Privacy policy

Who we are

Stationed provides the public site and hosted product at https://stationed.tech. Contact: hello@stationed.tech.

What we collect

For an organisation using Stationed we process:

• Account details: name, email, organisation, role, and hashed password.
• Payment details handled by Stripe when you buy a plan or boards (card, billing, and shipping address).
• Operational records: presence events, forms, incidents, tasks, schedules, and audit logs.
• Device metadata: hardware ID, public key, last seen time, and last IP used to talk to the API.
• Optional photos attached to a check, stored in Amazon S3 when configured, otherwise with that event.
• Technical logs needed to run the service (for example request errors).

We never ask for or store GPS coordinates. Presence is proven by a signed board at a named location, redeemed by a signed-in user.

Why we process it

We process this data to provide the service to the organisation that invited you: to authenticate people, issue and redeem challenges, keep an evidence log, send transactional email, and keep the product secure. We do not use it for advertising.

Roles

For people invited by a customer organisation, Stationed is a processor and the organisation is the controller. For website enquiries and our own accounts, Stationed is the controller.

Where it is stored

Production application data is hosted in the European Union. Email, when enabled, is sent through Resend. Payments go through Stripe.

Retention

Records stay while the organisation account is active. Organisations should set their own retention for evidence they hand to clients or auditors. When an organisation is deleted, its data is removed from the live application database. Event history is not editable in the product; corrections are recorded as new events.

Your rights

Depending on where you are, you may ask for access, correction, deletion, or restriction. Staff should raise requests with their organisation first. You can also email hello@stationed.tech.