Privacy Policy

Your privacy

This Privacy Policy governs the privacy terms of Our website at risesms.com and the Safety Management System (SMS) services RISE SMS, LLC ("We", "Us", "Our") provide through Our software (the "Website" or the "Service").

RISE SMS, LLC is committed to protecting your privacy. This Privacy Policy outlines how We collect, use, disclose, and safeguard customer ("You" or "Your") information when You use Our Service or Website, including how We handle Personal Data in compliance with global privacy laws, e.g., the General Data Protection Regulation (GDPR). By accessing Our Service or Website, You agree to this Privacy Policy.

Definitions

• Personal Data: information about an individual that can be used to identify them, e.g., name, email address, or payment details.
• Usage Data: data collected automatically, including, e.g., IP addresses, browser types, time spent on Our Website, and navigation paths.
• Cookies: small files stored on Your device to collect information and improve Your experience.
• Data Controller: the entity responsible for deciding how and why Personal Data is processed. For Personal Data and Usage Data collected and/or provided by Us as described in this policy, RISE SMS, LLC is the Data Controller. For Personal Data that is part of Customer Content provided by the customer, the customer is the Data Controller and RISE SMS, LLC acts as a Data Processor, as described below.
• Data Processors: RISE SMS, LLC (for Customer Content) or third parties We employ to process data on Our behalf, e.g., analytics services and payment processors.
• Data Subject: the identified or identifiable individual to whom Personal Data relates.
• User: an individual who accesses the Service under a customer's account.

Customer Content, and who controls it

The Service exists to store and process safety records provided by customers. Safety records include, e.g., hazard and incident reports, risk evaluations, corrective actions, audits, inspections, and the documents attached to them (collectively the "Customer Content"). Customer Content frequently contains personal data about the customer’s own personnel, including, e.g., names, roles, accounts of what happened to them, and reports, some or all of which might have been submitted in confidence to the customer’s designated reviewers.

For Customer Content, the customer is the Data Controller and RISE SMS, LLC is a Data Processor. We process Customer Content responsive to and based on each customer’s instructions and permission in order to provide the Service, and for no other purpose. We do not sell Customer Content, use it to market to any individuals named in it, or use it to serve another, different customer.

The Service also offers optional AI features, including the RISE Agent assistant and AI risk analysis. The RISE Agent is available only to customers who subscribe to it. AI risk analysis is enabled by default, and the customer’s Account Owner may turn it off for the entire account in account settings. When used, text from Customer Content, which may include the names of individuals and the contents of safety reports, is sent to Our AI service provider, Anthropic, for processing, and We store the questions users ask the RISE Agent to operate and improve the feature. By electing to use these features, the customer and its users agree to this processing.

Within the Service, access to, and usage permission for, Customer Content is controlled by each customer. Every record and piece of information in the Customer Content belongs to a specific customer account. Individual records and data within the Customer Content, and forms and other information, can be restricted further by the customer to limit access to specific named people or groups within the customer. Our staff accesses and processes or uses Customer Content only where it is necessary to operate the Service or to provide support that the customer controlling the Customer Content has requested.

Requests about Customer Content

If You are an employee or contractor of one of Our customers and You want to see, correct or delete personal data held about You in their Customer Content, that request should be made to the customer, not to Us, because the customer, not Us, determines what Customer Content is held and for how long. We act in response to instructions from the customer.

You may contact Us at support@risesms.com if You are not sure who to ask, and We will point You to the right customer without disclosing anything about Customer Content.

Data We collect

We collect information You provide directly, e.g., when You sign up for an account, request a demo, or contact Us. This information may include Your name, email address and phone number; billing information for processing transactions; and Your preferences about receiving marketing or promotional communications.

You may opt out of promotional communications by following the "unsubscribe" instructions in promotional emails We send.

We also collect Usage Data to understand how the Service is accessed and used, which may include Your device’s IP address, browser type and version, pages visited and time spent on them, and unique device identifiers.

Cookies and tracking

We use cookies and similar tracking technologies to monitor activity on Our Service. You can instruct Your browser to refuse all cookies, though some parts of the Service may become unavailable. We use cookies as follows.

Service

When You use the RISE SMS application, We use a first-party login cookie that keeps You signed in (essential; expires after 30 days) and Stripe cookies used to prevent payment fraud (essential; __stripe_mid, 1 year; __stripe_sid, 30 minutes). Display preferences, such as list filters and columns, are stored in Your browser’s local storage and are not shared with third parties. The Service does not use analytics or advertising cookies.

Website

The following applies to Our website at risesms.com:

• No non-essential script loads until the visitor presses Accept. A visitor who has not yet answered is treated exactly as one who declined.
• Only if and when a visitor presses Accept, the following third-party services are loaded:

Effect of declining cookies

Declining does not disable the site. Rather, gated features are replaced by cookieless equivalents:

• Forms are replaced by a direct email address that reaches the same people.
• The booking calendar is replaced by a plain hyperlink to Calendly’s own booking page. Visitors choose whether to navigate to Calendly’s site, where Calendly’s notice applies.

Changing your choice

You can change Your choice at any time using the Cookie choices link in the footer of the Website. If You change Your choice to Decline, We remove the cookies the Website set. Cookies set directly by third parties, such as Calendly, may need to be removed through Your browser settings.

Cookie storage

Only two items are stored by the site itself in the visitor’s own browser. Neither is transmitted to or readable by any third party.

• The consent decision. Stored in browser local storage under the name rise.consent, containing the single word accepted or declined.
• Progress through self-assessment tools. The site offers several scored tools visitors may complete at their discretion (e.g., flight risk assessment; fatigue risk screen). During completion, answers are temporarily held in browser session storage. The browser discards these when the tab is closed. The sole purpose is to allow unfinished assessments to survive a page refresh.

Forms

When You submit a form on the Website, such as a request for a resource or a demo, the information You enter is sent to HubSpot so that We can provide what You requested and follow up with You. This happens whether or not You have accepted cookies, because You chose to submit the form. If You have not accepted cookies, Your submission is not linked to Your browsing activity on the Website. Each form displays a notice that by submitting it You agree to receive emails from Us, and You can unsubscribe at any time.

How We use data

We use the data We collect to:

• Provide and maintain the Service
• Improve Your experience on the Website or when using the Service
• Notify You of changes to Our Service
• Enable interactive features
• Provide customer support
• Monitor and analyze usage patterns
• Market other services or products related to Our platform

Retention and transfer

We retain Your Personal Data only as long as necessary to fulfill the purposes outlined in this Privacy Policy and provide the Service, including to comply with legal obligations, resolve disputes, or enforce Our agreements.

Customer Content is retained for at least as long as the customer’s account is active. Safety-related records may be retained for years due to their value in providing history and context and/or due to legal requirements. A customer requiring a shorter or longer retention period should communicate that request to Us so that it can be evaluated.

When a user deletes a record or file in the Service, it is permanently deleted and cannot be restored by the customer or by Us, except that it may remain in Our backups until those backups expire.

Accounts are closed at the customer’s request, or by Us in accordance with the customer’s subscription agreement, including for non-payment or breach. When a subscription ends for any reason, the customer may obtain a copy of its Customer Content for thirty days by contacting Us. Ninety days after a subscription ends, We may permanently delete the account and all of its Customer Content.

Backups are made daily and retained for a limited period, after which they are deleted.

Application data, including Customer Content, is held on servers in the United States. Some of the service providers listed below in the Service providers section may process data outside the United States, so information they handle may be processed outside Your country or state.

Disclosure of data

Business transactions: in the event of a merger or acquisition involving Us, Your data may be transferred to a new entity (with whom We have merged, or who has acquired Us). Notice will be provided before this occurs.

Law enforcement: We may disclose Your Personal Data if required to do so by law or in response to valid, lawful requests by public authorities.

Data security

Every record in the Customer Content used by the Service is directly tied to the customer account associated with it, and every transaction and query utilized by the Service is directly tied to that customer account. This means that one customer’s Customer Content is not reachable from, or accessible by, another customer account. Within a customer account, Customer Content, including, e.g., records and forms, can be restricted by the customer to specific named people or groups within the customer. In addition, multiple permission levels control what each person with access to Customer Content is permitted to do.

Records in the Service’s main modules carry an activity log showing who made changes, what was changed, and when. This activity log is visible to the customer. Uploaded files are stored separately from the database.

No method of transmission or storage is completely secure, and therefore We cannot guarantee absolute security.

If something goes wrong

If We become aware of a breach affecting Personal Data or Customer Content, We will notify affected customers and, where required, the relevant supervisory authority. Notification will describe what We know, what We are doing about it, and what the customer may need to do.

Legal basis for processing (GDPR)

For residents of the European Economic Area, RISE SMS, LLC processes Personal Data on the following legal bases: contractual necessity, where processing is required to fulfill contractual obligations; consent, where You have provided it explicitly, for example for marketing communications; legitimate interests, where processing is in Our legitimate interests and not overridden by Your rights; and compliance with legal obligations.

Your rights under GDPR

If You are located in the European Economic Area, You have the following rights vis-à-vis Us relating to Personal Data that We control (but not regarding Customer Content, which is controlled by customers). You may exercise these rights relating to Personal Data that We control by contacting Us at support@risesms.com.

Be advised that We handle these requests manually rather than through a self-service tool. If You inform Us what You are requesting, We will tell You what information We have, what We are able to do about the situation, and how long We believe it will take to address Your request. The following are examples of rights that You have with respect to Personal Data that We control:

• Right of access: request access to the data We hold about You.
• Right to rectification: request corrections of inaccurate or incomplete data.
• Right to erasure: request deletion of Your data.
• Right to restrict processing: request a halt to processing in certain situations.
• Right to data portability: receive Your data in a machine-readable format.
• Right to object: object to Our processing of Your data for marketing or other reasons.

Where a request involves Customer Content

Where a request involves Customer Content rather than Personal Data that We control, that request should be made to the customer whose account holds permission and access to it, because they (not Us) determine what is kept and for how long.

United States privacy rights

If You live in a US state with a general privacy law, You may have the right to know what personal data We hold about You, to have it corrected or deleted, and to opt out of its sale or of targeted advertising. We do not sell personal data, and We do not use it for targeted advertising.

You may exercise any of these rights by contacting support@risesms.com. Requests about Customer Content go to the customer whose account holds permissions for that Customer Content, as described above. We will not treat You differently for exercising these rights.

Service providers

We employ third-party companies to facilitate Our Service and to process data on Our behalf. These third parties have access to Your data only to perform tasks on Our behalf and are prohibited from using it for any other purpose. Third parties include, e.g.:

• DigitalOcean: hosts the Service and stores application data and uploaded files.
• Vercel: hosts Our website.
• Anthropic: provides the AI behind the optional RISE Agent and AI risk analysis features.
• Stripe: processes payments.
• SendGrid (Twilio): sends all email from the Service.
• HubSpot: customer communications, CRM, and website forms and chat.
• Google Analytics: website usage analytics.
• Google reCAPTCHA: spam protection on Website forms.
• Calendly: demo scheduling on Our website.
• Cloudflare: bot protection on signup.
• Mezmo (formerly LogDNA): server logs, kept for a limited period.
• Sentry: application error reporting. Error reports are scrubbed of request data and IP addresses before they are sent.
• Vimeo: embedded help videos.
• Google Fonts: web fonts.
• Optional integrations a customer may turn on: ForeFlight, Schedaero/Avinode, and Airplane Manager. Where a customer enables one of these optional integrations, flight and crew information is exchanged between the Service and that provider, including sending risk reports back to ForeFlight.

Third-party websites

Our Service may contain links to other websites. We are not responsible for the privacy practices of these external sites, and We encourage You to review the privacy policies of any third-party sites You visit.

Children’s privacy

We do not knowingly collect personally identifiable information from individuals under 18. If We become aware that a child under 18 has provided Us with Personal Data, We will take steps to delete such information.

Updates to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, with the effective date updated at the top. We encourage You to review this policy periodically.

Contact us

If You have any questions or concerns about this Privacy Policy, contact Us at support@risesms.com.