HEATSHIELD PRIVACY POLICY

Last Updated: 2.27.26

1. Information We Collect

1.1 Account Information

Name
Email address
Organization name
Role
Encrypted password

1.2 Employee Records (Organization-Controlled)

Employee names
Emails (if entered)
Phone numbers
Training completion status
Assessment records
Incident logs

HeatShield acts as a data processor for organization-controlled employee records.

1.3 Usage Data

Collected via:

PostHog (behavior analytics)
Sentry (error logging)

May include:

IP address
Browser type
Device information
Interaction metadata

1.4 System Logs

Authentication logs
Worker heartbeat logs
API usage records

2. How We Use Information

We use data to:

Provide platform functionality
Maintain security
Improve performance
Send operational emails via Resend API
Monitor system health

We do not sell personal data.

3. Cookies & Authentication

HeatShield uses:

Secure HTTP-only authentication cookies
Signed CloudFront cookies for training access
Session-based JWT tokens

Cookies are essential for platform functionality.

4. Data Sharing

We share data only with:

AWS (S3 & CloudFront)
VPS hosting provider
Resend (email delivery)
Sentry (error tracking)
PostHog (analytics)

All vendors operate under data processing agreements or standard contractual protections.

5. Data Retention

Data is retained:

While an organization maintains an active subscription
As required for operational backups
As required by law

Organizations may request data export or deletion upon termination.

6. Data Security

We implement:

Encrypted transmission (HTTPS)
Tenant-level data isolation
Secure password hashing
Automated backups
Access-controlled SCORM content

Despite safeguards, no system is immune to risk.

7. Your Rights

Depending on jurisdiction, users may have rights to:

Access data
Correct data
Delete data
Request data export

Requests may be sent to:
[email protected]

8. Children’s Privacy

HeatShield is not intended for users under 18.

9. International Users

Data is processed in the United States.

10. Changes to This Policy

We may update this policy periodically. Continued use constitutes acceptance.