stores licence card photographs, private, separated by company.
• Resend — sends email. Sees the recipient and the message.
• Telnyx — sends text messages. Sees the phone number, the message text and

whether it was delivered, and keeps its own list of numbers that replied STOP so it can stop texting them. Message text deliberately carries no licence number and no site address.

• Stripe — payments. Sees company billing details. **No roster, credential or

schedule data ever reaches Stripe.**

• Sentry — error reports. Licence numbers, phone numbers, email addresses and

secrets are stripped out before an error report leaves our systems, and a report is discarded entirely if that stripping fails.

• Web push services — Google, Apple, Mozilla or Microsoft, whichever runs the

officer's own browser, deliver app notifications to devices the officer turned them on for. They see the device's push address and when a message was sent. The message itself is encrypted to the device and unreadable to them, and carries no licence, site or company detail regardless.

We may also disclose information if legally required, or in connection with a sale of the business — in which case this policy continues to apply until you are told otherwise.

Where it lives

In the United States. Our servers, database and file storage are all US-hosted, and no provider stores your information in another region. The one thing that may cross a border is an app notification on its way to a device, carried by the device maker's own network — and it is encrypted so that network cannot read it. The service is offered to U.S. security firms and is not intended for use outside the U.S.

How long we keep it

While your employer is a customer, they decide. Licence and assignment records are generally kept for as long as the employer needs them to answer a licensing question, which may be several years after an officer leaves.

When a customer's account ends, their data remains available to them for 30 days and is deleted within 60 days after that, except where law requires otherwise. Database backups age out separately and are gone within 7 days.

Security

• Encrypted in transit and at rest
• Each company's data is separated at the database level, enforced by the database

itself rather than only by application code

• Licence card photographs are held in private storage under keys scoped to one

company; there is no public URL

• Credential and assignment decisions are recorded against a named person
• Error reports are stripped of personal information before they leave our systems

No system is perfectly secure. We are not SOC 2 certified. We built toward that standard and intend to certify, but we are not claiming it today.

Text messages

We only text an officer who has agreed to it, and consent is recorded with the exact wording shown at the time.

Consent is never required. An officer who declines SMS, or who opts out later, still receives every shift offer and every licence warning by email. Declining costs an officer nothing.

Every message can be stopped by replying STOP, and HELP returns contact information. An officer who replies STOP is opted out everywhere on GuardPostSync, including at any other security firm using the platform where they also work. No employer can override this — which also means one employer's opt-out stops another employer's messages, and we think that is the right way round.

Text messages are sent only between 8am and 9pm in the officer's local time — except a verification code the officer asks for themselves, which goes straight away because it expires in ten minutes.

We will not share your mobile information with third parties for marketing purposes. Mobile numbers and text-message consent are used only to send the messages described here, through Telnyx, the provider listed above. They are never sold, and never shared with anyone — including affiliates — for marketing or promotional purposes.

App notifications

An officer can turn on notifications for a device from the Wallet screen; the device's own permission prompt is the agreement. Turning them off there, or in the device's settings, stops them. They carry the same news as the emails — shift offers, shifts the officer has been put on, shifts that have filled — in a few words that name no company, site or licence, because they can appear on a locked screen. Email is still sent every time; a notification is never the only message.

Notifications are not held for quiet hours: the device's own Do Not Disturb governs them, and an officer who needs to hear about a 2am opening can.

Your rights

If you are a security officer: ask your employer. They control your record and can correct or remove it directly. If they will not, or you cannot reach them, write to privacy@guardpostsync.com and we will pass the request on and tell you what happened.

If you are our customer: you can access, correct, export and delete data from inside the product, and contact us for anything you cannot do yourself.

If you are in California: you have the right to know what is collected, to delete it, to correct it, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined, and we do not use it for targeted advertising. California removed the employment-data exemption in 2023, so these rights apply to employee information. Where the information is your employer's record, direct the request to them; we act as their service provider. You may not be discriminated against for exercising these rights.

If you are in Texas, Colorado, Connecticut, Virginia or another state with a consumer privacy law: the same applies. Several of these laws, including the Texas Data Privacy and Security Act, exclude employment data from their scope. We answer requests the same way regardless.

We respond within 45 days and may need to verify who you are first. Write to privacy@guardpostsync.com.

Children

The service is not for anyone under 18 and we do not knowingly collect information about children.

Changes

We will post any update here and change the date at the top. For material changes we notify our customers by email.

Contact

GuardPostSync LLC · 7104 Cherry Beam Path, Austin, TX 78744 · privacy@guardpostsync.com