Privacy Policy

Account information. Name, email address, password credentials (stored by our authentication provider in hashed form), role, and agency affiliation.

Agency and compliance records ("Customer Data"). Information your agency enters into the Service: agency profile and license details, quality indicator values, incident and ANE documentation (which may include client and staff names and descriptions of events), emergency preparedness records, training logs, performance improvement projects, notes, and generated reports. Your agency controls what is entered.

Billing information. Paid subscriptions are processed by Stripe. We receive your plan, subscription status, and billing metadata. We never receive or store full payment card numbers.

Usage and log data. Standard technical logs: IP address, browser type, pages and features used, timestamps, and error events, used for security and service operation.

Marketing site submissions. If you submit our contact or waitlist form, we collect the information you provide (such as email and agency name).

Cookies. We use only the cookies necessary for authentication sessions and security. We do not use advertising cookies or cross-site tracking.

• To provide, operate, secure, and support the Service
• To process subscriptions and payments
• To communicate with you about the Service (transactional messages; and, with your consent or as permitted, product updates you can opt out of)
• To monitor performance, debug, and improve the Service
• To enforce our Terms and protect against fraud, abuse, and security threats
• To comply with law

We do not sell personal information. We do not use Customer Data for advertising. We do not use Customer Data to train generalized AI models.

For Customer Data, your agency is the controller of the records it keeps; PasQAPI processes those records on the agency’s instructions to provide the Service. Individuals whose information appears in an agency’s records (for example, an agency’s clients or staff) should direct requests about those records to the agency; we will support our customer agencies in responding.

If your agency is subject to HIPAA or Texas Health & Safety Code Chapter 181 and intends to store protected health information in the Service, a Business Associate Agreement with us is required first — see our Terms of Service, Section 6, and contact support@pasqapi.com.

When a user invokes an AI-assisted feature (for example, polishing a note or asking a rules question), the relevant text is transmitted to our AI subprocessor (Anthropic) via its commercial API to generate a draft or answer, and the result is returned to the user for review. Under our configuration, API inputs and outputs are not used to train the provider’s models. AI features are optional, user-initiated, and may be limited or disabled for certain accounts or data categories consistent with Section 3 and our Terms.

We use a small set of vetted providers to run the Service:

Each provider processes information only to perform its function under contractual restrictions. We will update this list as our providers change.

We apply administrative, technical, and physical safeguards appropriate to the data we hold, including encryption in transit (TLS) and at rest, per-agency data isolation enforced at the database layer (row-level security), role-based access controls within each agency, least-privilege internal access, and daily backups. No system is perfectly secure; we encourage strong passwords and prompt reporting of any suspected issue to support@pasqapi.com.

• Account and Customer Data: retained while your agency’s account is active. After termination, data is available for export for 30 days, then deleted from production systems, with residual copies removed on our standard backup cycle.
• Billing records: retained as required for tax, accounting, and legal purposes.
• Marketing submissions: retained until you ask us to remove you or the information is no longer needed.
• Logs: retained for a limited period for security and diagnostics.

• Access, correction, export, deletion. Email support@pasqapi.com. Agency admins can manage most records directly in the Service. For records held within an agency’s account, we may route or coordinate the request with that agency (Section 3).
• Marketing emails. Opt out via the link in the message or by contacting us. Transactional messages (billing, security, service notices) are sent as needed to operate the Service.
• Texas residents may have rights under the Texas Data Privacy and Security Act; we honor applicable rights requests regardless of technical exemptions. We do not sell personal data or process it for targeted advertising.

If we determine that a security incident has compromised personal information we hold, we will notify affected customers without unreasonable delay consistent with applicable law (including Texas Business & Commerce Code §521.053) and our contractual commitments, and will provide information reasonably needed for the customer’s own notification obligations.

The Service is a business tool for agencies and is not directed to children. We do not knowingly collect personal information from children under 13. Records an agency keeps about the individuals it serves are governed by Section 3.

We are a United States company and the Service is hosted in the United States. If you access the Service from elsewhere, you understand your information will be processed in the U.S.

We may update this policy. Material changes will be announced by email or in-product notice before they take effect. The current version will always be posted at pasqapi.com/privacy.