Privacy Policy

Last updated October 12, 2026

This policy explains what Safeguards Tracker, run by Golden Rock (San Antonio, Texas), collects and how we use it.

What we collect

• Account details: your name, work email, business name, and the people you invite.
• Program records you enter: task status and notes, risks, vendors, training records, incidents, and evidence files you upload.
• Billing: handled by Stripe. We receive your subscription status and a customer ID, never your full card number.
• Referrals: if you sign up through another business's invite link, we record which business invited you so we can give them their free month. They only see how many businesses signed up through their link and how many subscribed, never which ones.
• Checklist emails: if you ask for the free checklist by email, your email address, the page you asked from, and when you confirmed or unsubscribed.
• Technical data: sign-in times, IP addresses in short-lived security logs, and privacy-friendly page analytics from Cloudflare that don't use cookies. If you arrive from one of our ads, a first-party cookie remembers that ad's name for 30 days so we can tell which ads lead to sign-ups; it isn't shared or used to follow you on other sites.

How we use it

Only to run the service: signing you in, showing your program to your team, sending sign-in links, invites, the weekly reminder and billing notices, and keeping the service secure. If you asked for the checklist by email and confirmed, we send it and two short tips emails; each has a one-click unsubscribe. We don't sell your data, share it for advertising, or use your program records to train AI models.

Who else handles it

• Google Cloud (United States) hosts the server and database.
• Cloudflare carries traffic to the service over HTTPS.
• Stripe processes payments.
• Our email provider delivers sign-in links and reminders.

We may disclose information if the law requires it, and we'll tell you first when we're allowed to.

Security

Traffic is encrypted with HTTPS. Each business's records are kept separate and are visible only to its signed-in team members. Evidence files are stored privately and served only as downloads to your team. Sign-in links are single-use and expire. We back up the database and evidence files every night, with an off-site copy.

Keeping and deleting data

We keep your data while your account is open. When the account owner deletes the business in Settings, we delete its records and files right away. Copies inside our nightly backups are deleted on a rolling schedule, within about 120 days. If a subscription lapses, we keep the data for at least 60 days so you can come back or export it. For checklist emails, we keep your address while you're subscribed. After you unsubscribe we keep only the address and the date, so we never email it again; ask us through the contact page to delete it entirely.

Your choices

The account owner can export all data from Settings at any time, turn off reminder emails, or delete the account. For anything else, including access or correction requests, reach us through our contact page.