Privacy Policy

Who we are

RDAP Pro (“Rapid Disaster Assessment Program,” “we,” “us”) provides an emergency-operations platform used by cities, counties, and relief organizations (“Organizations”) to coordinate disaster assessment and response. This policy explains what information the platform handles and how we protect it. For most information on the platform, the Organization that collected it is the data controller and we process it on their behalf.

Information we collect

• Account information — name, email address, phone number, and profile photo for staff and volunteer accounts.
• Incident and case information — damage-assessment reports may include street addresses, map coordinates, household contact details provided to responders, damage descriptions, photos, documents, and case-timeline notes.
• Public report submissions— when a resident files a report through an Organization’s public link, we collect what they enter, including optional contact details used to give them secure access to their case.
• Location information — field users may share device location to place reports on the map or navigate to assignments; location is captured when those features are used, not continuously tracked.
• Communications — messages, announcements, and notifications sent through the platform, plus device push-notification tokens.
• Usage and log data — sign-in events, actions taken on records, IP addresses, and device/browser information, kept in tamper-evident audit logs.

How we use information

To operate the platform: routing reports to responders, coordinating assignments, sending verification codes and notifications, powering the resident case portal, maintaining security and audit trails, providing support, and improving the service. We do not sell personal information, and we do not use customer data for advertising.

How information is shared

• Within and between Organizations — information is visible to authorized members of the Organization that collected it, and to other Organizations only when explicitly shared by an administrator (every cross-org share is logged and revocable).
• Residents — through the case portal, a verified resident sees only the information their Organization has marked public on their own case.
• Service providers — we use vetted sub-processors to run the platform: Vercel (hosting), Supabase (database, authentication, storage), Resend (email), Google Firebase (push notifications), and map/routing providers for map tiles and directions. Each processes data only to provide their service.
• Legal requirements — we may disclose information when required by law or to protect life and safety in an emergency.

Security

Data is encrypted in transit and at rest. Access is controlled with role-based permissions enforced at the database layer, multi-factor authentication is available for staff accounts, sensitive actions are recorded in append-only audit logs, and access codes are stored only as cryptographic hashes.

Retention

Account information is kept while an account is active. Incident records are retained according to the owning Organization’s policies and applicable public-records law. Audit logs are retained for six years by default. When information is deleted, it is removed from production systems and expires from backups on a rolling basis.

Your choices and rights

Depending on where you live, you may have rights to access, correct, or delete personal information. For information held by an Organization (for example, a report about your household), contact that Organization; we support them in fulfilling requests. For account information, contact us at support@rdap-pro.com. You can opt out of non-essential notifications in the app, and reply STOP to any text message to stop receiving texts.

SMS / text messaging

If you provide your mobile number and consent to receive text messages (for example, when filing a report, volunteering for an event, or as a contact on file for a case), we send only the operational messages described above — case updates, verification codes, and event notifications. Message frequency varies based on activity on your case or event. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help; you can also contact support@rdap-pro.com.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except with service providers acting on our behalf solely to deliver the messages (e.g., our SMS carrier), and only as necessary for that purpose.

Children

The platform is intended for adults. We do not knowingly collect personal information from children under 13; incident records may reference household members as reported by an adult.

Changes and contact

We will post any material changes to this policy on this page and update the effective date. Questions: support@rdap-pro.com or RDAP Pro, 45 E Highline Drive, Woodland Hills, UT 84653.