Privacy Policy
Effective July 22, 2026
1. Scope
This Privacy Policy explains what information Standby (“we”, “us”) collects when you use the Service, how we use it, who we share it with, and the choices you have.
2. Information we collect
Account information: when you sign in with Google or an email magic link, we receive your email address and, where available, your name. We store your selected role (organizer or EMT).
Event and assessment data: details you enter to run a risk assessment (such as event type, expected attendance, venue conditions, dates, and on-site resources) and any assessments or reports you save.
EMT profile and credential data: for EMTs, the certification level, service area, rate, specializations, and licensure details (such as license number, state, expiry, and an uploaded certification document) you submit during onboarding. Credential fields and documents are stored privately and are never exposed on public marketplace pages.
Booking data: coverage requests exchanged between organizers and EMTs, including event details and status.
Usage data: basic technical information (such as IP address, log, and device data) generated when you use the Service. We use IP addresses for security purposes such as rate limiting and abuse prevention.
3. How we use information
To provide and operate the Service — authenticate you, generate risk assessments and reports, surface matching personnel, and process coverage requests.
To send transactional service communications — sign-in links, and email notifications about booking requests and their status. These are service messages, not marketing; we do not send marketing email.
To verify EMT credentials before a profile is published, to maintain safety and integrity, to protect the Service against abuse, and to comply with legal obligations.
4. How we share information
With other users as needed for the Service: an EMT’s public profile (excluding private credential fields) is visible to organizers; when you send a coverage request, the relevant event details are shared with the EMT you contact, and booking notifications include the counterpart’s display name and the event details.
With service providers who process data on our behalf — including Supabase (authentication, database, and file storage), Vercel (hosting), Google (sign-in), and Resend (delivery of transactional email, which processes your email address and the content of booking notifications). These providers may only use the data to provide their services to us.
Third-party lookups from your browser: optional assessment conveniences (venue autocomplete, weather auto-fill, and nearest-hospital distance) send the venue text or coordinates and the event date directly from your browser to Open-Meteo and OpenStreetMap’s Overpass service. These requests are not tied to your account and include no other personal information; skipping those fields’ auto-fill avoids the lookups entirely.
For legal reasons, where required to comply with law or protect rights and safety. We do not sell your personal information.
5. Data retention
We keep your information for as long as your account is active or as needed to provide the Service, then for a reasonable period as required to comply with legal obligations, resolve disputes, and enforce agreements.
6. Your rights and choices
You can access and update much of your information from within the Service. You may request a copy of your data, or request that we delete it, by contacting us. We will honor applicable data rights under the laws that apply to you.
7. Security
We protect your data with encryption in transit and at rest and with row-level access controls so users can only reach data they are authorized to see. No method of transmission or storage is perfectly secure, but we work to protect your information.
8. Cookies
Standby uses only essential cookies: the session cookies required to keep you signed in, set by our authentication provider (Supabase). We do not use advertising cookies, third-party analytics cookies, or cross-site tracking.
9. Children
The Service is intended for users 18 and older and is not directed to children. We do not knowingly collect personal information from children under 18.
10. Changes and contact
We may update this Policy; material changes will be reflected by updating the effective date below. Questions or data requests can be sent to standbysupport@gmail.com.