Privacy Policy

Who we are and how to contact us

Vertex Readiness is a facility-readiness and recordkeeping app provided under the Vertex Fire Protection and Safety brand and operated by Michael E. Aldaco. This policy explains how information is handled through vertexreadiness.com and its installed web-app experience.

For privacy questions, access, correction, or deletion requests, email support@vertexreadiness.com. A future change in the legal operator or data practices will be reflected in an updated policy.

Information we collect

• Account and contact information: your name, sign-in email, authentication identifiers, verification status, and business/contact details you enter, including optional phone numbers and timezone. Supabase handles password authentication; we do not ask you to send passwords to support.
• Facility and workspace information: facility names and addresses, profiles, local requirements, observations, inspection and service dates, drafts, completed records, corrective actions, responsible-person names, and other information you choose to enter.
• Photos and documents: uploaded images, PDFs, filenames, descriptions, categories, file metadata, and links to the related facility, record, or finding. Uploaded files may include embedded metadata. Avoid unnecessary sensitive information about employees, occupants, or others.
• Reminder and device information: schedules, timezones, chosen recipients, delivery preferences and status, and browser push subscription endpoints and keys when you enable device notifications. A phone number or SMS preference may be saved even when SMS delivery is not connected.
• Billing and purchase acknowledgments: Stripe customer, checkout, and subscription identifiers, selected prices, payment/access status, relevant dates, and the version of the purchase disclaimer acknowledged at checkout. Real payments are not enabled at this time.
• Technical and support information: service providers may process IP addresses, browser/device information, request timestamps, security and error logs, delivery logs, and messages or screenshots you send to support.

How we use information

We use information to create and authenticate accounts; provide facility workspaces, records, exports, and downloads; deliver reminders you enable; manage plans and access; respond to support and privacy requests; investigate errors, fraud, or misuse; maintain security; and meet applicable legal obligations.

Only enter information you are authorized to provide. The service is for owner observations and recordkeeping; do not use it to store unnecessary medical records, government identification numbers, passwords, or payment card details.

Payments are handled by Stripe

Checkout and payment-management pages are hosted by Stripe. Payment card numbers, security codes, and other payment credentials entered there go directly to Stripe, rather than through our app's payment form. Our app does not store full card numbers or card security codes.

Stripe may collect payment, billing, device, and transaction information for payment processing, fraud prevention, and its legal obligations. Stripe may make transaction and limited billing details available to the operator through its dashboard. Our app stores billing references and status needed to manage access, not full card credentials. Use test payment details only while checkout is in sandbox mode.

When information is shared

• Supabase: account authentication, database records, and private file storage.
• Vercel: hosting, request processing, scheduled jobs, and operational logs.
• Resend: account/reminder emails, recipient addresses, delivery information, and support messages. Reminder emails may include facility details and calendar attachments.
• Stripe: checkout, purchase acknowledgments, payment/subscription administration, and related billing references.
• Push and calendar providers: your browser/device push service processes notifications you enable. A calendar provider receives event information when you choose a calendar link or import an event. People and apps you choose for sharing receive the content you send.
• Other necessary disclosures: information may be disclosed when required by law, to protect safety or legal rights, or in a business transfer subject to applicable privacy obligations.

We use service providers to operate the app, not to sell your facility records. We do not sell personal information, rent customer lists, or use app data for targeted advertising. The current app does not include advertising SDKs or cross-app advertising tracking. SMS delivery is not currently connected; we will update the disclosures before activating a new SMS provider.

Each sign-in has its own workspace. Shared employee access is not currently enabled. Authorized support or administrative access may be used when needed for operation, security, or a verified request.

Cookies, device permissions, and your choices

Authentication uses necessary cookies or browser storage to maintain your session. Blocking these can prevent sign-in. Browser permission is requested when you choose to enable device notifications. You can disable notifications through the app or your browser/device settings and pause email summaries under Reminders.

You choose which files to upload and which calendar or sharing app to use. The current web app does not request your contacts or GPS location. A facility address you enter is stored as part of your workspace. Calendar copies and files you export are separate from the app and are not automatically updated or deleted when app records change.

How logs, reminder dates, and uploads are stored and protected

Storage and encryption at rest

Facility logs, observations, corrective actions, internal business records, reminder dates and schedules, and account information are stored in the app's hosted Supabase database. Uploaded photos and PDFs are stored in a private Supabase Storage bucket; file descriptions and record links are kept in the database. Your workspace is cloud-hosted, not stored only on your device.

Supabase states that customer data is encrypted at rest using AES-256 and in transit using TLS. We rely on that provider-managed encryption for stored database and file data; encryption keys are managed by the provider rather than supplied by individual app users. See Supabase's security information.

Encryption in transit

The app is served over HTTPS/TLS, and connections to the Supabase web APIs use HTTPS. This protects data while it travels between your browser, the app, and its storage APIs. Vercel documents TLS protection for hosted connections and AES-256 encryption for data stored on disk within its infrastructure, such as retained hosting data. See Vercel's security measures.

Account and file access controls

Signed-in requests are checked against the account that owns the data. Database row-level security and facility/owner checks restrict workspace access. File uploads require an authenticated owner and an authorized facility; uploaded records are not placed in a public file bucket. An authorized download creates a signed file link with a 60-second validity period. Anyone holding that issued link can use it until it expires, so do not forward private download links.

Private workspace responses are marked not to be stored in shared public caches. Server-side administrative credentials are kept out of browser code. Authorized application services and administrators can access data when needed to operate the service, deliver enabled reminders, provide support, address security issues, or fulfill verified requests.

Limits of encryption and exported information

The service does not provide end-to-end encryption or user-held encryption keys. Provider-managed encryption does not prevent authorized services or administrators from processing readable data for the purposes described in this policy.

When you enable reminder emails, relevant facility and event details may leave the private workspace for email delivery. Emails, calendar links, and exported calendar files are not protected by the app's sign-in once shared or downloaded. Calendar links include event details in the URL and can be opened without signing in; those details may remain in browser history or service logs. Anyone with the complete link or file may be able to read its event details. Share only with intended recipients and avoid confidential information in reminder titles or calendar descriptions.

Imported calendar events, downloaded PDFs, printed logs, email copies, and files saved on a device are protected by that device, recipient, or external provider's controls, rather than the app's private workspace rules. They are not automatically updated or removed when app data changes or an account is deleted.

No system can guarantee absolute security. Protect your sign-in, use trusted devices, and do not send passwords, verification codes, or full card details to support.

Processing locations

Our service providers may process information in the United States or other countries where they operate. Privacy protections can differ from those in your location. This policy does not promise that every copy, operational log, email, or calendar export stays in a single country.

Retention

Account and workspace information is retained while the account remains active and as needed to provide the service, including continued access to existing records when Plus ends. Ending a subscription or archiving a document does not delete the account or permanently erase stored files.

After a verified deletion request, we review the account and associated data for deletion. Limited information may need to be retained for taxes, payment records, fraud prevention, security, dispute resolution, or other legal requirements, for as long as those reasons apply. We will explain relevant exceptions when responding to a request. Service-provider backups and logs, where applicable, are subject to their retention cycles; copies you exported or shared remain under your or the recipient's control.

Access, correction, and account deletion

You can update business contact details in Account & access, view and print records, download existing attachments, and manage reminder preferences. Changing your contact email does not change your sign-in email or transfer ownership.

To request account deletion and deletion of associated personal/workspace data, email support@vertexreadiness.com from your registered account email and state that you want your Vertex Readiness account deleted. Contact support if you no longer control that email. You may also request access, correction, or deletion of specific information. We verify your authority before disclosing or changing data; do not send identity documents unless a secure verification method has been agreed.

You can start permanent account deletion in Account & access → Delete account, confirm your password, and type DELETE. The feature requires the account-deletion database setup to be active; if setup is pending or you cannot sign in, use the support contact above. Deletion removes the sign-in, workspace records, and private uploaded files. Any incomplete deletion must be retried or completed with support. Merely disabling an account is not a substitute for fulfilling a deletion request. We will explain any information that must be retained. Existing sandbox subscriptions are cancelled as part of the automated deletion flow. Live mobile purchases are not yet enabled. Payment-provider records and service backups may remain subject to their retention requirements.

Depending on your location, you may have additional privacy rights, including rights to access, correct, delete, or obtain a copy of your information. Contact us to exercise applicable rights or raise a concern. We will handle requests in accordance with applicable law.

Children

Vertex Readiness is intended for business and facility use, not for children under 13. We do not knowingly seek personal information from children under 13. Contact support if you believe a child has provided personal information so it can be reviewed for deletion.

Changes to this policy

We will update this page and its effective date when practices change. Material changes will be communicated through an appropriate in-app or account notice when required. New data uses that require consent will not be enabled solely by changing this policy.