Privacy Policy

Effective date: June 12, 2026

1. Introduction and scope

SAR Chat (“SAR Chat,” “we,” “us,” or “our”) provides communication, mapping, coordination, and record-keeping tools for Search & Rescue teams through our website at sar.chat and our associated web and mobile applications (collectively, the “Service”). This policy governs our handling of personal information — defined as data that identifies or relates to you as an individual.

By accessing or using the Service, you acknowledge reading and consenting to these practices. We may periodically update this policy to reflect operational or legal changes, notifying users of material revisions by email or prominent in-service notice. We will not retroactively reduce your rights or use information in materially inconsistent ways without your consent.

2. Information we collect

We collect only information reasonably necessary to deliver the Service, fulfill our obligations to your agency, and comply with legal requirements. This includes the following categories:

a) Identifiers and contact details

• Collected when you register, are onboarded by your agency, configure your profile, or contact support.
• Includes your name, callsign, email address, phone number, agency, and role.

b) Commercial transaction records

• Collected when an agency subscribes to a paid plan.
• Includes billing contact, the last four digits of a payment card (processed by a PCI-compliant payment provider — we never store full card numbers), and subscription history, used for billing, tax compliance, and fraud prevention.

c) Technical operation data

• Collected automatically as you use the Service.
• Includes IP address, device type, operating system, application version, and diagnostic or crash logs, used to keep the Service secure and reliable.

d) Operational content

• Created when you use the Service's communication and coordination features.
• Includes messages, pins, rosters, assignments, file attachments (including photos), and location data shared while you are deployed. This content is visible to authorized members of your agency and the channels you belong to.

Withholding essential information — such as the contact details needed to create an account — may prevent us from delivering the Service.

3. How we use information

We use personal information only for the operational purposes below:

• Identifiers and contact details — to authenticate access, deliver critical system and security notifications, and route support requests.
• Commercial transaction records — to process payments through a compliant payment provider and to meet tax obligations under Canadian law.
• Technical operation data — to monitor security, diagnose service disruptions, and understand aggregate usage for capacity planning.
• Operational content and location — to support team coordination during an operation, produce operational and after-action exports for your agency, and resolve issues you report.

Where legally required, we may process information to comply with court orders or to report a privacy breach to the Office of the Information and Privacy Commissioner for British Columbia. We do not use operational content for advertising.

4. Information sharing and disclosure

We share information only where necessary. Internally, access is restricted to personnel with a legitimate operational need. Externally, we share with service providers bound by confidentiality obligations who help us operate the Service (such as hosting, payment processing, and message delivery); with legal authorities when required by a warrant or court order; and with a successor entity during a business transition such as a merger, with advance notice. We never sell your personal information.

5. Data storage, transfers, and security

Your information resides primarily on servers located in Canada. For certain technical functions — such as text-message (SMS) and voice call-out delivery — limited data may transit through or be processed in other jurisdictions, including the United States, under contractual safeguards designed to provide equivalent protection, including encryption in transit (TLS) and at rest.

Our security framework includes role-based access restrictions, row-level access controls so that only authorized members of your agency can see your operational data, internal privacy practices for staff, and monitored infrastructure. No electronic system is perfectly secure; should a breach occur that poses a real risk of significant harm, we will notify affected users without unreasonable delay, along with protective recommendations. You are responsible for keeping your account credentials confidential.

6. Retention

We retain personal information only as long as necessary to fulfill the purposes in this policy, balancing operational requirements, legal mandates, the sensitivity of the data, and the technical feasibility of secure deletion. Agencies own their operational records and control retention and export. When information is no longer needed, it is securely destroyed using methods proportionate to its sensitivity. Where immediate deletion is constrained by our systems or by law, we apply strict access controls and encryption until permanent destruction is practicable. You may request specifics about retention timelines by contacting our Privacy Officer.

7. Your rights

Under British Columbia's Personal Information Protection Act, you may:

• Request confirmation that we process your data and obtain a copy of your personal information.
• Request correction of inaccurate or outdated records.
• Withdraw consent for non-essential processing.
• Request erasure where legally permissible (for example, where data is no longer needed for its original purpose).

Contact our Privacy Officer to exercise these rights. We respond within 30 days and verify your identity through existing authentication or government-issued ID to prevent fraud. We never sell personal information and do not degrade the Service for users who exercise their privacy rights.

8. Cookies and tracking technologies

• Essential cookies maintain your session and protect against cross-site request forgery; they cannot be disabled.
• Analytics — we use limited, privacy-conscious analytics to understand aggregate usage and keep the Service reliable. We do not use advertising or cross-site tracking cookies.

9. Additional provisions

Links on our website may lead to third-party platforms whose privacy practices we do not control. The Service is not directed to children, and we do not knowingly collect personal information from minors; suspected collection should be reported for prompt deletion. Service-critical notices are sent to your registered contact email, while promotional communications require separate opt-in consent under Canada's Anti-Spam Legislation and include a one-click unsubscribe.

10. Contact and complaints

Direct privacy inquiries or requests to our Privacy Officer at info@sar.chat (British Columbia, Canada). We investigate complaints promptly and cooperate with the Office of the Information and Privacy Commissioner for British Columbia on any unresolved matter.