1. Who we are

CrisisComms provides software for building, managing, and running crisis communication playbooks. The service is offered through our website and authenticated web application.

2. Information we collect

We may collect the following categories of information:

Account and identity data - such as name, email address, organization membership, and role, provided when you register or are invited. Authentication is handled by Clerk.
Workspace and playbook content - playbooks, decision trees, approval settings, incident records, notes, and related data you or your organization enter in the product.
Emergency SMS data - mobile phone numbers, opt-in and opt-out status, consent timestamps, and message delivery logs when you or your employer use crisis SMS alerts.
Billing data - if you subscribe to a paid plan, payment processing is handled by Stripe. We receive limited billing status and customer identifiers, not full payment card numbers stored by us.
Support and feedback - information you submit through feedback forms or support requests.
Technical and usage data - such as IP address, browser type, device information, and logs needed to operate, secure, and troubleshoot the service.

3. How we use information

We use personal information to:

Provide, maintain, and improve the CrisisComms platform;
Authenticate users and enforce access controls;
Process subscriptions and manage accounts;
Send emergency SMS alerts on behalf of your employer after you opt in, and honor STOP/HELP replies;
Respond to support requests and feedback;
Protect against fraud, abuse, and security incidents;
Comply with legal obligations.

We do not sell your personal information. We do not use your playbook content, account data, or communications for artificial intelligence model training.

4. How we share information

We share information only as needed to run the service, including with:

Service providers - infrastructure and hosting, database, authentication (Clerk), payments (Stripe), SMS delivery (Twilio), and email delivery providers that process data on our instructions.
Your organization - other users in your company workspace according to roles and permissions you configure.
Legal and safety - when required by law, court order, or to protect rights, safety, and security.
Business transfers - in connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.

We do not share, sell, or otherwise provide your personal information to third parties or affiliates for their own marketing or promotional purposes.

5. Cookies and similar technologies

We and our authentication provider use cookies and similar technologies for session management, security, and core site functionality. You can control cookies through your browser settings; disabling certain cookies may limit your ability to use signed-in features.

6. Data retention

We retain personal information for as long as your account or organization relationship is active and as needed to provide the service, resolve disputes, enforce agreements, and meet legal requirements. Retention of playbook and incident data is governed by your organization's use of the product and applicable plan features.

7. Security

We use administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

8. Your choices and rights

Depending on your location, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing. Account profile details may be managed through the application where available. To exercise other rights, contact us using the details below. We may need to verify your identity before responding.

9. International users

If you access the service from outside the United States, your information may be processed in the United States or other countries where our providers operate, which may have different data protection laws than your jurisdiction.

10. Children

CrisisComms is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us so we can delete it.

11. Emergency SMS alerts

If your employer invites you to receive crisis text messages through CrisisComms, we process your mobile number and consent records to deliver those messages on their instructions.

What you'll receive: Emergency and crisis communications only. Messages are sent only during workplace incidents or crises — not for marketing.

Message frequency: Message frequency varies and is driven by your employer's use of the program — messages are sent only when your employer issues an emergency or crisis alert through CrisisComms. There is no fixed schedule; you may receive no messages for extended periods, or multiple messages in a short time during an active incident.

Message and data rates may apply.

Consent: You must opt in yourself using the personalized link sent to your work email. The consent checkbox is unchecked by default; administrators cannot opt in on your behalf.

Opt-out and help: Reply STOP to any message to opt out, or HELP for help.

Non-sharing statement: No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Your mobile information and messaging consent are not sold. We use Twilio as a service provider to deliver messages.

Visibility: Administrators in your employer's workspace can see consent status for people on their emergency contact list.

Reliability: Delivery is not guaranteed; do not rely on text messages as your only source of safety information.

Retention: We retain SMS consent records and related logs for as long as your employer maintains your contact record and as needed to demonstrate consent, honor opt-outs, and meet legal or carrier requirements.

12. Changes to this policy

We may update this policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may also be communicated through the product or by email where appropriate.

13. Contact us

Questions about this policy or our privacy practices: team@crisiscomms.io