Privacy notice

Who we are

atduty (Atduty Inc., "we") provides software that organizations use to run events, classes, courses, bookings and registrations. This notice explains what personal information atduty handles, why, and the choices you have.

Write to us about privacy at privacy@atduty.com.

Two roles

• When you register with an organization, the organization decides what it asks and why. For that information the organization is the controller, and atduty processes it on the organization's behalf. Questions about an organization's use of your information go first to that organization; its address for privacy questions is shown at the foot of its pages.
• For your atduty account itself (your sign-in, your security settings, and how you use the service) atduty is the controller.

What we handle

• Account details: your name, email address, preferred language and time zone, and your sign-in methods. Passwords are stored only as a one-way hash; passkeys and second factors are stored as their public parts.
• Security records: sign-in attempts, the device and browser used, IP addresses, and an audit record of sensitive actions.
• What an organization asks: the answers you give on its forms, which the organization chooses. They can include date of birth, school and grade, emergency contacts, photo and media consent, and ordinary notes such as allergies or a medical condition to be aware of. You may give them for yourself or for family members, including children, you are allowed to act for.
• Registrations and participation: what you registered for, attendance and check-in (including a photo at check-in where the organization uses it), course progress, results and certificates.
• Payments: amounts, what they were for, and the payer's name and email. Card details go straight to Stripe and never reach atduty; Stripe keeps its own record of each payment under its own privacy policy.
• Messages and files: messages with an organization and files you upload.
• Notifications: email delivery records, and a device token if you turn on push notifications.
• Your choices: whether you agreed to hear news from an organization, with the record of when and how.

We do not use advertising trackers, we do not sell personal information, and we do not share it for targeted advertising. atduty uses only the cookies and browser storage it needs to work, and none that track you: your session, and short-lived ones while you sign in; your language, time zone and display theme; and, kept in your browser only, unsaved drafts (such as a form being designed or a learner's answer in progress), the list views you chose, and whether you turned push notifications on or dismissed the offer.

Why we use it

• to provide atduty to you and to the organizations you deal with (our contract with you, and the organization's instructions);
• to keep accounts and the service secure, and to prevent abuse (our legitimate interest in a secure service);
• to send the email the service needs, such as verification codes, confirmations and reminders;
• to send an organization's news, in the organization's name and as its sender, only where you confirmed that you want it (your consent, which you can withdraw from any such email);
• to meet legal obligations, such as keeping financial records.

Who receives it

• The organization you register with, and the people it authorizes, such as its staff and volunteers.
• Our service providers, which run parts of the service for us, under written agreements and only for that purpose: hosting and storage, email delivery, card payments, push notifications, and error reports. The list of these providers is available on written request to privacy@atduty.com.
• Authorities, when the law requires it, and others where needed to protect someone's safety or our rights.
• A successor, if atduty's business is transferred, under this notice's protections.

How long we keep it

• An organization's records are kept for as long as the organization keeps them in atduty, subject to the law and to deletion requests.
• When you delete your account, it is removed after a 30-day grace period, during which you can ask us to restore it. The records that you accepted the Terms of use and read this notice are deleted with it.
• Records of a marketing consent are kept while the consent is live and, after it is withdrawn or lapses, for as long as they may be needed as proof that the organization's news was sent with consent.
• atduty's copy of each payment's record (the amount, what it was for, the date and the payment provider's reference) is kept for as long as tax and accounting law requires.
• An organization can keep an archive of its events that are purged from atduty. It is on by default and kept after the purge for the period the organization chooses in its settings, or the organization can turn it off. What you gave the organization for those events stays in the archive for that period, on the organization's instructions. A request to erase your information reaches the archive too, and when the organization closes, its archive is given to it and then deleted.
• The audit record of sensitive actions is kept for as long as it is needed for security, to meet legal obligations and to resolve disputes.
• Backups are kept for 30 days, then deleted.

The periods we apply are available on written request to privacy@atduty.com.

Children

Organizations such as schools and clubs use atduty for children's activities. A child's information is given by a parent or guardian, or by the school as part of a registration. You must be 18 or older, or the age of majority where you live, to create an account; a younger person is registered by a parent or guardian. A parent or guardian consents before a child uses atduty's learning features; a school does not consent in a parent's place. A school remains responsible for the notices the law requires of it, including under FERPA, and atduty acts for the school as a service provider.

A child learns in one of two ways, both started by a parent or guardian: on the parent's own device, in learner mode, or on the child's own device, through a link and a code the parent gives them. A learner session keeps a session cookie, for that school's address, on the child's device. It lasts until it has gone unused for a year, or until a parent or guardian ends it, or the school ends it for the child's safety. While a child learns, atduty records their answers, submissions and progress in the school's course, and which parent or guardian made the session possible. A learner is not sent email or marketing, cannot send messages, and has no analytics profile.

Your rights

Depending on where you live, you may have the right to see, correct, export or delete your information, to object to or restrict some uses, and to withdraw consent. You can:

• see and change your details in your account settings;
• download your data from your account settings;
• delete your account from your account settings;
• ask an organization to correct or delete what it holds about you;
• write to us at privacy@atduty.com for anything else, including if you have no account. We may need to confirm your identity first.

You may also complain to the authority that oversees privacy where you live.

Where it is stored

Your information is stored in the United States. If you live elsewhere, it is transferred to the United States and processed there, where courts, law enforcement and national security authorities may be able to reach it under US law. Some of our service providers handle data in other countries; the list of providers, available on written request, says where. Where the law requires it, transfers are protected by standard contractual clauses or an equivalent safeguard.

Security

Data is encrypted in transit and at rest. Access inside atduty is limited by role and recorded, every organization's data is kept separate from every other's, and accounts can use passkeys and a second factor. No system is perfectly secure; we will tell affected organizations and people about a breach as the law requires.

Changes

We publish each new version of this notice on this page with the date it takes effect, and announce it here before that date.