Effective: September 26, 2026

Privacy Policy

This Privacy Policy describes how Gurfinkel Ventures LLC (“SOPReady,” “we,” “us”) collects, uses, and protects information when you use the SOPReady platform. By using the service, you consent to the practices described here.

1. Information we collect

Account information

Name, email address, rank, role, and the department you are associated with. For department administrators: department name, state, type, and billing information (processed by Stripe).

Department profile

Information entered during onboarding: apparatus inventory, staffing model, water supply, response district, specialties, and mutual aid agreements. This data is used to generate department-specific SOPs.

SOP content

Standard Operating Procedures generated through the platform, uploaded by your department, or manually created — including all versions, edits, and approval history.

Acknowledgment records

For every member acknowledgment: the member who acknowledged, the SOP, the version number they acknowledged, and the timestamp. We do not record an IP address for SOP acknowledgments. These records are the compliance audit trail that departments rely on for insurance and legal purposes.

New-hire packet signatures

When someone signs an onboarding packet through an emailed link, we record the name they typed, the timestamp, the IP address the signature came from, and their browser’s user-agent string. A packet is signed without an account, so these are the only details identifying the signer, and they appear on the signed packet PDF. Packet signing is the only compliance record in which we store an IP address; SOP acknowledgments do not. We also use the caller’s IP address transiently as a rate-limiting key on unauthenticated requests, as described in §2.

Uploaded files

Existing SOP documents (PDF, Word, text) uploaded for gap analysis, including extracted text content.

Usage data

Error logs, page views, and feature usage for the purpose of debugging and improving the service. We use Sentry for error tracking, which may receive error context including user identifiers.

Payment information

Processed entirely by Stripe. We store only the Stripe customer ID and subscription status — never credit card numbers, bank accounts, or other financial credentials.

2. How we use your information

• To provide the service — generating draft SOPs, tracking acknowledgments, and producing the compliance reports and exports described below. SOPReady does not monitor regulatory standards on your behalf and does not send standards alerts; see §1 of the Terms of Service.
• To send transactional emails — member invitations, SOP distribution requests, review reminders, weekly compliance digests, password resets, and onboarding packet links.
• To generate AI content — a subset of your department profile (name, state, type, apparatus, staffing, water supply) is sent to Anthropic (Claude) to generate department-specific SOPs. SOP content from other departments is never included in your prompts.
• To maintain security — audit logging, rate limiting, and access control to protect your department’s data.
• To improve the service — aggregated, anonymized usage patterns help us prioritize features. We never use individual department data for this purpose.

3. What we do NOT do

• We do not sell, rent, or share your data with advertisers, data brokers, or marketing platforms. Ever.
• We do not use your department’s SOP content to train AI models or improve outputs for other departments. Your SOPs are yours.
• We do not share your data with third parties except the subprocessors listed below, and only as necessary to provide the service.
• We do not store credit card numbers or financial credentials.

4. AI data handling

SOPReady drafts SOPs using Anthropic’s Claude API. When generating an SOP, we send your department profile context and the relevant SOP topic to that API. The response is stored in your department’s database.

Anthropic is a subprocessor. It handles that data under its own published terms and policies, not under any commitment we can make on its behalf. As of September 26, 2026, Anthropic states that it does not, by default, use inputs or outputs from its commercial products — the Anthropic API among them — to train its models, and that it automatically deletes API inputs and outputs on its backend within 30 days of receipt or generation, subject to exceptions it describes (for example, longer retention where required for legal compliance or where content is flagged under its usage policy). We have not enrolled SOPReady in any Anthropic program that would permit your data to be used for model training, and we do not hold a zero-data-retention agreement with Anthropic, so Anthropic’s standard retention applies.

Those are Anthropic’s terms and Anthropic can change them. The current versions are published at privacy.claude.com. We review this section against those pages at least annually and update the effective date above when it changes.

5. Subprocessors

6. Data retention

Changed September 26, 2026. This section previously said data was deleted 30 days after cancellation and backups purged within 90 days. No such deletion was ever implemented or performed. The section below describes what actually happens, and how to ask us to delete your data.

• Active subscription: All data retained for the duration of your subscription.
• After cancellation: Retained, and still available for export. We do not delete a canceled department’s data automatically and we do not put it on a timer — the acknowledgment record a department built here is often exactly what it needs after it stops paying us, to answer an insurance carrier, a city council, or an attorney.
• Deletion: On request. Email hello@sopready.com and we delete your department’s records from our active systems and confirm when it is done. Export first — deletion is not reversible. Nothing else deletes your data: there is no scheduled purge, and no earlier version of this policy’s 30-day deletion was ever carried out.
• Backups: Our hosting provider takes routine backups that we cannot edit selectively. After we delete a record from our active systems a copy can remain in those backups until they age out on the provider’s own retention schedule, which is set by the provider and not by us.
• Audit logs: Retained on the same basis as everything else above — they are the compliance evidence, so they are not aged out separately or trimmed when a subscription ends.

7. Data security

We implement the following security measures to protect your data:

• Row-level security — department data lives in tables with database-enforced row-level security, so a query made with your session can only return your department’s rows. Members of one department cannot access another department’s data. A small number of operations that are not performed on behalf of a signed-in user — scheduled jobs, billing webhooks, and the acknowledgment links we email to members — run with elevated database credentials and are scoped in application code instead.
• Encryption — data is encrypted in transit (TLS) and at rest (AES-256 via Supabase).
• Access controls — role-based permissions (department admin, member) restrict access to sensitive operations.
• Audit trail — all compliance-significant actions are logged with actor, timestamp, and metadata.
• Rate limiting — request limits on sign-up, SOP generation, and other high-cost endpoints reduce abuse. Rate limiting is a throttle, not an access control; the controls above are what keep one department’s data out of another department’s hands.

8. Your rights

• Access: View your data at any time through the SOPReady dashboard, reports, and audit trail.
• Export: Download your department’s data from Settings as a ZIP archive — the full text of every SOP (including drafts and archived SOPs), your member roster, every acknowledgment record with the member, SOP and version it applies to, and your audit trail.
• Correction: Update your profile information on the Profile page. Department admins can update department settings.
• Deletion: Email hello@sopready.com. Canceling a subscription does not delete anything by itself — see §6. Export your data before asking for deletion; it cannot be undone.

9. Children’s privacy

SOPReady is designed for fire department professionals. We do not knowingly collect information from children under 18.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before they take effect.

11. Contact

Privacy questions or data requests: hello@sopready.com

Gurfinkel Ventures LLC