Privacy Policy
Rollcall is asset tracking software for businesses in the United States. This policy explains what we do with personal information — yours, if you have an account, and other people's, if your employer put their details into the system.
We have tried to write this the way we write everything else: plainly, and without hiding anything in a long sentence. If something here is unclear, email us at timothy@rollcallsoftware.com and we will explain it.
Two different roles, and why it matters
Rollcall handles two kinds of information, and our responsibility is different for each.
Your account information — we are the controller. When you sign up, we decide how your name, email and organization name are used. If you want that information corrected or deleted, ask us directly.
Everything your company uploads — we are the processor. Your equipment records, serial numbers, locations, and the names of staff holding gear belong to your company. We handle that data on your company's instructions, not our own. Your company decides what goes in, who can see it, and when it comes out.
The practical difference: if you are an employee and you want your name taken out of your employer's equipment records, we cannot simply do that for you. Ask your employer. They control that data, and we will act on their instruction. If you are not sure who to ask, write to us and we will point you at the right organization.
What we collect
Account data
When someone creates an account or is invited to one:
- Name and email address.
- Password, stored as a hash by our authentication provider. We never see or store the password itself.
- Organization name and your role within it.
- Email addresses you enter when inviting colleagues.
Data your organization uploads
This is whatever your company chooses to track. Typically:
- Assets: names, descriptions, serial numbers, purchase dates, photos, categories.
- Locations: job sites, yards, tool rooms, vehicles, offices.
- People who hold equipment: names, and email addresses if your company wants confirmation emails sent.
- The original spreadsheet files you import.
- Audit records: a log of who did what and when — every check-out, check-in, scan, edit and confirmation.
Technical and log data
Our hosting provider records ordinary web server information when you use the product: IP address, browser and device type, which pages were requested, and when. We use it to keep the service running, investigate faults, and detect abuse. We do not build profiles from it or use it for advertising.
Messages you send us
If you fill in the contact form on this website, we receive your name, company, email address and message. If you book a demo, you do that on a third-party scheduling site — see who we share information with.
Cookies
The product at app.rollcallsoftware.com sets authentication session cookies only. They are provided by our authentication service and they keep you signed in as you move between pages. They are strictly necessary: without them the service cannot tell who you are, and you cannot use it at all.
This marketing website sets no cookies whatsoever.
We do not use analytics, advertising pixels, session recording, chat widgets, or any third-party tracker — on either the website or the product. That is a deliberate choice, not an oversight.
Because we set nothing beyond what is strictly necessary to sign you in, there is no cookie consent banner. There would be nothing to consent to.
Why we use this information
| What we do | Why |
|---|---|
| Run the service — accounts, assets, scanning, check-in and check-out | To provide what you signed up for |
| Send service email — sign-in links, invites, equipment confirmations | To operate features you or your organization turned on |
| Keep records secure and investigate problems | Our legitimate interest in a service that works and is not abused |
| Answer your messages | To respond to you |
| Respond to lawful legal requests | Legal obligation |
We do not use your data to train machine learning models, and we do not use it to build advertising audiences.
Equipment confirmation emails
Rollcall can send an automatic email to whoever is holding a piece of equipment, asking them to confirm they still have it. Tapping the link in that email records the confirmation. We should be direct about what this means: some people who get these emails never signed up with us. They are our customer's employees or subcontractors, and their email address reached us because our customer entered it.
If you received one of these and you are wondering who we are:
- These are transactional messages, sent at our customer's direction. Your employer, or the business that gave you the equipment, configured them. We act as their processor.
- We never use these addresses for our own marketing. We do not sell them, rent them, share them with anyone else, or add them to any mailing list.
- The confirmation link is single-use, expires, and works only for the one item and the one person it was issued to.
- The feature is off unless an administrator at that business switches it on.
- To stop receiving them, ask the business that holds your equipment. They control it. If you cannot work out who that is, email us and we will help you find them.
Our customers are responsible for having a lawful basis to give us their staff's contact details, and for telling their staff that the system will email them. That obligation is written into our Terms of Service.
Who we share information with
We share data with a small number of vendors who run parts of the service for us — hosting, the database, outbound email, payments and our contact form. They are listed individually, with what each one handles and where, on our subprocessor page. We keep that page current so you can answer a security questionnaire without emailing us.
Other than that, we share personal information only when:
- You or your organization ask us to.
- We are required to by law, or in response to a valid legal request. We will tell you when we are permitted to.
- We need to establish or defend legal claims, or protect someone's safety.
- The business is sold or merged, in which case your data moves with it and this policy continues to apply until we give you notice of a change.
We do not sell your personal information
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We never have. We have no advertising relationships and no trackers to support them.
That is why you will not find a "Do Not Sell or Share My Personal Information" link on this site. There is nothing to opt out of.
How long we keep things
| What | How long |
|---|---|
| Account data | While the account is open, then deleted within 30 days of closure |
| Assets, locations and other uploaded records | Until you delete them, or within 30 days of account closure |
| Original imported spreadsheets | 90 days after the import is committed, then deleted |
| Audit records | While the account is open, and for at least 12 months after it closes |
| Server and request logs | A short period set by our hosting provider, for security and debugging |
| Contact form messages | While we are talking, and afterwards as a record of the conversation |
Why the audit log is treated differently
Rollcall's audit log is deliberately append-only. Records can be added but never edited or deleted while an account is open. That is the point of it: an equipment history that anyone could quietly rewrite would not be worth having, and it is what lets you prove who had a tool and when.
So we will not remove individual entries from a live account on request, and we would rather say that plainly than promise otherwise. We keep the audit history for at least 12 months after an account closes. If you want yours removed sooner than that, write to us and we will tell you honestly what we can and cannot do.
Why we keep import files at all
We keep your original spreadsheet for a short period after import so we can show you exactly what was in the file if something imported oddly, and so we can re-run the import if needed. After that it has no further use and is deleted. The records it created stay in your account, as normal.
Your choices and rights
Whoever you are, you can ask us to:
- Give you a copy of the personal information we hold about you, and tell you where it came from.
- Correct it if it is wrong.
- Delete it, subject to the retention periods above.
- Export it in a portable, machine-readable format.
Email timothy@rollcallsoftware.com. We will confirm we received your request and respond within 45 days. If we need longer we will tell you why. We may need to verify who you are first — usually by checking you control the email address on the account.
We will never charge you, degrade your service, or treat you differently for exercising any of these rights.
One limit worth repeating: if your details are in an employer's equipment records, that employer decides. Send your request to them, and we will act on their instruction.
Children
Rollcall is a business tool, sold to businesses. It is not intended for consumers, it is not directed at children, and it is not for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child's information has ended up in our systems, email us and we will remove it.
How we protect information
What we actually do, stated without exaggeration:
- Row-level security on every table. Separation between customers is enforced by the database itself, not by application code that could forget. Every table has it, without exception.
- Automated cross-tenant tests. We run a test suite that sets up two separate organizations and asserts that neither can read a single row belonging to the other. It runs before changes ship.
- An append-only audit log, with no code path that can edit or delete an entry.
- Encryption in transit and at rest, provided by our database and storage platform.
- Secrets confined to server-side code. Administrative database keys exist only on the server, are never included in anything sent to a browser, and our build fails if one is referenced from client code.
- Limited access. Only the founders can reach production systems.
What we are not claiming: we do not hold SOC 2, ISO 27001 or any other certification, and we will say so if you ask. No system is perfectly secure, and Rollcall is early software. Please keep your own copy of anything you could not stand to lose.
Where we operate
Rollcall is offered to customers in the United States. Data is stored in the United States, in the US East (N. Virginia) · AWS us-east-1 region.
The service is not directed at the European Union, the European Economic Area, or the United Kingdom, and it is not designed to meet the requirements that apply there. If you are subject to those rules, Rollcall is not currently the right product for you.
Changes to this policy
If we change this policy we will update the effective date at the top. For changes that meaningfully affect how we handle your information, we will email account administrators at least 10 days before the change takes effect, so you have time to read it and decide.
Contact us
Questions, requests, or anything you think this policy gets wrong:
Timothy Buchen, doing business as Rollcall
Illinois, United States
timothy@rollcallsoftware.com
Email reaches us fastest, and a founder reads it. If you need a postal address to send a formal request or notice, ask and we will give you one.