Privacy & GDPR

The property management company operating a building is the data controller for its residents' data. EvacRoster acts as a data processor, processing that data only on the controller's documented instructions. A Data Processing Agreement (DPA) is available to controllers on request.

• Managers: name, email, and login credentials (passwords are hashed by our auth provider).
• Residents: name, unit, phone, email, languages spoken, mobility needs and notes, medical-training and resource flags, and an emergency contact — all self-provided through the intake form.
• Operational: SMS broadcast records used for compliance evidence.

Mobility and medical information may be special-category data. We collect it only with the resident's explicit consent, captured at intake.

When you opt-in to receive SMS/text messages through EvacRoster, you consent to receive automated emergency alert messages at the mobile number(s) provided. Message frequency varies based on emergency situations and test broadcasts. Message and data rates may apply based on your mobile carrier plan.

Opt-in Process: SMS consent is collected during the resident intake process via a clear checkbox: "I consent to receive emergency alert text messages from this building. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time." By checking this box, you agree to receive SMS alerts for all residents included in the same building submission. Consent includes: date and timestamp of opt-in, phone number(s) that opted in, and the specific message program agreed to receive (emergency alerts and occasional service tests).

Opt-out Procedures: You may opt-out of receiving SMS alerts at any time by replying "STOP" to any message received from EvacRoster. You will receive a one-time confirmation message confirming your opt-out has been processed. To resume receiving alerts, you must opt-in again through the intake form.

Sender Identification: All SMS messages are sent from a verified Twilio phone number registered to EvacRoster. Messages will clearly identify the source as related to your building's emergency alert system.

Message Content: SMS alerts contain emergency information relevant to building safety and evacuation procedures. Periodic test messages may be sent to verify system functionality (typically no more than once per month).

Data Usage and Sharing: Phone numbers provided for SMS opt-in are used exclusively for sending emergency alert messages through our Twilio integration. We do not share SMS opt-in data with third parties except as necessary to deliver messages (Twilio as our messaging provider). Phone numbers are stored encrypted at rest. Your mobile information will never be shared or sold to third parties or lead generators.

Consent Verification: SMS opt-in consent is recorded with a timestamp and linked to the specific building submission. This record is maintained as long as the resident data is retained and can be provided as compliance evidence if requested.

When you opt-in to receive WhatsApp messages through EvacRoster, you consent to receive emergency alert messages via WhatsApp at the phone number(s) provided. Message frequency varies based on emergency situations and test broadcasts. Standard WhatsApp data rates apply based on your mobile carrier and internet plan.

Opt-out Procedures: You may opt-out of receiving WhatsApp alerts at any time by updating your preferences through the intake form or contacting your building management.

• Explicit consent — for residents' special-category (health/mobility) data.
• Legitimate interests / legal obligation — building safety, emergency preparedness, and meeting fire-safety recordkeeping duties.
• Contract — providing the service to the managing company.

• Supabase — database, authentication, and hosting (encryption at rest and in transit).
• Google — authentication via Google Identity Services (GIS) for manager sign-in; only ID tokens are exchanged, no personal data beyond email and name are shared.
• Twilio — sending emergency SMS, only when a manager triggers a broadcast.
• Stripe — subscription billing; residents' personal data is never sent to Stripe.

We do not sell personal data or use it for advertising. When you sign in with Google, Google's privacy policy also applies to your Google account data.

Resident data is kept while the building maintains an active readiness roster and is deleted or anonymised when a manager removes a resident, deletes a building, or closes the account. Broadcast logs may be retained longer where needed as compliance evidence.

Under GDPR, data subjects can request to:

• Access the personal data held about them
• Rectify inaccurate data
• Erase their data ("right to be forgotten")
• Restrict or object to processing
• Withdraw consent at any time
• Receive their data in a portable format

Residents should contact their building manager (the controller) to exercise these rights; managers can action them directly in the dashboard or ask us for assistance.

We use only strictly-necessary cookies to keep managers logged in. No advertising or third-party tracking cookies are set, so no cookie-consent banner is required.

Privacy questions or data-subject requests: contactus@evacroster.com.