1. Who we are
SentryReport (“we,” “us,” or “SentryReport”) operates the SentryReport incident reporting software and related websites (the “Service”). This Privacy Policy describes how we handle personal information when you visit our sites, create an account, or use the product.
It should be read with our Terms of Service. Terms defined there have the same meaning here.
2. Roles and who controls what
SentryReport is multi-tenant. Each organization is one property. That distinction matters for privacy:
- Account and operations data. We are the controller (or equivalent) for information we collect to run the product: your name, email, authentication, billing identity for Owners, plan, and similar account records.
- Customer Content. Incident reports, answers, photos, video, signatures, amendments, building and unit details, and similar records are submitted by your organization. For that content, the organization (through its Owner) is the controller. We process it as a processor / service provider on the organization’s instructions, which are given by using the Service (create, view, export, amend, delete).
If you appear in a report as a resident, visitor, or other third party, the organization that filed the report—not SentryReport—is generally the party to contact about that record. We will refer such requests to the Owner when we can identify the organization.
3. Information we collect
Account and profile
When you sign up we collect your name and email address, and we store authentication credentials through our identity provider (Supabase Auth). We do not ask for a phone number or postal address as part of signup.
Organization and team
We store organization name, property-related settings (including optional address and branding), join codes, memberships, roles (Owner, Admin, Officer), pending join requests, and activity such as approvals, role changes, and report events.
Customer Content
Officers and Admins may enter incident details, narrative text, structured answers, times, locations, people involved, and attachments (images, video within plan limits, signatures). Drafts and submitted reports, including later amendments, are stored so the team can review and export them.
We do not currently run automated AI analysis or “polish” on narratives. If we add that later, we will describe it in the product and update this policy if the processing is material.
Billing
Owners who subscribe are billed through Stripe. We store identifiers needed to link the organization to Stripe (customer and subscription IDs, plan, status, period dates, and similar). Stripe processes payment method details. We do not store full card numbers on our servers.
Technical and usage data
Our hosting and database providers may log IP address, user agent, timestamps, and similar security or reliability data. We do not currently run a separate marketing analytics product (such as a third-party page-view tracker) in the application.
4. How we use information
We use information to:
- Provide, maintain, and secure the Service, including authentication, organization isolation, and role-based access.
- Process join requests, team changes, report intake, exports, and billing.
- Enforce plan limits (officers, storage, video length, and branding) and prevent abuse.
- Communicate about the account (for example authentication email, billing receipts from Stripe, and notices about the Service).
- Comply with law and protect our rights and users.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
7. Retention and deletion
We keep account and organization data while the account or organization exists, and Customer Content while it remains in the product (including drafts, submitted reports, and amendments).
If an Owner deletes an organization, we delete that property’s reports, memberships, and media we store for it, subject to short technical backups and any legal hold. Deletion is not available while a paid subscription is still in force; cancel first, then delete when the product allows.
You may close your user account using the product controls where available, or by contacting us. We may retain limited records as required by law, to complete billing, or to resolve disputes.
8. Security
Organizations are isolated with access rules in the database (row-level security) so members of one property should not read another’s Customer Content. Access within a property follows roles described in the Terms. Media is stored in our file storage with access tied to those rules.
No method of transmission or storage is completely secure. You are responsible for protecting your password and for who you approve onto the team. Notify us if you believe there has been unauthorized access.
9. Your rights and choices
Depending on where you live (including the EEA, UK, and certain US states), you may have rights to access, correct, delete, or export personal information, to object to or restrict certain processing, and to appeal a denial. You may also have the right to lodge a complaint with a supervisory authority.
For account data we control, email privacy@sentryreport.com. We will need enough information to verify you. For Customer Content inside a report, start with the organization’s Owner or Admin; they control that file.
We do not sell personal information. If a “Do Not Sell or Share” right applies to you, our practices described above are intended to satisfy that request without an extra form, because we do not sell or share for advertising. You may still contact us to confirm.
California residents: we collect identifiers (name, email), commercial information (plan and billing status), internet or electronic activity (logs needed to operate the Service), and Customer Content you or your team submit. We use this for the business purposes in Section 4. We do not use or disclose sensitive personal information for purposes that require a right-to-limit notice under the CPRA beyond providing the Service.
10. Children
The Service is for adult organizational users. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA where consent is required). If you believe a child has created an account, contact us and we will delete it.
Reports may mention minors as part of an incident. That content is Customer Content controlled by the organization. Organizations must only record what they are legally allowed to record.
11. International transfers
We and our processors may store and process information in the United States and other countries. If you access the Service from outside the US, you understand that your information may be transferred to, stored, and processed there, where laws may differ from those in your country. Where required, we rely on appropriate safeguards with processors (such as standard contractual clauses).
12. Changes
We may update this policy. The “Last updated” date at the top will change. Continued use after an update means you accept the revised policy. If we make material changes, we will post them on this page and, for Owners, attempt to email the address on the account.
13. Contact
Privacy and legal notices: privacy@sentryreport.com.