GUARDHELM PRIVACY NOTICE ======================== Version 2026-10-17 Effective 17 October 2026 This notice explains what GuardHelm collects about the people who use it, who can see it, and how long it is kept. It is written for guards. Office staff who use the GuardHelm console are covered too, in their own section near the end. GuardHelm is run by Bereme W.L.L. In this notice "we" means Bereme W.L.L. "Your employer" means the security company you work for, which chose to use GuardHelm and decides how parts of it are set up. Questions, or a request about your data: sos@jr.al THE SHORT VERSION ----------------- - While you are signed in, the guard app records your phone's location in the background, on shift and off shift. Your employer controls this and can turn it off. Location points are deleted after 90 days. - What you create at work, such as clock-ins, patrol scans, reports, photos and voice notes, is a work record. Nobody can edit or delete it, and no end date has been set for keeping it. - Calls between you and the office are not recorded today. You can call the GuardHelm assistant only after you say yes, and those calls are transcribed. - Your employer's office can see your location, your records and your pay. Your employer's clients see only the reports your employer releases to them, without your name. - We do not sell your data. There is no advertising or analytics code in GuardHelm. LOCATION -------- -- When it is recorded -- While you are signed in to the guard app, it records your phone's location in the background, on shift and off shift, including when the app is closed. Your employer has this on unless it turns it off. - On shift: a new point each time you move about 25 metres, and a check every 5 minutes while you are still. - Off shift: a new point each time you move about 100 metres, and a check every 15 minutes while you are still. A still iPhone off shift may send nothing. The app also takes one location reading when you clock in, clock out, start or end a break, and at a patrol stop that asks for a photo. -- What a point contains -- Latitude and longitude, how accurate your phone thinks the reading is, the time, your battery level, whether your phone flagged the location as faked, and what caused the reading: moving, a timed check, or a change to your location settings. Speed, heading, altitude and what you were doing are not sent. We do not turn your position into an address. -- How you can tell -- While location is being recorded, the app shows "Location on" at the top of the screen. On Android a notification stays up saying GuardHelm is recording your location for your employer. On iPhone the location indicator shows in the status bar. There is no hidden mode. -- Who controls it -- - Your employer can turn tracking off for the whole company, or for you alone. Each change needs a reason and is recorded with the name of the person who made it. - We can pause tracking for a whole company, and lift that pause. We have no switch for a single guard. - The app has no on/off switch. You can turn location off in your phone's Settings, or allow it only while the app is open. Background recording then stops. Clocking in and out still works, and your pay does not depend on your location. - Your employer asks for your consent to location tracking on paper, outside the app. GuardHelm does not hold a copy. - Signing out of the app stops tracking on that phone. Only guard accounts are tracked. Office accounts never are. -- Who can see your location -- - Supervisors, dispatchers, admins and owners who cover every site can see each guard's latest position, on shift and off shift. Their views of off-shift positions are logged with their names. - Office staff limited to certain sites see your position only while you are on shift at one of their sites. - Supervisors and above can see the positions recorded during a shift, and the exact position recorded with each clock-in, clock-out and break. You can see your own. - If your phone stops sending its location during a shift, or location is turned off or set to approximate, your office gets an alert. - Your employer's clients never see your coordinates. A receipt your employer shares with a client can say whether a punch or scan was made at the site. -- How long it is kept -- - Background location points are deleted 90 days after they were recorded, by a job that runs every night. - Your latest position is cleared from the live map after 5 days. - Points your phone could not send are dropped from the phone after 3 days, or oldest first once more than 5,000 are waiting. - Some points are kept longer. A point that set off an alert your employer has to review, such as leaving your site during a shift, is kept with that alert. Points under a legal hold are kept until the hold ends. The position recorded with a punch or a photo stop is part of that work record and is kept with it. WORK RECORDS ------------ What you create in the app is a work record: clock-ins and clock-outs, breaks, checkpoint scans, incident reports and their follow-up notes, and the photos and voice notes in them. Your phone signs each record with a key only that phone holds, and the office sends back a signed receipt. Nobody can edit or delete a work record. That includes you, your employer and GuardHelm. A mistake is fixed by adding a correction beside the original, with the name of whoever made it. That protects you too. Nobody can quietly rewrite what you filed, or make a shift you worked disappear. No end date has been set for keeping work records. If one is set, this notice will change. The text of your reports and follow-up notes, and the position recorded with each punch, are encrypted on our servers. Reading them needs a key that is kept outside the database. Your employer sets a pay rate for each shift, and GuardHelm works out your hours from your punches. You can see your own hours and pay in the app. THE CAMERA AND PHOTOS --------------------- The camera is used to: - scan the setup code your office gives you - scan patrol checkpoint tags - take a photo at a patrol stop that asks for one - add photos to an incident report or a message, when you choose to A photo is taken only when you press the shutter. Photos are saved without the location data cameras usually add to them. They are signed and sent to your office. Photos in a report stay with the report. If your employer releases that report to a client, the client can see its photos. Photos in a message follow the rules for messages below. THE MICROPHONE, VOICE NOTES AND TRANSCRIPTS ------------------------------------------- The microphone is used during a call in the app, and when you tap Record to make a voice note in an incident report or a message thread. A voice note stops when you stop it, or after two minutes. A computer turns voice notes into text, using a speech-to-text service that Cloudflare runs for us. The text is marked as automatic and may be wrong. It never replaces what you write. - In an incident report, the office can ask for the text after you send the report. The recording and its text are kept with the report. - In a message thread, the text is made after you send the note. Both follow the rules for messages below. - If you tap "Show what it heard" before you send a report, the recording goes to our server and to that service to make the text. That preview is not stored. - You can ask for an AI draft of the report from that text. An AI model that Cloudflare runs for us writes it. The draft is not stored and is never filed. You copy what you want into your own words, or ignore it. Record your own account. Do not record other people without telling them, because some places require everyone's consent. CALLS ----- -- Calls with your office -- You can call your office from the app, and your office can call you in it, including to check that you are OK. A call from the office rings with your phone's own call screen, even when the phone is locked. The app checks that the call is for the guard signed in on that phone, and a call meant for someone else stops at once. These calls run over the internet through Cloudflare, not over the phone network. They do not appear in your phone's call history. Today they are not recorded. We keep a record that each call happened: who called whom, when it rang, when it was answered and ended, and the shift and site it belonged to. Your employer can see that record. Call records are deleted after one year, unless they are under a legal hold. Calls in the app are not for emergencies. In an emergency, call 911 from your phone. The Help screen's call button uses your phone's own dialer to call your site's number. -- Calls to the GuardHelm assistant -- The assistant is a computer, not a person. It answers questions about your shifts, your post and its instructions. - Before your first assistant call, the app asks your permission. You can say no and still use everything else, and change your mind later on the Help screen. - Each call begins by saying it is recorded and transcribed. We keep the text of what you said, including anything you said while the assistant was talking, and of what it answered. The audio is not saved. - Turning your speech into text, writing the assistant's answers and speaking them are done by AI models that Cloudflare runs for us. - An assistant call ends after 10 minutes. - Transcripts are encrypted, kept with your employer's records, and deleted after one year unless they are under a legal hold. MESSAGES -------- The app has message threads: with your office, and with the guards and office staff at a site. Messages and their attachments are encrypted on our servers. Each thread is read by the people it is for: a thread with the office by the office staff who cover you, a site thread by the guards and office staff of that site. The people in a thread can see when a message reached your phone and when you read it. Your employer sets how long messages are kept, anywhere from 30 days to 7 years. The default is one year. After that, the messages are deleted along with their photos, voice notes and transcripts. Your employer's clients never see messages. NOTIFICATIONS ------------- To send notifications to your phone, the app registers it with Expo, a notification service, which passes them on through Apple or Google. A notification carries one fixed sentence and a reference number for the shift. It does not carry details such as your site's name. To ring your phone for a call, our server sends a call signal straight to Apple or Google. It names no company, person, place or shift. When you sign out, the phone stops taking calls and we stop sending to it. WHAT WE KEEP ABOUT YOU ---------------------- - Your name, your email address, and your phone number if your employer adds it. - Your role in your company, whether your account is active, and the history of changes to both. - Your sign-in details, if you have them: a scrambled form of your password, and any two-step sign-in codes. - Your licences, if your employer records them: the number, who issued it, its dates and any notes. Only admins and owners can see the full number. - Your availability and your time-off requests. - The pay rate your employer set for each of your shifts, and your hours. - Your phone: whether it is an iPhone or an Android phone, its system and app versions, its battery level and charging state, its network connection, and whether location, notifications, the camera and the microphone are allowed. These reports are deleted after 90 days, except the newest one for each phone. - Your sign-ins: when each session started, when it was last used and when it ended, and a scrambled form of your IP address and your phone or browser type. Someone determined could reverse that scrambling, so do not treat it as strong protection. - A log of who in your company opened your records, downloaded files about you or saw your off-shift location. That log cannot be edited or deleted. - Your answers to welfare checks, your acknowledgements of announcements, your answers to the assistant's permission question, and your acknowledgements of this notice. - Your name on the monthly statement GuardHelm prepares for your employer, for each month you clocked in. Only your employer's owners see it. We do not collect your date of birth, home address, social security number, bank details or a profile photo. We do not collect your phone's serial number, IMEI, advertising ID or any other hardware identifier. WHO CAN SEE YOUR DATA --------------------- -- You -- Your own punches, receipts, hours and pay, the positions recorded during your own shifts, and your reports before you send them. -- Your employer's office -- - Supervisors, dispatchers, admins and owners can see your punches and their exact positions, your patrol scans, your reports with their photos and voice notes, your hours and pay rate, and your location as described above. - They can download timesheets and payroll files that include your email address, hours, pay rate and pay. A downloaded file is outside GuardHelm's control. We log who downloaded it and when. - Office accounts limited to certain sites see your records only for those sites. -- Your employer's clients -- Your employer can release shift reports and incident reports to its clients. A released report includes what you wrote and its photos. It does not include your name, your email address, your hours, your pay or your coordinates. -- Other security companies -- None of your data. Every record is locked to your employer in the database itself. -- GuardHelm -- We run the servers, so people at GuardHelm with access to the production systems can reach what is stored. The key to the encrypted parts is kept separately, so database access alone does not let them read report text, punch positions, messages or assistant transcripts. They can read everything else, including background location points, which are not encrypted by GuardHelm itself. SUPPLIERS --------- These companies help us run GuardHelm and handle your data as part of doing so: - Cloudflare: servers, network, file storage for photos and voice notes, in-app calls, the AI models for speech-to-text and the assistant, and server logs. - Neon: the database, hosted on Amazon Web Services in Ohio, USA. - Expo: delivers notifications to your phone. - Apple and Google: deliver notifications and call signals to iPhones and Android phones, and provide your phone's location services. - Transistorsoft: makes the location component built into the app. The app sends your location only to GuardHelm. We have not confirmed whether that component contacts Transistorsoft on its own, for example to check its licence. No advertising, analytics or crash-reporting company receives your data, and none of their code is in the app or the console. We do not sell your data. GuardHelm sends no email or text messages today. Your office hands you invitations and setup codes itself. WHERE YOUR DATA IS HELD ----------------------- The database is in the United States, in Ohio, and our servers are set to run beside it. Some work, such as speech-to-text and parts of calls, runs wherever Cloudflare's network handles it. Your phone's requests first reach the nearest Cloudflare location, which can be outside the United States. Cloudflare stores photos, voice notes and other files, and we have not chosen a region for them. ON YOUR PHONE ------------- - The app keeps a working copy so it keeps working with no signal: the records you create and their receipts, your current shift, your post orders, your site's emergency number, your hours, your messages and any report you have not finished. - Report text, unfinished reports and punch positions are encrypted on the phone. The key is locked to that phone and is not included in phone backups. - Once the office confirms a record, the phone erases that record's text and its key. - Signing out erases everything GuardHelm stored on the phone. The app will not let you sign out while you are clocked in, while records are still waiting to send, or while a report is unfinished. - If you lose your phone, tell your office. They can mark it lost, which ends its sessions and stops GuardHelm accepting anything new from it. Records that had not reached the office cannot be recovered. HOW LONG WE KEEP IT ------------------- - Background location points: 90 days. - Your latest position on the live map: 5 days. - Phone reports: 90 days, except the newest one. - Call records and assistant transcripts: one year. - Messages: what your employer sets, from 30 days to 7 years. The default is one year. - Work records, the photos and voice notes in reports, receipts and timesheet approvals: no end date set. - Your account, your sign-in history, the log of who saw your data, and your acknowledgements: no end date set. - Anything under a legal hold your employer places: until the hold ends. When something is deleted, copies can stay in our suppliers' backups for a limited time until those backups expire. IF YOU LEAVE YOUR EMPLOYER -------------------------- When your employer removes you, you lose access and tracking stops. Your records stay with your employer's records, under the periods above. YOUR CHOICES AND REQUESTS ------------------------- - Location: your phone's Settings, or ask your employer. - The assistant: say yes or no when the app asks, and change your answer on the Help screen. - A copy: the Receipts and Hours screens let you share a list of your own records and hours. There is no button that downloads everything we hold about you. - Anything else: write to sos@jr.al with your name and your employer's name to ask for a copy of your data, a correction or a deletion, or to ask about this notice. Work records cannot be deleted, and your employer may need to keep other records too. We will tell you what we can do. You can also ask your employer. READING THIS NOTICE IN THE APP ------------------------------ The app and the console show a card asking you to read this notice. Tapping "I have read this notice" records that you acknowledged this version, together with a fingerprint of its exact text, so nobody can later change the text and claim you saw something else. It records that you read the notice. It is not a consent. It never blocks clocking in, clocking out, reports or pay. OFFICE STAFF USING THE CONSOLE ------------------------------ We keep your name, email address, role and the sites you cover, your sign-in details including two-step sign-in, your sessions as described above, and a log of what you open and change. That log cannot be edited or deleted. Calls you take in the console are kept as call records, without audio. Office accounts are never location tracked. If you switch the console's site map to satellite view, the imagery loads from the US Geological Survey, which sees your IP address and the area you are viewing. CHANGES TO THIS NOTICE ---------------------- Each version is stored unchanged, with a fingerprint of its exact text. A change means a new version. Old versions, and who read them, stay on record. When a new version takes effect, the app asks you to read it. CONTACT ------- Bereme W.L.L, which runs GuardHelm sos@jr.al