Privacy Policy

SoberAuth respects your privacy. This Privacy Policy explains what information SoberAuth collects, how we use and disclose it, how long we generally retain it, and the choices available to users of our website, mobile applications, access control platform, and related services.

1. Information We Collect

Depending on your role and the features configured by your organization, we may collect:

• Account Information: First and last name, email address, phone number, user ID, password credentials, account status, and session information.
• Organization and Facility Information: Organization and facility names, facility location, membership, assigned role, access keys, operational settings, and escalation contacts.
• Access and Activity Information: Door access requests and results, lock and hub events, timestamps, alerts, acknowledgments, administrative actions, and related activity history.
• Breath Test Information: Test status, estimated blood alcohol concentration (BAC), connected breathalyzer name, test errors, battery conditions, and the facility associated with the test.
• Verification Video: A short front camera video recorded during an access breath test. The current workflow records video without audio and does not perform facial recognition or create biometric face templates.
• Location Information: Precise latitude and longitude captured once when an access breath test is submitted. SoberAuth does not continuously track users or collect background location.
• Hub and Device Information: Hub and smart lock identifiers, provider type, device name and location, connection status, battery condition, signal quality, firmware, and command results.
• App and Mobile Device Information: Device platform and name, operating system version, app version, push notification token, IP address, login activity, and diagnostic or security logs.
• Communications: Support requests, contact form submissions, account and membership emails, push notification events, and records related to automated alert calls.

2. Mobile Permissions

The SoberAuth mobile app may request permission to use:

• Camera: To display a front camera preview and record a short verification video during an access breath test.
• Precise Location: To capture location once when a breath test is submitted for facility access.
• Bluetooth and Nearby Devices: To discover, connect to, and communicate with a compatible breathalyzer.
• Notifications: To deliver facility, hub, lock, battery, background process, and alert escalation updates.

Permissions can be managed through your mobile device settings. Disabling a permission may prevent the related feature or access workflow from operating.

3. How We Use Information

• Create, authenticate, secure, and maintain user accounts and sessions.
• Confirm organization and facility membership and apply permissions based on assigned roles.
• Process facility access requests and communicate with compatible hubs and locks.
• Conduct breath test workflows configured by the organization and record their results.
• Maintain activity, test, alert, acknowledgment, and operational histories.
• Monitor hub and device availability, battery conditions, and background operations.
• Provision and support emergency offline access configured by facility staff.
• Send service emails, push notifications, and automated alert escalation calls.
• Provide customer support, investigate problems, prevent misuse, and improve reliability.
• Comply with applicable U.S. law and protect SoberAuth, participating organizations, and users.

4. Organization Access to Information

SoberAuth is generally used through a participating organization. Authorized administrators and staff may view information associated with their organization or facility, including user membership, activities, alerts, breath test results, verification video, and test location. Residents do not receive the same administrative access. Each organization is responsible for assigning appropriate roles, configuring its workflows, and using the information available to it lawfully and responsibly.

5. Verification and Access Decisions

Facilities may configure breath tests to occur on every entry, never, or according to a stated random probability. They may also configure a BAC access limit and the action taken after a failed test. SoberAuth uses these settings, recent test records, device availability, and operational conditions to support an access request. BAC measurements are estimates produced by compatible third party devices and are not medical, legal, employment, or law enforcement tests.

6. Emails, Push Notifications, and Automated Calls

• Email: We may send account, membership, security, and service emails.
• Push Notifications: With mobile permission, we may send operational information, warnings, errors, and alert escalation notices.
• Automated Voice Calls: We may place automated or prerecorded calls to authorized escalation contacts when a critical alert has not been acknowledged.

These communications are operational and are not advertising or telemarketing. Frequency varies based on facility events. Carrier calling or data charges may apply. SoberAuth does not currently send SMS or MMS messages. Users may disable push notifications in device settings and may contact us regarding automated calls, although doing so may prevent delivery of urgent facility alerts.

7. How We Share Information

We do not sell personal information. We may disclose information:

• To authorized administrators and staff associated with the relevant organization or facility.
• To service providers that support hosting, storage, email, push notifications, automated calls, security, video processing, and connected device functionality.
• At the direction of a participating organization or when a user requests or authorizes the disclosure.
• When required by applicable U.S. law, legal process, or a valid government request.
• When reasonably necessary to investigate misuse or protect users, organizations, SoberAuth, or others.
• As part of a merger, acquisition, financing, reorganization, or sale of all or part of the business, subject to applicable law.

8. Data Retention

• Breath Tests: Completed test records, verification videos, and associated location information are currently scheduled for deletion after 90 days.
• Activities: Activity records are currently scheduled for deletion after one year.
• Other Records: Account, membership, facility, device, alert, communication, security, and business records are retained for as long as reasonably necessary to operate and secure the Services, meet legal obligations, resolve disputes, and enforce agreements.

Information may remain for a limited additional period in backups or when preservation is required by law. Retention periods may change as operational or legal requirements evolve.

9. Data Security

We use administrative, technical, and organizational safeguards designed to protect information, including authenticated sessions, authorization based on assigned roles, password hashing, security logging, and restricted access to retained records. No system or transmission method is completely secure, and we cannot guarantee absolute security. Users should protect their credentials and promptly report suspected unauthorized access.

10. U.S. and Texas Data Deletion Requests

SoberAuth is currently intended for use in the United States, including Texas. Users may request deletion of their personal information by contacting us. Requests from Texas residents will be handled in accordance with applicable Texas law. We may need to verify the request and coordinate with the participating organization responsible for the account or facility records. Some information may be retained when reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, or enforcement of agreements. Applicable federal or state law may provide additional rights.

11. Children's Privacy

SoberAuth is intended for participating organizations and their authorized users and is not directed to children under 13. We do not knowingly collect personal information directly from a child under 13 without legally sufficient authorization. An organization authorizing use by a minor is responsible for providing required notices and obtaining any required parent or guardian authorization.

12. Changes to This Policy

We may update this Privacy Policy as SoberAuth changes or as legal requirements evolve. We will post the revised policy and update the date above. Additional notice will be provided when required by law.

13. Contact Us

For privacy questions or to request deletion of personal information, contact support@soberauth.com.