This Privacy Policy explains how STEM Technology, LLC, doing business as Guardix ("Guardix," "we," "us," or "our"), handles personal information in connection with our websites, applications, security workforce platform, connected devices, and related services (collectively, the "Services"). It also explains the choices and rights that may be available to you.
The Services support organizations operating across the United States and internationally. The laws and rights that apply depend on factors including your location, the organization responsible for your information, the purpose of processing, and the Services being used. This Policy does not replace a notice your employer, security provider, property operator, or another customer is required to provide.
1. Who is responsible for your information
Information Guardix controls. Guardix generally determines the purposes and means of processing information used to operate its business, including website inquiries, prospective customer contacts, account administration, billing relationships, marketing preferences, and necessary business security records. For this information, Guardix acts as a controller or equivalent responsible organization under applicable law.
Information our customers control. A security company, employer, property operator, or other organization that subscribes to the Services (a "Customer") generally determines why and how its workforce, operational, client, and site information is processed. Guardix processes that information on the Customer's documented instructions under our Data Processing Addendum. Depending on the arrangement, we act as a processor, subprocessor, service provider, or contractor. A Customer may itself act for another organization.
If your account was provided by an employer or other organization, that organization controls your assignments and access permissions and may access, retain, correct, export, or delete information associated with its workspace. Contact that organization about its monitoring practices, employment decisions, and use of your records. You may also contact Guardix, and we will assist or direct your request as applicable. These descriptions do not change the responsibilities imposed on any party by law.
2. Information we collect
The information processed depends on enabled modules, your role, device settings, Customer configuration, and your interactions with the Services. It may include:
| Category | Examples |
|---|---|
| Identity and account information | Name, business contact details, organization, user ID, role, authentication information, account settings, and profile photograph. |
| Workforce and assignment information | Schedules, availability, site assignments, attendance, clock-in and clock-out records, breaks, qualifications, training, employment documents, leave requests, and acknowledgments. |
| Location and patrol information | Precise or approximate location, on-duty GPS updates, geofence events, patrol routes, checkpoint scans, timestamps, and location information included in a report or photograph. |
| Images, audio, video, and verification information | Clock-in selfies, site photographs, incident recordings, messages, call recordings where lawfully enabled, body-camera footage, and related device or recording metadata. Facial verification may involve biometric information when the enabled technology and applicable law make it biometric. |
| Operational and client information | Post orders, dispatch logs, incident reports, visitor details, site contacts, service requests, customer instructions, and records relating to people involved in an incident. |
| Commercial and financial information | Company name, organization size such as the number of guards or users, subscription details, billing contacts, invoice records, expense submissions, receipts, mileage, and payroll preparation information where the Customer uses those features. Payment information handled by a payment provider is also subject to that provider's practices. |
| Communications and AI feature content | Support requests, messages, feedback, prompts, documents submitted to an AI feature, and resulting drafts, suggestions, or summaries. |
| Device and usage information | IP address, browser type, operating system, app version, device identifiers, push notification tokens, referring and exit pages, date and time of access, access logs, feature interactions, diagnostics, and security events. |
| Website technology information | Cookies, local storage, pixels, and similar technology information described in our Cookie Policy. |
We also collect business contact details when you request a demo, contact us, attend an event we host or sponsor, or are referred to us by a user. When you contact us by phone or video meeting, we may record, transcribe, and summarize the conversation, including with AI tools, for quality assurance, training, and accurate records. We will tell you at the start of a call if it is being recorded, and you can ask us not to record it. When you buy hardware such as body cameras or accessories, we collect the shipping address, contact person, and billing details needed to deliver it. Payment cards are processed by our payment provider; we receive only limited details such as the cardholder name, card type, last four digits, and expiration date.
We receive information directly from you, from the Customer and its authorized users, from devices and integrations connected to the Services, from service providers, and from people who communicate with us. We may receive business contact information from publicly available professional sources or referrals where lawful.
You should not submit sensitive information that is unnecessary for the relevant task. Some information is necessary to provide a requested feature; without it, that feature may be unavailable.
3. Location, monitoring, and connected cameras
Workforce location. Routine workforce location tracking is limited to active, on-duty shifts. Depending on permissions and Customer settings, the app may collect location while running in the background during an active shift. Background access does not itself authorize tracking outside the permitted work period. Your device may allow you to review or change location permissions; disabling permissions may affect geofencing, attendance verification, patrols, or other location-dependent functions.
Device permissions. The app asks for device permissions before using certain features, and you can allow, limit, or revoke them at any time in your device settings. Depending on the features your organization enables, these may include: location, for on-duty tracking, geofencing, time clock, patrols and site tours, location stamps on reports, and SOS or panic alerts; camera and photo library, to capture or attach photos and videos to reports, incidents, and clock-in verification; microphone, to record audio with video and for push-to-talk (walkie-talkie) and other voice features; and notifications, to deliver shift, dispatch, and safety alerts. The app does not use these permissions after you sign out. Turning a permission off may stop the related feature from working.
Emergency functions. A separately initiated SOS or emergency-location feature may require access to your location at the time of the request. Any access outside routine shift tracking must be specifically explained in the applicable feature notice and supported by the required device permissions and legal basis. Contact your organization about the emergency features it has enabled.
Photographs and biometrics. A photograph is not automatically biometric information under every law. If an enabled verification feature extracts facial geometry or otherwise processes regulated biometric identifiers or information, additional notices, authorizations, retention limits, and safeguards may apply. This Policy and a device permission prompt do not replace a legally required biometric notice, written release, or consent. Customers must provide those materials before using the relevant feature, and Guardix must meet its own applicable obligations.
Body cameras and recordings. When a connected camera service is enabled, authorized users may access recordings, device status, or live streams through the Guardix platform, including over a supported 5G connection. Recordings may include officers, workers, visitors, bystanders, conversations, locations, and people involved in an incident. Availability depends on the device, connectivity, Customer configuration, and purchased service. The Customer is responsible for identifying a lawful purpose, providing required recording notices, obtaining required permissions, and limiting access and retention. Recording restrictions can differ by country, state, workplace, and location.
For information about footage controlled by a Customer, contact the organization operating the camera or site. If you contact Guardix, provide enough information to help identify the responsible organization without submitting unnecessary sensitive material.
4. How information is used
Subject to the relevant processing role, we use information to:
- Provide accounts, role-based access, scheduling, attendance, patrols, reports, dispatch, communications, connected devices, and other requested functions.
- Process subscriptions and invoices, respond to inquiries, provide support, and administer our Customer relationships.
- Authenticate users, investigate misuse, maintain service integrity, troubleshoot problems, and protect people, accounts, and systems.
- Send necessary service, security, and administrative communications.
- Develop and improve the Services using information we are lawfully permitted to use for that purpose, including appropriate aggregate or deidentified information.
- Send marketing communications, such as product news and promotional offers, where permitted, subject to applicable consent requirements and your preferences. Every marketing email includes an unsubscribe link.
- Respond to questions, request feedback, and run surveys, contests, or promotions, subject to their own terms and applicable law.
- Supply, ship, and support hardware and accessories you buy from us.
- Comply with legal obligations, respond to valid legal requests, and establish, exercise, or defend legal claims.
Customer-controlled information is processed under the Customer's instructions and the DPA. A general statement about improving our Services does not authorize unrelated reuse of Customer personal information.
5. AI-assisted features
If a Customer enables an AI feature, relevant content may be processed to perform the requested task, such as refining a report, drafting training questions, or suggesting scheduling or dispatch actions. Depending on the feature, this may involve an approved service provider. The Customer controls which authorized users may submit information and is responsible for reviewing the resulting content before using it.
AI output can be inaccurate, incomplete, or inappropriate for the circumstances. It should not be treated as a verified incident finding, legal conclusion, emergency instruction, payroll determination, or final employment decision without suitable human review.
Permissions to process content for a requested AI function do not, by themselves, authorize unrelated advertising or training of shared foundation models. The DPA governs the use of Customer personal information, including any additional authorization required for model training. We do not use this Policy as consent to a decision producing legally significant effects based solely on automated processing.
6. Legal bases where required
Where a law requires a legal basis for information Guardix controls, we rely on the basis appropriate to the activity: performance of a contract with you or steps you request before a contract; compliance with a legal obligation; legitimate interests, where recognized and not overridden by your rights; or consent where required. Our legitimate interests include operating a secure business, responding to business inquiries, administering organizational accounts, and improving service reliability.
Where required, we obtain an additional valid condition for processing sensitive information. A Customer must determine and document the legal bases and any additional conditions for the information it controls. Workforce monitoring should not be justified by consent where applicable law does not regard that consent as freely given. You may withdraw consent for future processing where consent is the applicable basis; withdrawal does not invalidate earlier lawful processing.
7. Who receives information
We disclose information as necessary and lawful to:
- Your organization and its authorized users. Access depends on the Customer's configuration. Managers, dispatchers, administrators, and authorized client contacts may receive relevant records within their permissions.
- Service providers. Providers may support hosting, authentication, communications, payments, technical support, security, analytics, and enabled AI functions. Examples include Amazon Web Services and Google Cloud for hosting and infrastructure, Logto for authentication, Twilio and Twilio SendGrid for text, voice, and email communications, Google Maps Platform for maps and location, and providers such as Anthropic and OpenAI for enabled AI functions. These examples are not a complete list, and we may add, remove, or change service providers at any time. The current subprocessor register for Customer personal information is in Schedule 3 of our Data Processing Addendum and on our Subprocessors page.
- Customer-selected integrations and recipients. Information is shared when a Customer connects an integration, directs an export, or instructs us to transmit information. Independent third-party services operate under their own terms and notices.
- Professional advisers and lawful authorities. We may disclose information for legal advice, audits, compliance, valid legal process, protection of rights, or emergencies where law permits. Requests are reviewed for applicable authority and scope.
- A business transaction recipient. Information may be disclosed in a proposed or completed merger, acquisition, financing, reorganization, or asset transfer, subject to appropriate protections and any required notice or choice.
Affiliates. We may share information with companies under common ownership or control with Guardix, which must protect it consistent with this Policy.
Partners and resellers. If you buy through, or ask to be connected with, a reseller or implementation partner, we share the business contact and account details needed for that relationship. The partner's own policies apply to its independent use.
Reviews and invitations. If you submit a testimonial or public review, we may display it with your name and company. You can ask us to remove it at any time. If you invite colleagues to Guardix, we use the contact details you provide to send the invitation on your behalf, which may include your name.
A business transaction under this section includes insolvency, bankruptcy, or receivership. We may also share aggregated or deidentified information that does not identify any individual.
We do not authorize subprocessors to use Customer personal information for their unrelated purposes.
U.S. sale and targeted advertising disclosure: Guardix does not sell personal information for money. As of the effective date of this Policy, we do not sell or share personal information for cross-context behavioral or targeted advertising, as those terms are defined under U.S. state privacy laws, including the Texas Data Privacy and Security Act and the California Consumer Privacy Act. Disclosures to service providers and subprocessors to operate the Services are not sales or sharing. If our practices change, we will update this Policy before the change takes effect and provide the opt-out rights required by law. Guardix never sells, leases, or trades biometric identifiers, including facial data captured at clock-in, and does not knowingly sell or share personal information of anyone under 16. Our DPA prohibits sale or sharing of Customer personal information processed as a service provider, contractor, or processor, as those terms are defined by applicable law.
8. International processing and transfers
Guardix is based in the United States. Our currently published hosting information identifies primary hosting in the AWS U.S. East (Northern Virginia) region. Information may also be accessed or processed in other countries identified in the applicable service documentation and subprocessor register. Purchasing or using the Services does not itself promise storage in your country.
Where a transfer requires a legal safeguard, we use an applicable mechanism, such as an adequacy decision or valid contractual safeguards, together with required assessments and supplementary measures. For relevant transfers, the DPA addresses EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and appropriate Swiss adaptations. Other jurisdictions may require a separate transfer mechanism or additional contractual protections. These instruments are not interchangeable in every country.
You may request information about safeguards relevant to your information, including a copy of applicable contractual safeguards with legitimate confidential information protected. Customer-specific processing locations and residency commitments must be documented in the applicable agreement.
9. Retention and security
We retain information for the period needed for the applicable purpose, taking into account account status, Customer instructions, the type and sensitivity of the information, legal retention requirements, disputes, fraud prevention, and the ability to meet the purpose with less information.
Customer operational records are retained under the Customer's configuration and agreed retention schedule. For example, when a Customer archives the profile of an officer who has left, those records stay until the Customer deletes them or the subscription ends. Recordings, biometric information, precise location, employment records, financial records, support communications, and security logs may require different retention periods. Information subject to a valid preservation obligation is restricted to that purpose. After a retention period ends, information is deleted or appropriately deidentified, subject to limited backup cycles and lawful preservation. Backup copies remain protected and are not retained for routine use. Biometric identifiers are destroyed within a reasonable time, and no later than one year after the purpose for collecting them ends, or sooner where applicable law requires. Retention periods may change as the Services and our legal obligations change.
We use technical and organizational safeguards appropriate to the information and processing risks, including encryption in transit, access restrictions based on role, secure hosting, regular backups for continuity, and confidentiality obligations for our personnel. We review these measures regularly. No system is completely secure. Customers and users must also protect credentials, configure permissions appropriately, and promptly report suspected unauthorized access.
If we become aware of a security incident affecting personal information, we will investigate, take reasonable steps to contain and remedy it, and notify affected Customers, individuals, and authorities as required by applicable law and our agreements.
10. Your choices and privacy rights
You can update available account information, manage device permissions, use marketing unsubscribe options, and manage optional technologies through Cookie Settings. Service and security messages may continue when necessary to administer your account or provide the Services.
You can review and update your profile information at any time in your account settings, or ask your organization's administrator to update information it manages. Some browsers offer a "Do Not Track" setting. Because there is no common industry standard for responding to these signals, our websites do not currently respond to them. We do honor Global Privacy Control signals where applicable law requires, as described in Section 11.
Depending on applicable law, you may have rights to obtain information about processing; access, correct, or delete personal information; receive a portable copy; restrict or object to certain processing; withdraw consent; opt out of a sale, sharing, targeted advertising, or certain profiling; appeal a refusal; or complain to a regulator. These rights are subject to legal conditions and exceptions.
Submit a request to privacy@guardix.com. For information controlled by your organization, submit your request to that organization or identify it when contacting us. We may verify identity and authority where appropriate, request information reasonably necessary to locate records, and coordinate with the responsible Customer. We do not require an account or identity verification beyond what applicable law permits for an advertising opt-out or a recognized preference signal. An authorized agent may submit a request subject to applicable verification requirements. We respond within the deadlines required by the law that applies.
You will not be unlawfully discriminated against for exercising your rights. Where an appeal is available, reply to our decision or contact the same email with the subject Privacy Appeal. Your rights to contact a regulator or seek a legal remedy remain available without first obtaining our permission.
Text messages. Where Guardix sends text messages, such as shift reminders or login codes, you can reply STOP to stop non-essential messages. Some messages your organization's account depends on, like verification codes, may still be needed to sign in.
When we respond to a request, we may direct you to settings where you can make the change yourself, or to the organization that controls your information. We may redact information about other people or confidential information when providing access, and we keep records of requests and our responses as the law requires.
11. Regional information
United States, nationwide. Applicable federal and state laws may provide different rights and protections. State comprehensive privacy laws may exclude some employment, commercial, or other information, while other laws may protect that same information. California residents may have rights to know, access, correct, delete, opt out of sale or sharing, and limit certain uses or disclosures of sensitive personal information where the CCPA applies. Residents of other states may have comparable or additional rights, including applicable targeted advertising and profiling opt-outs and appeals. We honor legally required universal opt-out mechanisms, including Global Privacy Control, for processing to which those mechanisms apply. Biometric, audio recording, employment, and surveillance rules may impose separate requirements.
California disclosures. In the past 12 months, Guardix has collected the following categories of personal information, as defined in the CCPA: identifiers; customer records; commercial information; internet or other electronic network activity; geolocation data; audio, electronic, visual, or similar information; professional or employment-related information; biometric information where a Customer enables facial verification; and, through AI features, limited inferences used only to provide the requested feature. We collected this information from the sources and for the purposes described in Sections 2 and 4, and disclosed each category for business purposes to the recipients described in Section 7. We have not sold or shared personal information for cross-context behavioral advertising. We use sensitive personal information, such as precise geolocation, account login credentials, and biometric information, only for purposes permitted by law, such as providing the Services, security, and verification, and not to infer characteristics about you.
European Economic Area and United Kingdom. Where applicable, the GDPR or UK GDPR provides rights including access, rectification, erasure, restriction, portability, objection, and rights relating to certain automated decisions. You may object to direct marketing at any time. You may complain to a competent EEA supervisory authority or the UK Information Commissioner's Office. Information about an appointed representative or data protection officer, where legally required, is available by contacting privacy@guardix.com. Where we appoint a representative or data protection officer, we will post their details in this section, and we may update them at any time.
Switzerland. Where the Swiss Federal Act on Data Protection applies, you may exercise the rights provided under that law and contact the Federal Data Protection and Information Commissioner. International disclosures are subject to the applicable Swiss safeguards.
Canada. Applicable federal or provincial law may provide rights to access and correct information, withdraw consent subject to lawful limits, and challenge compliance or make a complaint. Organizations remain responsible for applicable safeguards when using overseas service providers. Contact us about the locations, purposes, and protections relevant to information Guardix controls, or contact the Customer for its processing.
Australia. Where the Australian Privacy Act applies, you may request access or correction and make a privacy complaint. We will review complaints and communicate our response. You may also contact the Office of the Australian Information Commissioner. Applicable overseas disclosure obligations remain in effect.
Brazil. Where the LGPD applies, rights may include confirmation of processing, access, correction, portability where applicable, information about sharing and consent, and anonymization, blocking, deletion, or opposition where the legal conditions are met. You may contact the responsible controller and, where applicable, the Autoridade Nacional de Proteção de Dados. International transfers require a mechanism recognized under the applicable Brazilian rules.
Other locations. Mandatory local rights continue to apply when their legal conditions are met. A reference to one region does not exclude protections required in another region.
12. Children and people recorded at a site
Guardix organizational accounts are intended for business users who are at least 18 years old. We do not direct our websites, account registration, or marketing to children, and we do not knowingly collect personal information directly from children under 13. If we learn that we have collected such information without required parental consent, we will delete it.
Customer records and recordings may nevertheless contain information about minors, including visitors or people involved in an incident. The Customer must assess whether collecting that information is necessary and lawful, provide required notices and permissions, and apply appropriate protections and retention limits. If you believe information about a child has been collected unlawfully, contact the responsible organization or privacy@guardix.com.
13. Changes and contact
We may update this Policy at any time, including to reflect new features, service providers, technologies, practices, or legal requirements. The updated Policy takes effect when posted, as shown by the effective date above. Where a change materially reduces your rights or the protection of personal information, we will give reasonable notice before it takes effect, by email, in-app message, or a notice on this page, and obtain consent where required by law. Your continued use of the Services after the effective date means you accept the updated Policy. An update does not retroactively authorize an incompatible use of information or replace consent required by law.
Privacy contact
STEM Technology, LLC — Guardix
Attn: Privacy
1901 Central Dr, Ste 404
Bedford, TX 76021-5830, United States
Email: privacy@guardix.com
Related pages: Terms of Service · Data Processing Addendum · Cookie Policy