Privacy policy | Escudo Ready

This policy covers this website and the dashboards and apps of Escudo Emergency, Escudo Fleet, Escudo Aviation and Escudo Mining (the Service), operated from Melbourne, Australia by Escudo Ready Pty Ltd (we, us). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles and, for New Zealand customers, the Privacy Act 2020 (NZ).

1. What we collect

Account information: name, work email, password (stored only as a one-way hash), organisation, role, station or site, industry and country.
Crew, driver and staff information entered by your organisation: names, email addresses, phone numbers, roles, the station, depot or site they work at, licence class and expiry, authorisation numbers, competencies, training and credentials with their dates (including medical and induction expiry dates), positions they are signed on to and when, and signatures drawn on the screen.
Check, vehicle and site records: check results, photos taken in the app with their time and, where the phone allows, GPS position and compass heading, tag scans, meter and fuel readings, defects, handovers, work orders, equipment records, and the audit log of who did what and when.
Escudo Fleet records: trips with the place each trip starts and ends, fill-ups with receipt photos and their time and location, and fuel card transactions you import.
Incident and response records: in Escudo Aviation, and in Escudo Emergency with ARFF on, incident and standby reports, whose narratives and casualty details may include health information; in mine rescue, incident times, logs and counts. Medical responses in mine rescue are kept as times and counts only, never patient details.
Billing information (Escudo Fleet): your plan, the number of vehicles you pay for, and your invoices. Card details are entered on and held by Stripe, our payment provider, not by us.
Demo requests and enquiries: what you put in the demo form on this website or send us.
Technical information: device type, app version, IP address and the logs needed to run and secure the Service.

2. Why we collect it

To provide the Service: run checks, set the status of vehicles, assets and places, raise alerts and keep the records your organisation needs.
To support you, reply to a demo request and tell you about changes to the Service.
To keep the Service secure and investigate misuse.
To improve the Service, using aggregated information that identifies nobody.

GPS is recorded only while a check, inspection, trip or fill-up is being recorded. The Service never tracks anyone in the background. Photos are meant to show vehicles, equipment and places, not people.

We do not sell personal information. We do not use your records to train machine learning models. We do not share your records with an insurer, a regulator or anyone else unless you ask us to, the law requires it, or it is necessary to protect someone from serious harm.

3. Your organisation controls its records

Your organisation decides what is recorded about its people, vehicles and places, who in the organisation can see it, and when it is deleted. If you are a crew member, driver, operator or volunteer with a question about information your organisation holds about you in the Service, ask your organisation first. We will help them answer.

4. Where it is stored

Every record and photo is stored in Sydney, Australia, with our hosting providers Supabase (on Amazon Web Services) and Vercel. Photos are kept in private storage and shown only to your organisation through short-lived links. Each product keeps its records in its own database: Escudo Emergency, Escudo Fleet, and Escudo Aviation with Escudo Mining. If you use Microsoft sign-in, Microsoft confirms who you are under its own terms. Email is sent through a transactional email provider.

Escudo Fleet card payments are processed by Stripe, which may handle your billing details outside Australia, including in the United States. Apart from Stripe, we do not transfer personal information outside Australia except where a provider we use processes support requests or email delivery from another country under contract.

5. Who can see it

People in your organisation, according to the roles you set. Our staff, only with your permission, to support you. Our hosting providers and, for Escudo Fleet billing, Stripe, only as needed to run the Service. Nobody else.

6. How long we keep it

We keep your records while your organisation uses the Service. You can export them at any time. When you leave, we delete your organisation’s records when you ask, except anything the law requires us to keep. Backups held by our hosting provider expire on their own rolling schedule.

7. Cookies

This website uses no advertising or tracking cookies. The dashboards use a cookie to keep you signed in and cookies to remember the organisation and station you chose, and keep your preferred board layout in your browser. This website remembers on your device which product you last signed in to. Paying by card on Escudo Fleet uses Stripe’s own cookies on Stripe’s pages. If we add privacy-respecting analytics to this website we will say so here.

8. Your rights

You can ask for a copy of the personal information we hold about you, ask us to correct it, or complain about how we have handled it, by emailing info@escudoready.com. We respond within 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner or, in New Zealand, the Privacy Commissioner.

9. Security

Separation between organisations is enforced in the database. The audit log is append only. Submitted checks and photos cannot be altered. Connections are encrypted. See security and data. If a data breach is likely to cause serious harm, we will notify the people affected and the Commissioner as the law requires.

10. Changes

We will post changes here with a new date, and tell organisation administrators by email if a change is significant.