Privacy Policy

1. Who we are

TurnoutFlow provides recruitment, onboarding, and retention software for fire and EMS organizations, including volunteer, career, and combination departments. This Privacy Policy explains how we collect, use, and protect personal information across our marketing website and the TurnoutFlow platform.

2. Our role

For applicant and member information collected through a department's application and onboarding process, the department (not TurnoutFlow) decides what to collect and why. TurnoutFlow processes that information on the department's behalf and under its instructions. Questions about a specific department's application should be directed to that department. For information collected on our own marketing site (such as demo requests and email subscriptions), TurnoutFlow is the responsible party.

3. Information we collect

Marketing site: organization name, contact name, email, phone, and department details you submit when requesting a demo or subscribing to campaign emails, plus standard technical information from your visit (IP address, browser and device type, referring page, and the pages you view), including through the advertising cookies described in section 4. Platform: staff account details (name, email, password hashes); applicant application data submitted to a department, which may include demographics, employment history, certifications, screening responses, identity documents, and, where a department requires it, Social Security numbers; messages exchanged through the applicant portal; uploaded documents; and technical logs. Within the platform we also record limited, non-identifying product analytics (for example, that an application step was completed) that contain no names, emails, or narrative content.

4. Cookies and advertising

Our marketing website uses the Meta (Facebook) pixel to measure how our advertising performs, for example, how many people who saw an ad went on to request a demo. The pixel sets cookies and sends Meta your IP address, browser and device information, and which pages you viewed on our site; Meta may match that activity to a Facebook or Instagram account. This runs on our marketing website only. It is not part of the TurnoutFlow platform, so applicant and member activity inside a department's workspace is never sent to Meta. You can limit this tracking through your browser's cookie settings, your Meta ad preferences and off-Facebook activity controls, or a tracking-protection extension. The platform itself uses cookies only for essential purposes such as keeping you signed in.

5. Sensitive information

Social Security numbers are encrypted at rest; only the last four digits are ever re-displayed, and full SSNs are never included in logs, analytics, audit records, or error reports. Uploaded documents are stored in access-controlled object storage and served only through short-lived signed links. Screening narrative responses are excluded from audit snapshots.

6. How we use information

We use personal information to operate the Service: processing applications on behalf of departments, sending transactional email (secure sign-in links, application status, interview and onboarding notifications, weekly summaries requested by department staff), providing support, billing subscriptions, securing the platform, and improving the product using de-identified usage data. If a department chooses to, we also keep its staff's requests to the AI report builder, and the reports they produced, with the names on its roster removed, so we can find and fix the AI's mistakes; only TurnoutFlow staff see them, and they are not used to train AI models. Marketing emails are sent only to people who requested them, and every marketing email includes an unsubscribe link.

7. How we share information

We do not sell personal information for money. We share it only with: the department you applied to (that is the purpose of the Service); service providers who help us run the platform (hosting, object storage, email delivery, payment processing), bound to use it only for those services; Amazon Web Services, which hosts the platform and, through Amazon Bedrock in the United States, runs the optional AI report builder for department staff (it receives the text of a staff member's request and the report's settings, not the department's records, and does not store them, use them to train models, or share them with the AI model's developer); Meta, limited to the marketing-website advertising measurement described in section 4; and authorities where required by law. Because that measurement involves cross-context behavioral advertising, some U.S. state privacy laws may treat it as "sharing" or as a "sale," you can opt out using the controls in section 4. Payment card details are handled by our payment processor and never stored by TurnoutFlow.

• Customer data is not shared with third parties for promotional or marketing purposes.
• Mobile opt-in and consent are never shared with anyone for any purpose. Any information sharing that may be mentioned elsewhere in this policy excludes mobile opt-in data.

8. Messaging program terms and conditions

If you opt in to text messages from TurnoutFlow, these terms apply.

1. The messaging program may consist of general customer care messaging to answer questions and provide support to customers, and/or marketing messaging that include discount codes, special deals or texts promoting our products/services, depending on which program(s) you opt in to. We will only send content you have explicitly signed up to receive via our opt-in process. Messages will be sent from (585) 449-9399.
2. You can cancel the SMS service at any time. Just text "STOP" to the phone number from which you received messages. After you send the SMS message "STOP" to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time and we will start sending SMS messages to you again.
3. If you are experiencing issues with the messaging program you can reply with the keyword HELP for more assistance, or you can get help directly at [email protected].
4. Carriers are not liable for delayed or undelivered messages.
5. As always, message and data rates may apply for any messages sent to you from us and to us from you. Message frequency will vary based on communication needs. If you have any questions about your text plan or data plan, it is best to contact your wireless provider.
6. If you have any questions regarding privacy, please read our privacy policy details contained in the rest of this page or contact us at [email protected].

9. Retention

We retain platform data for as long as the subscribing department maintains its account, and delete or de-identify it after the department's account closes and the export window in its Subscriber Agreement ends. Departments control retention of their applicant records within the platform, subject to their own legal obligations. AI report requests a department chooses to keep are deleted after 90 days, or as soon as the department stops keeping them. Marketing contact data is retained until you unsubscribe or ask us to delete it.

10. Security

Data is isolated per organization at every layer of the platform. We use encryption in transit, encryption at rest for the most sensitive fields, hashed single-use sign-in tokens, role-based access, and append-only audit logging of critical actions. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify affected parties as required by law.

11. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information. For applicant data, contact the department you applied to and we will support their response; for marketing data, contact us directly. You can unsubscribe from marketing email at any time via the link in each message, and opt out of advertising cookies on our marketing website as described in section 4. You can delete your TurnoutFlow account yourself at any time from your profile page, on the web or in the app: that removes your sign-in email, password, sessions, registered phones and alert settings straight away. Fire and EMS departments are required by public-records and retention laws to keep their own records, so your roster entry, call responses, incident, training and LOSAP records, submitted applications and their audit trail stay with the department; contact the department about those records. We will not discriminate against you for exercising your rights.

12. Children

The Service is not directed at children under 13, and we do not knowingly collect their information. Junior or cadet membership programs, where offered, are administered by the individual department, including any parental-consent requirements.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced by email or in-product notice before they take effect, and the "Last updated" date above will always reflect the current version.

14. Contact

Privacy questions or requests: [email protected].