Privacy Policy

1. Who we are and our role

For data about account holders and visitors to our website, SitePling is the controller. For incident data submitted through an organization's forms, the organization is the controller and SitePling acts as its processor. The organization decides what forms to publish, who receives notifications, and how long data is kept. Business customers can request a Data Processing Agreement.

2. Data we collect

From account holders

• Email address, used for passwordless sign-in and service communications.
• Name and organization details that you provide.
• Billing information processed by Stripe. We store a Stripe customer and subscription identifier and the subscription status.
• Configuration you create, such as locations, incident categories, and recipient email addresses.

From people who submit incident reports

• The incident category you select, which is required.
• An optional free-text description, up to 500 characters.
• An optional photo, up to 10 MB. Photos may show people, vehicles, or property.
• The date and time the report was received.

We do not ask for or record a reporter's name, email address, phone number, IP address, device information, or precise location. The only location associated with a report is the physical location that the QR code represents.

Collected automatically

• Essential session and security cookies in the application, needed to keep you signed in.
• Email delivery logs, which record the recipient address, subject, delivery status, and any error, so we can retry failed notifications and troubleshoot.

We do not use analytics or advertising cookies, and our marketing website does not set cookies.

3. How we use data and legal bases

• To provide the Service, including delivering incident reports and any attached photo by email to the recipients an organization configures. Legal basis: performance of a contract, or our legitimate interest in operating the Service for reporters.
• To send transactional email, such as sign-in links, receipts, and optional weekly status summaries. Legal basis: performance of a contract.
• To process payments and manage subscriptions. Legal basis: performance of a contract.
• To keep the Service secure and prevent abuse, including rate limiting. Legal basis: legitimate interests.
• To comply with legal obligations and to establish, exercise, or defend legal claims. Legal basis: legal obligation and legitimate interests.

4. Cookies

The SitePling application sets only essential cookies: a session cookie that keeps you signed in and a security cookie that protects sign-in requests from cross-site request forgery. These are required for the application to work. We do not use analytics, tracking, or advertising cookies, and the SitePling marketing website does not set cookies.

5. Subprocessors

We use the following third parties to provide the Service. Each processes personal data only as needed to perform its function.

• Vercel: application hosting and private storage of data.
• Resend: sending transactional email, including incident notifications and sign-in links.
• Stripe: payment processing and subscription management.

6. Sharing and disclosure

• Incident reports and their photos are sent by email to the recipients that the organization configures. Photos are included as an attachment.
• We share data with the subprocessors listed above.
• We do not sell personal or any other form of data.

7. Retention

• Account data is retained while the account is active and for a reasonable period afterward.
• Incident data and photos are controlled by the organization and are retained until the organization or SitePling deletes them. Deleting an incident, a location, or an organization permanently deletes the associated stored photos.

8. Security

We use measures appropriate to the risk, including encryption of data in transit, private storage for uploaded photos, passwordless authentication, and access controls that limit incident data to an organization's authorized users.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with your local data protection authority.

If you submitted an incident report and want to access or delete it, contact the organization that published the form, since it is the controller for that data. SitePling will assist that organization as its processor.

11. Children

The Service is not directed to children. We do not knowingly collect personal data from children.

13. Contact

For privacy questions or requests: contact@sitepling.com