The short version
- We don't sell personal data.
- If you work for a security company that uses Evidence Pack, your employer controls your work records and is your first contact for them.
- The guard app shares your location with your employer while you're clocked in, including when the app is closed. Sharing stops when you clock out.
- Our public website, including the sign-in and sign-up pages, uses advertising tags. We don't load them on client portals or in the guard app.
This summary is for convenience. The full text below is what applies.
1Who this covers and who is responsible
This policy covers our website, the Evidence Pack web platform, the guard mobile app and the client portal. "We" and "us" mean Evidence Pack, based in Detroit, Michigan.
Who is responsible for your data depends on how it reached us:
- Work records. The security company using Evidence Pack (our customer) decides what is collected about its guards, supervisors, clients, visitors and the people named in its reports. We process that data on its instructions under our Data Processing Agreement.
- Our own records. We are responsible for data about website visitors, people who contact us, and the account and billing details of our customers.
2What we collect
Account and profile details
Name, email, phone, organization and role, plus a login credential we store in protected form. Customers can also add workforce details such as address, date of birth, the last four digits of a Social Security number, profile photo, employment dates, pay rates and license or certification records.
Location
The guard app collects precise location to verify a clock-in, to send an SOS, and to show supervisors where guards are while clocked in. With the permission granted, this continues in the background until the guard clocks out. We don't collect app location for live tracking when a guard is off the clock.
Shift and operational records
Schedules, timecards, patrol and checkpoint scans, time-off and swap requests, invoices, messages between guards and supervisors, and documents the customer uploads.
Incident reports
Descriptions of events, photos and attachments, timestamps and location. Reports may name people involved and can include physical descriptions, contact details or injury information.
Voice recordings
If a guard chooses to speak a report, the audio is sent for transcription and the text is used to fill in the report for the guard to check.
Visitor logs
Where a customer uses visitor management: name, company, contact details, photo, vehicle plate, host and the times of arrival and departure.
Billing
Subscription and invoice details. Card details are entered with and held by Stripe. We don't store full card numbers.
Website and device data
IP address, approximate location derived from it, browser and device type, pages viewed, referring page, clicks, scroll depth and time on page. See our Cookie Policy. If you fill in our contact form, we keep what you send along with how you arrived at the site.
We don't use facial recognition and don't collect biometric identifiers such as fingerprints or face scans.
3How we use it
- To provide the service: scheduling, time and attendance, patrols, reporting, messaging and client portals
- To run AI features the customer uses, such as report review, transcription and the Shield assistant
- To process payments and send invoices and service messages
- To answer support requests and sales inquiries
- To keep the service secure, investigate misuse and meet legal obligations
- To understand and improve the product and website
- To measure and advertise our own service on our marketing website
Where the law requires a legal basis, we rely on performing our contract, our legitimate interests in running and securing a business service, legal obligations, or your consent where it's needed.
4AI features
Some features send content such as report text, audio or uploaded documents to AI providers (currently OpenAI and Anthropic) to generate a transcript, review or draft. We use their commercial APIs, whose standard terms don't use that content to train their models.
AI output can be wrong. It's offered to help a person decide and doesn't make employment, legal or disciplinary decisions on its own. Customers are responsible for reviewing it.
6How long it's kept
Operational records stay available according to the customer's plan:
| Plan | Retention |
|---|---|
| Starter | 6 months |
| Professional | 1 year |
| Business | 3 years |
| Enterprise | As agreed |
After a customer's account ends, it has 30 days to request an export, and we then delete its data from active systems. Deleted data can remain in backups for a limited time. We keep billing and tax records, and anything else the law requires, for as long as we must.
7Security
Data is encrypted in transit and at rest, access is limited by role, and each organization's records are kept separate. No system is perfectly secure. If a breach affects your data, we'll notify the customer or you as the law requires. More detail is on our security page.
8Your choices and rights
Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal data, and to object to or limit certain uses. We won't treat you differently for using these rights.
- Guards, employees, visitors and people named in reports: please contact the security company that holds your record, since it controls that data. If you write to us, we'll pass your request to it. Employers may need to keep some records by law or for a legal claim.
- Everyone else: email info@getevidencepack.com. We may need to verify your identity, and we'll respond within the time the law allows. You can use an authorized agent where the law permits it.
- Location and device permissions: you can turn these off in your phone's settings, though clock-in verification, SOS location and photo features may stop working.
- Deleting an account: follow the steps on our account deletion page.
9Notice for US state privacy laws
California and some other states give residents specific rights, including the right to opt out of the "sale" or "sharing" of personal data. We don't sell personal data for money. Advertising tags on our public website may count as "sharing" or targeted advertising under those laws, and you can limit them using the controls in our Cookie Policy or by contacting us. We don't use sensitive personal data to infer characteristics about you.
10International visitors
We're based in the United States and data is processed and stored here. If you're outside the US, your data will be transferred to the US, where laws may differ from those at home. Where required, we use safeguards such as Standard Contractual Clauses. You may also complain to your local data protection authority.
11Children
Evidence Pack is a workplace service for adults and isn't directed at anyone under 18. A report may mention a minor who was involved in an incident. Such records are controlled by the customer that created them.
12Changes to this policy
We'll update the date above when this policy changes, and we'll tell customers by email or in the product before a material change takes effect.
13Contact
Evidence Pack, Detroit, Michigan. Email info@getevidencepack.com.