Privacy Policy

This Privacy Policy explains how DylTec Co. ("ReliefCommand," "we," "us") handles information in connection with the ReliefCommand web dashboard and mobile app (together, the "Service").

1. Two kinds of data, two roles

It matters, for this policy, which of two buckets a piece of information falls into:

• Account data — information about you as a user: name, email address, and the role/organization you're assigned. We are the controller of this data: we decide why we collect it (running the Service, invoicing, support) and are the ones you should contact about it.
• Customer Data — the operational data your organization enters into the Service: inventory (boxes, products, quantities), orders and shipments, point-of-distribution codes, volunteer names and hours, product photos, and any information about beneficiaries or recipients your organization chooses to record. Here, your organization is the controller and we act as a processor/service provider on its behalf, following its instructions (as expressed through how it configures and uses the Service). If you are a beneficiary, volunteer, or staff member whose information appears in Customer Data, your relief organization — not us — is who to contact about it; we will refer you to them.

We do not independently review, sell, or use Customer Data for any purpose other than providing the Service, and we do not use it to train machine-learning models.

2. What we collect

Directly from you or your organization:

• Account details: name, email, phone (if provided), organization, and role, via Firebase Authentication, using email/password, Google Sign-In, or Apple Sign-In on supported mobile devices.
• Customer Data as described above, including any product images uploaded to the app.
• Invoicing details: your organization's name and any billing contact you give us for invoice correspondence. Payment happens outside the Service, under your organization's agreement with us; we never receive or store card numbers.
• Anything you send us directly, e.g. by emailing support.

Automatically:

• Diagnostic data from our error-monitoring provider, Sentry: the error and its stack trace, the page or screen it happened on, app version, and device or browser type. We do not configure Sentry to attach your name, email, IP address, cookies, or request bodies. We also send timing data (performance traces) for about one in ten requests.
• Session replay, a screen recording Sentry uses to show what led to a bug. On the mobile app it records only around an error, never a session that ran cleanly. On the web app it records around an error and for a 10% sample of other sessions. Replay masks all text and images by default, so Customer Data on screen is hidden in the recording.

3. How we use it

• To provide, maintain, and secure the Service (authentication, org-scoped access, storage, and processing described below).
• To invoice and collect fees under your organization's service agreement.
• To respond to support requests and send Service-related notices (e.g. a claim change, an invoice).
• To diagnose and fix bugs and crashes.
• To meet legal obligations.

We do not sell personal information, and we do not use it for third-party advertising.

4. Who we share it with

We don't sell your data. We share it only with the infrastructure providers that run the Service on our behalf, each bound to only use it to provide their service to us:

• Google Firebase / Google Cloud — authentication, database (Firestore), file storage, and serverless functions. This is where Account data and Customer Data are stored.
• Vercel — hosting for the web dashboard.
• Twilio receives mobile numbers and order-update text messages for SMS delivery.
• Expo push service receives device push tokens and notification content for delivery through Apple and Google.
• The configured OpenAI-compatible provider receives product descriptions and category choices when staff request intake suggestions or reference prices. Suggestions require staff review.
• upcitemdb receives scanned barcodes for catalog lookups. Catalog entries are shared across organizations.
• Upstash processes rate-limit identifiers for public order tracking when configured.
• Google reCAPTCHA Enterprise processes browser and device signals for abuse prevention when configured.
• Sentry — error monitoring, performance traces for a sample of requests, and session replay around errors (plus a sample of other sessions on the web app).

We may also disclose information if required by law, to protect the rights, safety, or property of ReliefCommand or others, or in connection with a merger, acquisition, or sale of assets (with notice to affected organizations).

5. Data isolation between organizations

Customer Data is scoped to the organization that created it. Access is enforced at the database layer via server-verified organization membership and role — issued only by our backend, never accepted as a value a client claims — so one organization's users cannot read or write another organization's data regardless of what the app's interface shows them. Shared barcode catalog entries are available across organizations. A POD manager may access a warehouse through a redeemed POD code without joining its organization. Warehouses may publish category-level needs lists, and an order reference allows limited public shipment tracking.

6. Data retention and deletion

We retain Account data and Customer Data for as long as your organization has an active agreement or account, so the Service keeps working as expected.

You can delete your own account in the app, under Settings on the web and Profile on mobile. You confirm it is you first by signing in again. Deleting your account removes your sign-in, your volunteer profile, your organization membership and role, your POD links and your notification devices. If you are your organization's only org manager, we ask you to make someone else an org manager first.

Volunteer hours you logged are not deleted. Your organization may need them as donated-labor records for federal disaster reimbursement, which can require keeping them for at least three years after a grant closes. They stay, with your name replaced by "Deleted volunteer" and no link back to your account. Other records your organization created, such as orders and inventory history, stay with the organization. If your organization wants all of its data deleted, on account closure or on request, contact support@dyltec.com and we will delete it within a reasonable time, except where we need to retain certain records (e.g. invoice records) to meet legal or accounting obligations. We do offer inventory, order and volunteer reports, but no self-service export of all account and organization data.

7. Security

We use industry-standard measures appropriate to the sensitivity of the data, including encryption in transit, server-verified access control scoped to organization and role, and restricting administrative data access to what a given operation requires. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Children's privacy

The Service is intended for use by adults administering or working at relief organizations. It is not directed to children, and we do not knowingly collect personal information from children under 13 (or the relevant minimum age in your jurisdiction) as Account data. Where an organization records a beneficiary who is a minor as Customer Data, that is the organization's data and the organization's responsibility to handle in accordance with applicable law.

9. International data transfers

Our infrastructure providers may process and store data in the United States and other countries where they operate. Where required, we rely on appropriate safeguards for any such transfer.

10. Your choices

SMS order updates

A mobile number is optional. We send order-update texts only after recording checkbox consent or a staff note documenting the contact's verbal consent. Message frequency varies. Message and data rates may apply. Reply STOP to opt out, HELP for help. Consent is not required to use the Service. A STOP request applies across organizations using our sending service. Contact support@dyltec.com for help.

Mobile numbers are not shared for marketing. We share them with Twilio to deliver requested messages.

• You can review and correct your account details from within the app.
• You can delete your account in the app, or request deletion as described in Section 6.
• If you are in a jurisdiction that grants you additional rights over your personal information (e.g. access, correction, deletion, portability), contact us and we'll act on your request or, for Customer Data, route it to the relevant organization as its controller.

11. Changes to this policy

We may update this policy from time to time. If a change is material, we will notify organization managers by email or in-app notice before it takes effect.

12. Contact

Questions or requests regarding this policy: support@dyltec.com or 1741 Dexter St, Dubuque, IA 52001. See also the contact page.