Legal
Privacy Policy
Last updated: August 2026
1. What We Collect
The Service stores information entered by each facility's authorized personnel: staff names and contact details, certification records, audit results and comments, remediation records, and facility configuration. Standard technical logs (authentication events, error reports) are collected to operate and secure the Service.
2. Facility Isolation
Every record belongs to exactly one facility. Row-level security policies enforced at the database layer ensure users can only access data belonging to their own facility. No facility's data is visible to, aggregated with, or exposed to any other facility.
3. How Data Is Used
- To provide the Service to the facility that entered the data.
- To generate the facility's own analytics, schedules, and reports.
- To send notifications the facility has explicitly configured (e.g. Slack or Teams alerts).
We do not sell client data. We do not share client data with third parties except the infrastructure subprocessors required to operate the Service, each bound by their own data protection terms.
4. Security Measures
- All data encrypted in transit (TLS) and at rest.
- Row-level security isolating every facility's records at the database layer.
- Role-based access control within each facility (lifeguard / supervisor / manager).
- Immutable audit records — submitted audits cannot be altered, preserving evidentiary integrity.
- Staff accounts are created by facility administrators or via a facility-specific access code; access codes are managed and can be rotated by the facility at any time.
- Independent security certification (SOC 2) is on our compliance roadmap.
5. AI Processing
Certain features send audit context to an AI model to generate coaching guidance and training plans. Client data is not used to train AI models. See AI & Data Practices for the full statement.
6. Retention & Deletion
Records are retained for the life of the facility's account. Facilities may deactivate staff (preserving historical records for compliance purposes) and may request full account deletion, subject to any retention obligations that apply to the facility's own records.
7. Contact
Privacy questions: poolcontrolnate@gmail.com