Privacy Policy

1. Who we are

CheckpointGuard is operated by Ioannis Chorafas. CheckpointGuard is the product/trading name used for the service.

Operator / legal name: Ioannis Chorafas

Address: Agios Nikolaos, Crete, 72100, Greece

Country: Greece

Privacy contact email: [email protected]

For privacy questions, data requests, or account deletion requests, contact us at:

[email protected]

For operational guard, employee, patrol, site, schedule, payroll-review, report, message, SOS, NFC, geofence, and location data entered or generated by a customer organization, the customer organization is generally the controller, employer, or operator responsible for deciding why and how the data is used. CheckpointGuard generally acts as a processor or service provider for that operational data.

For our website, account administration, billing, NFC tag orders, direct support, security operations, and our own legal/business administration, CheckpointGuard may act as a controller. Customer organizations are responsible for staff notices, employment/labor compliance, internal monitoring policies, and having a lawful basis for their use of CheckpointGuard.

2. Services covered by this Privacy Policy

This Privacy Policy covers:

• CheckpointGuard website
• CheckpointGuard Web Admin
• CheckpointGuard Android app (guard and admin workspaces)
• Firebase login and authentication services
• NFC tag purchases and order pages
• Aegis AI features
• related APIs, notifications, and support services

3. Users of CheckpointGuard

CheckpointGuard is intended for business and operational use by authorized users, including:

CheckpointGuard is not intended for children.

• security company owners and administrators
• hotel or site supervisors
• patrol supervisors
• security guards
• approved company staff

4. Data we collect

Depending on the user role, app permissions, customer package, customer configuration, and enabled features, we may collect or process account and identity data, admin app and web dashboard data, guard app location data, QR and NFC checkpoint data, geofence data, SOS alert data, messages and uploaded content, scheduling and payroll-ready review data, device and technical data, website analytics data, marketing/demo request data, and NFC tag order, Stripe payment, billing, and shipping data.

Some features are available only on certain packages. For example, live GPS and trail playback may be enabled only for Gold and Platinum customers, and Aegis AI may be enabled only for Platinum customers. If a feature is not enabled for a customer, the related data may not be collected or processed for that customer, except for security, account, audit, billing, or operational records required for the service.

Account and identity data

• name
• email address
• user ID
• guard or employee ID code used for shift verification, where enabled
• authentication identifiers
• role, such as admin, supervisor, or guard
• assigned company or site
• profile image, if uploaded
• account status and access permissions

Admin app and web dashboard data

When admins use the CheckpointGuard admin workspace or Web Admin, we may process:

The CheckpointGuard admin workspace may show guard location and patrol activity to authorized admins. Admin access is limited by role, site assignment, and permission settings.

The CheckpointGuard admin workspace may use the admin device location while the app is open and the admin is using map edit tools, such as placing NFC checkpoints or geofences. This location is used to suggest a checkpoint or geofence position on the map, and the admin can adjust the marker manually. The Admin App does not use this for continuous admin tracking or background admin location tracking.

• admin login information
• admin actions and activity logs
• selected sites
• viewed guard operational data
• viewed guard location data
• SOS alert handling
• QR and NFC checkpoint management
• guard ID code generation and updates for shift verification
• geofence management
• messages and operational notes
• report and scheduling activity where enabled
• automatic report settings, report recipients, report delivery logs, and exported reports where enabled
• Aegis prompts, responses, reports, response reports, and related metadata where enabled
• push notification tokens, where notifications are enabled

Guard app location data

The CheckpointGuard guard workspace may collect device location data during active patrol or active shift workflows.

This may include:

CheckpointGuard uses location data so authorized supervisors can monitor live guard activity, verify site coverage, respond to SOS alerts, and review patrol history.

The CheckpointGuard guard workspace may continue collecting location during an active patrol or active shift while the screen is off, the app is in the background, or the app is not visibly open, depending on app/device settings, customer configuration, package, and app workflow. This may occur through an active foreground tracking service/notification.

Location may be used for active patrol/shift tracking, live monitoring, SOS context, geofence visits, patrol history, and operational proof. Tracking should stop when patrol or shift tracking is stopped, the shift ends, the user signs out, or tracking is disabled according to the app/customer workflow. Authorized admins can view guard location only according to their role, site, operation-sector, and package permissions. Location is not used for unrelated advertising.

• latitude and longitude
• device GPS timestamp and server received timestamp
• GPS accuracy meters
• speed, provider/source, or mock flag where available
• live guard location
• recent movement history
• guard trail/history for selected dates and time ranges
• geofence visit signals
• site arrival or exit context
• shift start and shift end events submitted through a Shift NFC page
• guard or employee ID code verification results

QR checkpoint data

When a guard scans a QR checkpoint, we may collect the opaque checkpoint token, guard and site references, captured and server-received times, patrol context, a client scan identifier, delayed-sync status, and available GPS evidence.

QR checkpoint data is used to validate and record patrol visits. Printed QR codes can be copied, so customers can regenerate tokens and optionally require nearby GPS verification.

NFC checkpoint data

When a guard scans an NFC checkpoint, we may collect:

NFC scans are used to verify patrol visits and create operational records.

• NFC checkpoint identifier
• checkpoint name
• guard user ID
• hotel or site ID
• scan time
• related location context, where enabled

Geofence data

We may process geofence data such as:

Geofence data is used for site coverage monitoring and patrol review.

• geofence name
• geofence shape or radius
• hotel or site assignment
• guard geofence visit time
• geofence status, such as visited, overdue, or missed

SOS alert data

When a user sends an SOS alert, we may collect:

SOS alerts are intended to notify authorized supervisors and create an operational record. CheckpointGuard does not replace emergency services.

• user ID
• hotel or site
• time of alert
• alert status
• location context, where enabled
• supervisor response and acknowledgement
• related operational history

Messages and uploaded content

If messaging or upload features are enabled, we may collect:

• message text
• sender and recipient information
• timestamps
• uploaded photos or files
• hotel or site context

Device, app, and technical data

We may collect:

This data is used for security, troubleshooting, reliability, and notifications.

• device type
• operating system
• app version
• IP address
• push notification token
• crash logs
• error logs
• diagnostics
• security logs
• failed login or failed access attempts
• permission-denied events
• rate-limit events
• suspicious request patterns
• public Shift NFC failed code attempts
• backend error identifiers

Website analytics data

Website requests may generate limited hosting and security records. Optional Google Analytics page and conversion tracking is disabled in this release.

Operational records are used to maintain availability and investigate abuse.

• pages visited
• approximate country or region
• browser and device type
• referring source
• basic usage events

NFC tag orders, Stripe payments, billing, and shipping

If you purchase NFC tags or related physical products, we may collect or access:

Payments are processed by Stripe or another payment processor. We do not intentionally store full payment card numbers on our own servers. Stripe may process payment information according to its own terms and privacy policy.

We use order, billing, and shipping information to:

We may access order and shipping information in Stripe or internal order records when needed to fulfill NFC tag orders or support customers.

• name
• email address
• company name
• phone number, if provided
• billing address
• shipping address
• order details
• product quantity
• payment status
• invoice or tax information
• delivery/support notes
• process orders
• ship NFC tags
• send receipts or invoices
• provide customer support
• handle delivery issues, returns, or refunds
• prevent fraud
• comply with tax and accounting obligations

Client sharing and optional integrations

Approved client accounts can view activity for their assigned sites. Incident text and attachments are shared through the client portal only when an authorised administrator explicitly publishes a client-facing summary and separately approves any attachment. Internal messages are not automatically published.

If a customer enables recruitment tools, we may process candidate contact details, source URLs, relevant public-source text, availability, experience, fit scores, review notes and outreach drafts. Public availability is not treated as unrestricted consent. Where enabled, Telegram receives selected operational questions, responses and alert details; public-web research sends the submitted research question to the configured research provider. Customers must not include private worker or client information in public-web research.

5. Aegis AI

CheckpointGuard may include an AI assistant called Aegis.

Aegis is designed to help authorized admins understand operational data, such as guard status, SOS alerts, NFC scans, geofence visits, messages, patrol activity, schedules, and report context.

Where Aegis features are enabled, CheckpointGuard may process admin prompts, responses, selected operational context, findings, severity, recommendations, audit logs, conversation messages, and metadata. Aegis only uses data the authorized admin is permitted to access and is decision-support only. Aegis does not override role, site, operation-sector, package, or feature permissions.

Where enabled, Aegis prompts, responses, interactions, feedback, reports, response reports, redacted response previews, request identifiers, and related safety logs may be stored for security, debugging, quality improvement, abuse prevention, operational review, and Super Admin review.

Aegis responses may be reported or flagged from inside the CheckpointGuard admin workspace where available. Aegis response reports may include reporting admin ID/email, timestamp, reason, optional note, site scope, app/platform, redacted response preview or response/request ID, and demo/test marker where applicable.

Aegis may summarize, explain, warn, or suggest actions based on data the admin is already allowed to access.

Aegis can make mistakes and should not be treated as a replacement for supervisor judgment, emergency services, legal advice, payroll decisions, safety procedures, or safety-critical decision-making. Important operational, payroll, safety, or emergency decisions must be verified and confirmed manually by an authorized human user.

Where enabled, Aegis may proactively notify admins about operational issues, such as SOS alerts, stale guard activity, overdue patrol activity, or other configured findings.

Aegis does not have permission to access data outside the permissions of the authenticated admin account.

6. How we use data

We use data to:

We do not sell personal or sensitive user data.

• provide the CheckpointGuard platform
• authenticate users
• manage roles and permissions
• show live guard activity to authorized admins
• record patrol activity
• verify QR and NFC checkpoint scans
• detect geofence visits
• send SOS alerts and notifications
• support operational messages
• generate logs and operational reports
• support scheduling and payroll-ready review where enabled
• process NFC tag orders
• ship physical products
• provide support
• maintain security and prevent misuse
• troubleshoot bugs and improve reliability
• comply with legal, accounting, tax, and contractual obligations

7. Legal basis for processing

Where GDPR applies, we process personal data based on one or more of the following legal bases:

Customer organizations using CheckpointGuard are responsible for informing their staff and guards about their internal use of the platform, including location tracking, patrol monitoring, and operational reporting.

• performance of a contract
• legitimate interests in providing and securing security operations software
• consent, where required
• compliance with legal obligations
• protection of vital interests in genuine emergencies, only where the applicable legal conditions are met

8. How we share data

We may share data only where necessary to provide, secure, or support the service.

Data may be shared with:

We do not sell personal data.

• the customer organization that manages the user account
• authorized admins and supervisors within permitted company/site access
• hosting and database providers
• Firebase/Google authentication services
• Google Maps or location service providers
• push notification providers
• email providers
• analytics providers, where enabled
• Stripe or payment processors
• shipping/delivery providers, where needed for NFC tag orders
• AI infrastructure or AI service providers, where Aegis is enabled
• legal authorities where required by law

9. Data security

We use technical and organizational measures designed to protect data, including:

No system can be guaranteed completely secure, but we work to protect personal and operational data from unauthorized access, misuse, alteration, or loss.

• HTTPS encryption in transit
• Firebase authentication
• role-based access controls
• site-level access restrictions
• server-side authorization checks
• scoped operational broadcasts
• rate limits on sensitive endpoints
• logging and monitoring
• restricted access to operational data
• secure handling of secrets and configuration

10. Data retention

We keep data only for as long as needed for the purposes described in this policy, unless a longer retention period is required for legal, accounting, tax, security, audit, contractual, or legitimate operational reasons.

Retention periods may vary by data type:

• account data: kept while the account is active or as needed for support/legal reasons
• patrol and operational records: kept according to customer needs and operational requirements
• location history and guard trails: kept according to customer configuration and operational requirements
• SOS alerts and logs: kept for operational review, security, and accountability
• NFC scans and geofence visits: kept for patrol proof and reporting
• payment/order records: kept as required for accounting, tax, fraud prevention, and support
• technical logs: kept for security, debugging, and reliability
• AI conversations, feedback and audit logs: retained for the stated service, security and review purposes, subject to applicable retention instructions and legal obligations

11. Account deletion and data deletion

Users may request deletion of their account or related personal data through:

https://checkpointguard.com/account-deletion/

or by contacting:

[email protected]

In the CheckpointGuard admin workspace and web account page, authorized users may also initiate an account deletion or data deletion request.

After verification, CheckpointGuard will delete or anonymize the personal account information and associated personal data covered by a valid deletion request, except for information that must be retained for legitimate legal, security, fraud-prevention, contractual, accounting, audit, dispute-resolution, or operational reasons.

Some data may be retained where required or justified for:

Deleting an admin account does not automatically delete all company, site, guard, patrol, SOS, NFC, geofence, invoice, or operational records unless the requester is authorized and the deletion is legally and operationally appropriate.

Company or workspace deletion may require verification of authority and may be handled as a separate request.

• security
• fraud prevention
• legal obligations
• accounting or tax obligations
• contractual obligations
• dispute resolution
• audit logs
• operational records required by the customer organization
• safety or SOS-related accountability

12. User rights

Depending on applicable law, users may have rights to:

To exercise these rights, contact:

[email protected]

• access personal data
• correct inaccurate data
• request deletion
• restrict processing
• object to certain processing
• request data portability
• withdraw consent where processing is based on consent
• lodge a complaint with a data protection authority

13. Customer organization responsibility

CheckpointGuard is used by businesses and organizations for security operations.

Customer organizations are responsible for:

• assigning authorized users
• informing guards and staff about monitoring
• ensuring they have a lawful basis for location and patrol tracking
• configuring user permissions correctly
• complying with employment, labor, privacy, and security obligations
• deciding internal retention rules where configurable
• handling internal employee notices and approvals where required

14. International data transfers

Some service providers may process data outside the user’s country. Where required, we use appropriate safeguards for international transfers, such as contractual protections or other lawful transfer mechanisms.

15. Cookies and website tracking

Our website may use cookies or similar technologies for:

Optional Google Analytics tracking is disabled in this release. Necessary authentication, security and preference storage may still be used. Optional tracking must not be enabled without appropriate prior choices and disclosures.

• website functionality
• analytics
• security
• performance measurement

16. Children

CheckpointGuard is not intended for children and does not knowingly collect data from children.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date above.

If changes are significant, we may provide additional notice where appropriate.

18. Contact

For privacy questions, data requests, or complaints, contact:

Ioannis Chorafas

Agios Nikolaos, Crete, 72100, Greece

Email: [email protected]