Privacy Policy

1. Scope

This Privacy Policy applies to personal information processed through cuSafely and related services provided by CES Credit Union or its affiliates ("we", "us"). It does not apply to third-party websites, apps, or services that may be linked from the Service.

2. Data We Collect

• Account & Profile: name, username, email, phone number, company/location assignments, roles, status/approval metadata.
• Usage & Device: IP address, browser/device type, timestamps, pages or features used, error logs.
• Messages & Actions: message visibility, read/unread receipts, push subscription endpoints, location status updates (who changed and when, if applicable).
• Support: information you provide when contacting support.

3. How We Use Data

• Provide and operate the Service (authentication, authorization, messaging, location status).
• Maintain security, prevent fraud/misuse, and enforce policies.
• Communicate with you (e.g., account approval, notifications, support).
• Improve the Service (analytics, performance, usability).
• Comply with legal obligations and organizational policies.

4. Legal Bases / Lawful Grounds

Our processing may rely on one or more of the following (depending on jurisdiction and organizational agreements):

• Legitimate interests in operating a secure communications and safety platform.
• Contract to provide the Service under applicable agreements.
• Consent (e.g., optional web push notifications), where required.
• Legal obligations to comply with applicable laws and regulations.

5. Sharing & Disclosures

• Service Providers: vendors that help operate the Service (hosting, email, push delivery, analytics), bound by confidentiality obligations.
• Organization Admins: your organization's administrators may access relevant data for operational needs.
• Legal: when required by law or to protect rights, safety, or the Service.
• Business Transfers: in the event of a merger, acquisition, or similar transaction.

6. Cookies & Similar Technologies

We use necessary cookies for authentication, security (e.g., CSRF), and core functionality. Where required by law for non-essential cookies, we will request your consent. Disabling necessary cookies may impair functionality.

7. Web Push Notifications

If you opt-in, the Service may send push notifications to your browser/device using your subscription. You can revoke permissions in browser settings. We store only what is necessary to deliver notifications and compute unread counts.

8. Data Retention

We retain information as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data category and organizational policy.

9. Security

We take reasonable and appropriate measures to protect personal information, including encryption in transit, access controls, and auditing. No method of transmission or storage is 100% secure.

10. Children

The Service is not directed to children under the age of 13 (or the age of digital consent in your jurisdiction), and we do not knowingly collect personal information from children without appropriate authorization.

11. Your Rights & Choices

Depending on your location, you may have rights regarding access, correction, deletion, or portability of your personal information, as well as the right to restrict or object to certain processing.

To exercise rights, contact Support or your organization's administrator. Additional rights may apply in certain jurisdictions (e.g., CCPA/CPRA, GDPR/UK GDPR). Requests are handled consistent with law and organizational policy.

12. International Transfers

If personal information is transferred across borders, we implement appropriate safeguards as required by law and maintain protections consistent with this Policy.

13. Changes to this Policy

We may update this Policy periodically. Material changes will be posted within the Service. Continued use after changes become effective constitutes acceptance of the updated Policy.

14. Contact Us