Privacy Policy

Last updated 18 September 2026. This page explains what the AI Incident Reporting mobile app and dashboard collect, why, and how it is protected.

Who this covers

AI Incident Reporting (“Incident Ops”) is operated by Attendify Vision Technology Solutions L.L.C – S.P.C (Abu Dhabi, United Arab Emirates, Economic Licence CN-6081654) and provided to organisations — typically security services companies — for their own personnel to use for incident reporting. If you are using the app or dashboard, your employer or the organisation that engaged you has provisioned your account and is the party responsible for deciding who on their team can see a given report. We process data on that organisation's behalf to run the service.

What we collect

Account and identity

Name, work email, employee/SAP number, phone, designation and the organisation, branch, client, contract or site you are assigned to. Accounts are created and managed by your employer or the security provider that deploys Incident Ops — there is no public sign-up inside the app itself for field staff.

Incident report content

Narrative text, structured form fields, photos, short video and voice recordings you or a reviewer capture while reporting or reviewing an incident, plus the people and notified-party details you enter for that report.

Location

Precise device location when you report an incident or select a site, used to confirm or suggest the location on the report. Background or continuous location tracking is not performed.

Camera, microphone and photo library

Used only when you actively capture or attach incident evidence. Recordings are uploaded as part of that incident's evidence and are not accessed for any other purpose.

Usage and device data

Basic technical data (app version, device platform, crash and error logs) used to keep the service working reliably.

How AI is used

When you record voice notes or attach photos to a report, that evidence may be sent to Google's Gemini API to help produce a draft. Specifically:

Audio you record is transcribed and, if needed, translated to English.
Photos are analysed to help describe what they show.
Extracted facts and a drafted narrative are produced from the above.
Every AI-produced field is labelled as AI-generated and held separately until you review, edit and confirm it — nothing AI-produced is treated as your official record until you approve it.

Who we share data with

Within your organisation

Report content and evidence are visible only to people at your employer or client organisation whose role and assigned coverage give them access — for example a supervisor covering your site, or a manager on the approval chain for that report.

Service providers we use to run Incident Ops

Supabase (database, authentication and file storage, hosted in the ap-southeast-1 region), Google (Gemini API, for the AI processing described above) and Resend (email delivery for notifications and password resets). Each acts on our instructions to provide the service and does not use your data for its own purposes.

What we do not do

We do not sell personal data, and we do not share incident data across organisations. Each organisation's data is isolated from every other organisation using Incident Ops.

Retention

Incident records and evidence are retained for as long as your organisation's account is active, in line with the retention period your organisation has agreed with us, and are deleted or anonymised on request once no longer required for operational or legal record-keeping.

Security

Access to report data is enforced by row-level authorization rules tied to your organisation, role and assigned coverage — not by client-side checks alone. Evidence files are stored in private storage areas rather than public URLs. Data in transit is encrypted (HTTPS/TLS).

Your choices

Camera, microphone, photo library and location permissions are requested only when you use the matching feature, and can be withdrawn at any time from your device settings — the app will tell you when a feature needs a permission you have not granted. To access, correct or delete personal data we hold about you, contact your organisation's administrator, or write to us at mudasar@collectflows.com.

Children

Incident Ops is a workforce tool provisioned by employers for their staff. It is not directed at children and we do not knowingly collect data from anyone under the age of 18.

Changes to this policy

We will update the date at the top of this page when this policy changes and, for material changes, notify organisation administrators directly.

Contact

Questions about this policy or a data request: mudasar@collectflows.com