Privacy Policy

1. Who this applies to

This policy covers people who sign up for or use School READi HQ: security directors, school staff and others invited by a school district or school (each a "Customer"). The app is built for adults working for schools. It is not directed to children, and students should not create accounts.

2. Information we collect

• Account information: name, work email, job title, phone number (optional), district or school name, and a password (stored only in encrypted, hashed form).
• Customer content: what you and your team enter into the app, including service tickets, incident reports, building names, photos and scanned pages, security assessments, drill logs, equipment records, post schedules, reminders, Memo Book entries and meeting notes.
• Usage information: sign-in times, pages used, device and browser type, IP address, and error logs, used to run and secure the service.
• Communications: messages you send to support, and whether you agreed to receive product updates.
• Agreement and billing records: which version of these documents you agreed to and when, and your subscription status (plan, dates and payment status — card numbers are handled by Paddle and never stored by us).

3. How we use information, and why

We do not use Customer content for advertising, and we do not sell or rent personal information.

• To provide, maintain and secure the app and your account (contract performance).
• To process subscriptions and prevent fraud (contract performance and legitimate interests).
• To send service messages, such as reminders, password resets and security notices (contract performance).
• To provide support and respond to requests (contract performance).
• To improve the app using aggregated, de-identified usage trends (legitimate interests).
• To send product updates and tips, only if you opted in (consent — you can unsubscribe at any time).
• To comply with law and enforce our Terms (legal obligation and legitimate interests).

4. READi (AI assistant)

When you ask READi a question, your question and the parts of your organization's data needed to answer it are sent to our AI provider only to produce the answer. Our agreement with that provider does not allow it to use your data to train its models.

5. Sensitive security information

Assessments, incident reports, tickets, photos and logs can describe a school's security weaknesses and people involved in incidents. We treat all Customer content as confidential. Access within our company is limited to staff who need it to operate or support the service, and only when required for support, security or legal reasons.

6. How we share information

• Within your organization: content is visible to users your district invites, according to the roles it assigns.
• Service providers: companies that host our app, store data, send email or provide the AI assistant for us, under contracts that require confidentiality and security. Current providers: Lovable Cloud (application hosting and data storage) and Lovable AI (the READi assistant).
• Merchant of Record: Paddle, which sells our subscriptions, collects payments, calculates and remits sales tax, issues invoices and handles refunds and billing inquiries on our behalf.
• Professional advisers: lawyers, accountants and insurers, when they need it to advise us.
• Legal reasons: when required by law, subpoena or court order, or to protect the safety of people or the service. Where allowed, we will notify the Customer first.
• Business transfers: if our company is sold or merged, this policy's protections continue to apply to your information.

7. School and student data

When we process information on behalf of a school, the school controls that information and we act as its service provider. Where the Family Educational Rights and Privacy Act (FERPA) applies, we act as a "school official" with a legitimate educational interest, use the data only to provide the service, and do not re-disclose it except as the school directs or the law requires. We will comply with applicable state student-privacy laws and will sign a reasonable data privacy agreement on request.

8. Security

We use encryption in transit and at rest, organization-level separation so one district can never see another's data, role-based access, hashed passwords, automatic sign-out after inactivity, and limits on repeated failed sign-ins. No system is perfectly secure. If a breach affects your information, we will notify the affected Customer without unreasonable delay and as required by law.

9. Data retention and deletion

We keep Customer content while the account is active. After an account closes, the Customer can export its data for 30 days, and we then delete it within 90 days, except where law requires us to keep it. Backups are overwritten on a regular schedule.

10. Cookies

The app uses only essential cookies and browser storage: keeping you signed in, remembering your preferences, and protecting against abuse. We do not use advertising or cross-site tracking cookies. You can clear or block these in your browser, but signing out or blocking them will keep you from staying signed in.

11. International transfers

Our service providers are primarily located in the United States. Where information is transferred outside your home country, we rely on the provider's certifications and contractual safeguards (such as the EU Standard Contractual Clauses) to protect it.

12. Your rights and choices

You can view and update your account information in Settings, and you can contact us at support@schoolreadihq.com to request access to, correction of, or deletion of your personal information, or to object to or restrict how we use it. Your district's administrator controls the content it owns, so requests about that content should go to your district first. Depending on where you live, you may have additional rights under state law (including the right to know, correct, delete or port your information, and the right not to be discriminated against for exercising these rights), and we will honor them. You can also unsubscribe from product emails at any time.

13. Children

The service is not intended for children under 13, and we do not knowingly collect their personal information directly from them. If you believe a child has created an account, contact us and we will delete it.

14. Changes to this policy

If we make material changes, we will notify account administrators by email or in the app before the changes take effect.

15. Contact us

Daniel Shook, doing business as School READi HQ™ · support@schoolreadihq.com