Privacy Policy

Rescue Workflow ("we," "us," or "our") is committed to protecting the privacy of the organizations and individuals who use our platform. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

By using the Rescue Workflow platform, you agree to the collection and use of information in accordance with this policy.

2.1 Account & Organization Information

• Organization name, address, city, state, zip code
• Admin user name, email address, and hashed password
• Billing information (processed and stored by Stripe — we do not store card numbers)
• Subscription plan and billing history

2.2 Operational Data (entered by your organization)

• Animal records: name, species, breed, medical history, photos
• Contact records: adopter, foster, volunteer, and donor names, email, phone, and address
• Application submissions from adopters, fosters, and volunteers
• Adoption contracts and e-signature records (including signature images)
• Financial transactions (adoption fees, donations)

2.3 Usage Information

• Log data: IP addresses, browser type, pages visited, timestamps
• Cookies and session tokens used for authentication
• Device information (browser, operating system)

2.4 Public Applicant Data

When members of the public submit adoption, foster, or volunteer applications through your rescue's public portal, or sign up for your waitlist, their submitted information (name, email, responses) is stored as part of your organization's data on our platform.

• Service Delivery: To provide, maintain, and improve the Rescue Workflow platform
• Authentication: To verify your identity and maintain your session
• Billing: To process subscription payments and payment disputes
• Communication: To send service-related notices, security alerts, and support responses
• Emails on Your Behalf: To send transactional emails (contract links, application confirmations) from your rescue to your contacts via Resend
• Analytics: To understand usage patterns and improve the platform (aggregated, non-personally-identifiable)
• Legal Compliance: To comply with applicable laws, regulations, and lawful requests

We do not sell your data or your adopters'/applicants' data to third parties.

We share data with trusted third-party providers only as necessary to deliver the Service:

• Stripe, Inc. — Payment processing for subscriptions and Stripe Connect for donation/fee collection. Subject to Stripe's Privacy Policy.
• Resend, Inc. — Transactional email delivery (verification emails, application confirmations, contract links). Subject to Resend's Privacy Policy.
• Supabase, Inc. — PostgreSQL database hosting and file storage (animal photos, contract signature images, documents). Subject to Supabase's Privacy Policy.
• Vercel, Inc. — Application hosting and serverless functions. Subject to Vercel's Privacy Policy.
• Cloudflare, Inc. — Bot protection (Turnstile) for public forms. Subject to Cloudflare's Privacy Policy.

We may disclose your information if required by law, court order, or to protect the rights and safety of Rescue Workflow, our users, or the public.

We use session cookies strictly necessary for authentication. We do not use advertising or retargeting cookies. You can configure your browser to refuse cookies; however, this may prevent you from accessing the authenticated dashboard.

We implement industry-standard security measures including TLS encryption in transit, encrypted storage, hashed passwords (bcrypt), and row-level security policies on our database. E-signature records are stored with a SHA-256 audit hash. However, no method of transmission over the Internet or electronic storage is 100% secure.

• Active accounts: Data is retained for the duration of your subscription.
• After cancellation: Data is retained for 90 days, during which you may export it. After 90 days it may be permanently deleted.
• Audit and legal records: E-signature audit logs and financial transaction records may be retained for up to 7 years to comply with legal requirements.
• Verification tokens: Email verification and password reset tokens expire within 24 hours and 1 hour respectively.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Export your organization's data in CSV format via the in-app export feature
• Opt-out of Communications: Unsubscribe from non-essential emails via the unsubscribe link in any email

California Residents (CCPA): You have the right to know what personal information is collected, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.

To exercise your rights, contact us at privacy@rescueworkflow.com. We will respond within 30 days.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately.

Information submitted through your rescue organization's public application portal is collected on behalf of your organization. Your organization (as the data controller) is responsible for handling that data in compliance with applicable privacy laws. Rescue Workflow acts as a data processor on your behalf for this information.

Public applicants may contact the rescue organization directly to exercise their data rights regarding submitted applications.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice. Continued use of the Service after changes are effective constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

📧 privacy@rescueworkflow.com