Privacy Policy

Effective date: [Month Day, Year]  |  Last updated: November 8, 2026

This Privacy Policy explains how [Company Legal Name] (“SecureVisit,” “we,” “us,” or “our”) collects, uses, discloses, and protects information through SecureVisit, a communications platform used by approved family members, residents, facility personnel, and administrators. It also explains choices and rights that may be available to you. The facility’s own notices and rules may apply to information it controls and to communications made through the service.

1. Who this policy applies to

This policy applies to SecureVisit’s websites and applications, family portal, resident portal, staff console, and support interactions (together, the “Services”). It does not replace a correctional facility’s privacy notice, visitation rules, records policy, or other terms.

A facility may choose who can use the Services, what features are available, and how communications are handled. Depending on the contract and applicable law, the facility may determine the purposes and means of processing certain resident, visitor, and communication records. SecureVisit processes that information to provide the Services and as directed by the facility, subject to our agreement and law.

2. Information we collect

The information collected depends on the feature, facility configuration, and your role. It may include:

• Account and contact information, such as name, email address, phone number, login credentials, and account preferences.
• Identity and eligibility information, such as a government-issued ID photo uploaded with a connection request, resident details entered by the family member (for example name and booking number), facility approval status, and information used to verify an account or prevent misuse. Resident accounts use a booking number and PIN.
• Communications and visit information, such as messages and attachments, visit scheduling and status details (requested time, approval, start and end), participants, delivery status, and facility moderation or review records. [Confirm whether any call or video content is recorded or stored; do not publish a statement until verified]
• Payment and transaction information, such as balances, ledger entries, payment status, and amounts, where payments are enabled for a facility. [Confirm the processor and whether SecureVisit ever receives or stores card data]
• Technical and usage information, such as push notification tokens for devices where you enable notifications, authentication events, and audit records of staff actions. [Confirm whether IP address, browser or device type, log events, or crash diagnostics are collected and retained]
• Support and feedback information, such as messages you send to support and troubleshooting details.

We may receive information from you, a facility or its authorized personnel, other approved users, service providers, and the device or browser you use. Do not submit information that a facility has prohibited or that is not needed for the intended communication.

3. How we use information

We use information as needed to provide, secure, and support the Services. This can include:

• creating and managing accounts, authenticating users, confirming facility approval and permissions, and connecting approved participants;
• providing messaging, video visits, notifications, account support, and payment-related functions enabled by the facility;
• allowing authorized facility personnel to administer the Services and apply facility rules, including reviewing, moderating, restricting, or retaining communications where configured or required;
• processing transactions, maintaining records, resolving disputes, and detecting fraud, security incidents, or misuse;
• diagnosing technical issues, maintaining and improving the Services, and developing aggregated or de-identified operational insights where permitted;
• complying with legal obligations, enforcing agreements, and protecting the rights, safety, and security of users, facilities, SecureVisit, and others.

4. Facility access, monitoring, and records

Use of the Services may be subject to facility monitoring, review, recording, retention, or restrictions. The facility determines which controls apply to its environment. Depending on configuration and law, authorized facility personnel may be able to access account details, communications, visit details, and records generated through the Services, including ID photos submitted with connection requests.

Before using a feature, read the notice displayed by the facility or in the Service. SecureVisit does not decide whether a communication is legally privileged and cannot guarantee that a message or visit will be confidential. Contact the facility for questions about its monitoring, disclosure, or records practices.

5. How we disclose information

We may disclose information in these circumstances:

• To the facility and its authorized personnel, to provide and administer the Services, apply facility settings and rules, and support facility operations.
• To vendors that help us host, secure, maintain, support, or provide the Services. These currently include Supabase (database, authentication, and file storage), Vercel (hosting), Daily (video visits), Expo (mobile app delivery and push notifications), Stripe (payment processing, where payments are enabled), and Resend (email delivery of demo requests from our marketing website). Vendors may use information only as permitted by our instructions and agreements. [Legal to confirm the vendor list and agreements]
• At your direction or with your consent, such as when you choose to communicate with another approved user.
• For legal and safety reasons, when we believe disclosure is reasonably necessary to comply with law or legal process, respond to lawful requests, protect people, investigate suspected fraud or abuse, or protect our rights and Services.
• In a business transaction, such as a merger, financing, acquisition, or transfer of assets, subject to applicable confidentiality and legal requirements.
• As aggregated or de-identified information that is not reasonably used to identify you, where permitted by law.

[Confirm and state the company’s policy on selling personal information, sharing for cross-context behavioral advertising, and targeted advertising. Do not publish a statement until it matches actual practices and applicable law]

6. Payments

Where payments are enabled, they may be handled by a third-party processor, currently Stripe. The processor’s privacy notice and terms govern its collection and use of payment information. SecureVisit is designed so that card details are handled by the processor rather than by our servers, and we keep transaction records needed to show payment status and balances, reconcile payments, and address support requests. [Confirm that card data is handled only by the processor, add the processor’s privacy link, and confirm whether payments are enabled at launch]

7. Cookies, analytics, and similar technologies

This marketing website does not use analytics, advertising cookies, or third-party tracking scripts. Our portals and apps may use cookies, local storage, or similar technologies for authentication, security, and preferences. Your browser may let you block or delete cookies, but some features may not work properly. [List any analytics, session replay, advertising, or cookie-management tools actually used in the portals and apps, and add required opt-out controls]

8. Data retention and security

We keep information for the period needed to provide the Services, meet contractual and legal obligations, resolve disputes, enforce agreements, and protect the Services. Retention periods may differ by information type and facility configuration. A facility may instruct SecureVisit to retain or delete facility data under its contract and records schedule.

Family accounts can be deleted; see Delete your account. After a 30-day grace period the account is erased and anonymized, while messages, visit records, audit logs, and certain other facility records are retained. [Insert actual retention periods for account records, message content, visit records, logs, and payment records, including backup deletion timing]

We use administrative, technical, and organizational safeguards designed to protect information, including access controls and encrypted connections. No system can be guaranteed completely secure, and SecureVisit has not been independently certified or audited. If a security incident affects personal information, we will respond and provide notices as required by law and our agreements.

9. Your choices and privacy rights

Depending on where you live and the role in which you use the Services, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information, or to opt out of certain processing. You may also be able to change account details or close your account through the Services.

For information controlled by a facility, submit requests to that facility or follow the process it provides. We may refer your request to the facility or act on its instructions. We may need to verify your identity and may deny or limit a request where the law permits or requires. You may appeal a denied request by contacting [Privacy contact email: to be confirmed].

[Insert state-specific disclosures and rights mechanisms for every state where SecureVisit is subject to privacy-law obligations, and add any required “Do Not Sell or Share” or targeted-advertising opt-out controls]

10. Children and family accounts

The Services are designed for facility-approved communication, not for children to independently create accounts unless the facility and SecureVisit expressly enable that use. [Choose the minimum account age and whether minors may use the Services with a parent or guardian]

If SecureVisit has actual knowledge that it collects personal information online from a child under 13, or operates a service directed to children under 13, it will follow applicable children’s privacy requirements, including providing required notices and obtaining verifiable parental consent where required. A parent or guardian may contact [Privacy contact email: to be confirmed] with a request concerning a child’s information.

11. International users and transfers

The Services are intended for use in [United States / list service countries]. If information is processed or stored in another country, it may be subject to that country’s laws. [Confirm hosting regions and any international transfer safeguards before publication]

12. Changes to this policy

We may update this policy as the Services or legal requirements change. We will post the updated version with a new “Last updated” date and provide any additional notice required by law. If a change materially affects how information is handled, we will provide additional notice where required.

13. Contact us

Privacy questions or requests: [Privacy contact email: to be confirmed]  |  [Company Legal Name]  |  [Mailing address]  |  [Privacy request URL, if available]

For facility-controlled information, contact the facility using its published privacy or records-request process.