PRIVACY POLICY

OnGuard Technologies, Inc.

1. INTRODUCTION

OnGuard Technologies, Inc. ("OnGuard," "we," "us," or "our"), a Delaware corporation, operates a software-as-a-service technology platform (the "Platform") that connects businesses ("Clients") with licensed security companies ("Vendors") and the security professionals employed by Vendors ("Guards"). This Privacy Policy explains how we collect, use, disclose, and protect Personal Information when you use the Platform.

OnGuard is a SaaS platform. OnGuard is not a security services provider, a staffing agency, an employer of any Guard, or a joint employer with any Vendor. Vendors are the lawful employers of the Guards under applicable state security-licensing statutes (in California, Cal. Bus. & Prof. Code §§ 7580 et seq.).

2. SCOPE

This Privacy Policy applies to all Personal Information collected through the Platform, the website at onguardsolutions.io, OnGuard's mobile applications, OnGuard's APIs, and OnGuard's communications with users.

This Privacy Policy does not apply to Personal Information that Vendors process about their Guards as employers, even where Vendors use the Platform to do so. For those processing activities, the Vendor is the controller and its own privacy notice governs.

3. PRIVACY PRINCIPLES

We collect only the Personal Information needed to operate the Platform.
We limit exposure via role-based access.
We do not sell Personal Information.
We prioritize security, compliance, and operational integrity.
We design to align with U.S. and global privacy standards.

4. DATA ROLES; SEPARATION OF SERVICES

4.1 Controller / Processor Allocation.

OnGuard is the controller for Platform account, usage, telemetry, and product-improvement data.
OnGuard is a processor / service provider when processing Client Data on Client's behalf to facilitate Vendor engagement (governed by the Data Processing Agreement).
Vendors are controllers for Guard employment, payroll, scheduling decisions, and HR data. OnGuard does not control such data.

4.2 Separation of Services. OnGuard provides technology only. OnGuard does not provide security services, employ Guards, or direct Vendors' operational delivery. Personal Information relating to security-service delivery is collected and processed by Vendors in their role as employers; OnGuard does not control such processing.

5. INFORMATION WE COLLECT

5.1 Account & Contact Information. Name, email, phone, company, job title, mailing/billing address, login credentials.

5.2 Guard Professional & Credential Information. Work history, training and certifications, state guard-card numbers (e.g., BSIS guard-card in CA), firearms permits, licensing documents, qualifications, verification status. Vendors are typically the controllers of this data; OnGuard processes it on their behalf.

5.3 Identification & Sensitive Data (Limited Use). Government-issued ID where required for credential verification; SSN or tax identifiers where necessary for payroll routing or background checks initiated by Vendors. Sensitive data is encrypted in transit and at rest and access-limited.

5.4 Operational & Job Data. Job requests and assignments, schedules, site addresses, attendance and check-in records, activity logs, ratings, performance feedback.

5.5 Communications. Messages between Clients, Vendors, and Guards through the Platform; support communications.

5.6 Payment & Billing Data. Payment method details (processed by Stripe; full card numbers are not stored by OnGuard), billing history, invoice records.

5.7 Device & Usage Data. IP address, device identifiers, browser/OS information, usage logs, cookies, and analytics data.

5.8 Location Data (When Enabled). GPS or other location data, where the Vendor enables it for its workforce management. The Platform stores and displays location to the Vendor employer; OnGuard does not enforce location-based actions.

5.9 Background Checks (When Enabled). Background checks are arranged by Vendors through third-party consumer reporting agencies (e.g., Checkr). OnGuard is not a consumer reporting agency under the FCRA. Vendors are responsible for FCRA notice, authorization, and adverse-action procedures.

6. HOW WE USE PERSONAL INFORMATION

We use Personal Information to:

provide, maintain, and improve the Platform;
create, manage, and verify user accounts;
facilitate Vendor matching and Client-Vendor coordination;
support credential verification workflows;
process payments and billing via Stripe;
provide customer and technical support;
detect, prevent, and investigate fraud and security incidents;
comply with legal obligations and respond to lawful requests.

7. LEGAL BASES FOR PROCESSING (where required)

For jurisdictions that require a legal basis (e.g., GDPR), we rely on:

performance of a contract;
legitimate interests (fraud prevention, security, Platform improvement), balanced against user rights;
compliance with legal obligations;
consent, where required (e.g., for precise location tracking or other sensitive processing).

8. DISCLOSURE AND SHARING

We do not sell Personal Information.

8.1 Platform Functionality. We share Personal Information among Clients, Vendors, and Guards only as necessary to fulfill the matching, coordination, and assignment functions of the Platform, subject to role-based access controls. Clients typically see limited Guard identity (first name + last initial, profile photo, credential status, relevant experience); Clients do not receive Guard credential documents.

8.2 Service Providers / Subprocessors. We share Personal Information with service providers that perform functions on our behalf, including Stripe (payments), Checkr (background checks initiated by Vendors), cloud hosting, analytics, and communications providers. A current Subprocessor List is available at https://onguardsolutions.io/legal/subprocessors or via privacy@onguardsolutions.io. We require subprocessors to provide protections at least as protective as this Privacy Policy and the DPA.

8.3 Legal & Safety. We disclose Personal Information to comply with lawful requests, court orders, and legal processes; to protect safety, property, or legal rights; and to prevent fraud and abuse.

8.4 Business Transfers. In the event of a merger, acquisition, sale, reorganization, or bankruptcy, Personal Information may be transferred as part of the transaction, subject to confidentiality protections.

9. FCRA AND BACKGROUND CHECKS

OnGuard is not a consumer reporting agency. Background checks are arranged by Vendors through third-party CRAs. Vendors are responsible for FCRA compliance, including notice, authorization, and adverse-action requirements. OnGuard's role is integration plumbing only and may include receipt of status-based results as permitted by law.

10. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, web beacons, and similar technologies for functionality, preferences, analytics, and Platform improvement. We provide cookie consent controls and preferences where required by law. See the Cookie Policy at https://onguardsolutions.io/legal/cookie-policy for details.

11. TEXT MESSAGING (SMS)

If you provide a mobile phone number, OnGuard may send you operational text messages (SMS) relating to your account and your use of the Platform — for example, sign-in verification codes, booking and shift status updates, rostering and document-acceptance notifications, and account or security alerts. These are transactional, service-related messages. OnGuard does not send marketing or promotional SMS.

Consent. SMS consent is collected when you provide your mobile number during account registration or onboarding and accept the applicable agreement (the Terms of Service for Clients and Vendors; the Guard Platform Agreement for Guards). Consent to receive SMS is not a condition of purchasing any product or service.

Message frequency and cost. Message frequency varies based on your activity on the Platform. Message and data rates may apply, depending on your mobile carrier and plan.

Opt-out and help. You can opt out of SMS at any time by replying STOP to any message; you will receive a final confirmation and no further texts (except as required to service your account). Reply HELP for assistance, or contact privacy@onguardsolutions.io. Opting out of SMS does not remove you from email or in-Platform notifications, and certain essential service messages may still be delivered by other means.

Carriers. Mobile carriers are not liable for delayed or undelivered messages. We do not sell or share mobile phone numbers or SMS consent with third parties for their own marketing.

12. INTERNATIONAL DATA TRANSFERS

Personal Information may be processed in the United States and other countries where OnGuard or its subprocessors operate. For cross-border transfers from jurisdictions with adequacy requirements, we use Standard Contractual Clauses or other appropriate safeguards.

13. DATA RETENTION

We retain Personal Information only as long as necessary for the purposes described and to comply with legal obligations:

Account data: retained while the account is active and for two (2) years after deactivation, unless a different period is required by law.
Payroll, tax, and employment records: retained by Vendors as the controller, in accordance with applicable tax and employment law.
Logs and analytics: 12–24 months for security, fraud prevention, and product improvement.
Communications and support records: as necessary for operation, safety, dispute resolution, and legal compliance.

For specific retention requests, contact privacy@onguardsolutions.io.

14. SECURITY

OnGuard maintains administrative, technical, and physical safeguards including encryption in transit and at rest for sensitive data, role-based access controls, multi-factor authentication for administrative access, logging and monitoring, vulnerability scanning, secure development practices, and a documented incident response plan. No system is impenetrable; we update protections continually.

15. DATA SUBJECT RIGHTS

Depending on your jurisdiction, you may have rights to:

access the Personal Information we hold about you;
correct inaccurate or incomplete information;
delete Personal Information (subject to legal and contractual exceptions);
restrict or object to processing;
portability;
opt out of the sale of Personal Information (we do not sell).

To exercise rights, email privacy@onguardsolutions.io or use the request form at https://onguardsolutions.io/legal/privacy-request. We will verify your identity and respond within applicable timeframes (e.g., 45 days for CCPA/CPRA, 30 days for GDPR with possible 30-day extension).

16. CALIFORNIA RESIDENTS — CCPA/CPRA

California residents have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of Personal Information (we do not sell or share for cross-context behavioral advertising). The categories of Personal Information we collect, the sources, the purposes, and the categories of third parties with whom we share are summarized in our California Notice at Collection, available at https://onguardsolutions.io/legal/california-notice. Authorized agents may submit requests on your behalf with appropriate verification.

17. OTHER STATE PRIVACY LAWS

Residents of Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws have analogous rights. Contact privacy@onguardsolutions.io to exercise them.

18. CHILDREN'S PRIVACY

The Platform is not directed to individuals under 18. We do not knowingly collect Personal Information from children. If we learn that we have inadvertently collected data from a minor without parental consent, we will take steps to delete it.

19. SECURITY INCIDENTS

We maintain an incident response program. We will notify affected individuals and regulators as required by applicable law in the event of a breach likely to result in risk to data subject rights.

20. CONTACT INFORMATION

OnGuard Technologies, Inc. 1066 Woods Bog Ave Middleton, ID 83644

Privacy contact: privacy@onguardsolutions.io Data Protection Officer (international inquiries): dpo@onguardsolutions.io

21. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will post the revised policy with an updated effective date and provide notice of material changes where required by law.

End of Privacy Policy.