Privacy Policy

Who we are and what this covers

CaliberStatus is continuing-education and credential-compliance software for fire departments, emergency medical services and law enforcement agencies. It is operated by [ENTITY].

This policy explains how we handle personal information in the course of providing that service.

The most important thing to understand about this policy: our customer is the department, not the individual member. When a fire department uses CaliberStatus, the department decides what records are kept, who can see them, and how long they are retained. We hold and process those records on the department's instructions. If you are a member of a department using CaliberStatus and you have a question about your own records, your department is the right place to start.

1. Information we hold

1.1 Account information

For each person with an account: name, email address, role within the department, and the groups, stations or shifts they belong to.

1.2 Training and credential records

This is the substance of the service. For each member, the department may record:

• Continuing-education hours, by category, against the department's own requirements
• Courses assigned, started and completed, with completion dates
• Credentials and certifications: type, issuing authority, issue date, expiry date, and state or agency approval numbers
• Practical skill evaluations, including the evaluator's identity and sign-off
• Test and assessment results

1.3 Documents uploaded by the department

Standard operating procedures, policy documents, training manuals and similar material that a department uploads for distribution or to build training content from.

1.4 Technical information

IP address, browser and device type, and timestamps of actions taken in the system. Administrative actions are recorded in an audit log together with who performed them and when.

1.5 What we do not collect

We do not collect payment card details. Departments are invoiced and pay by check or bank transfer; no card data passes through or is stored by CaliberStatus.

We do not collect date of birth, home address, emergency medical information, disciplinary records, or any information about a member's family — unless a department chooses to enter it in a free-text field, which we would discourage.

2. How we use it

We use the information above to:

• Provide the service: track CE hours, flag expiring credentials, deliver assigned training, and produce the reports and transcripts a department needs
• Send notifications a department has configured, such as expiry alerts and compliance digests
• Respond to support requests
• Maintain security, investigate misuse, and keep the system running

We do not sell personal information. We do not use department data for advertising. We never make one department's records available to another. Training content moves between departments only when a department publishes it to an industry channel itself — see section 4.

3. AI processing of uploaded documents

CaliberStatus can build structured training content from a document a department uploads. Here is what happens to that document.

The file itself is not stored. An uploaded document is held in memory for the duration of the request and written to no disk or storage service.

The text is sent to a third-party AI provider. Text extracted from the document is transmitted to Anthropic's API for analysis and content generation. If narration audio is generated, chapter text is additionally sent to OpenAI for speech synthesis.

The extracted text is retained. Text extracted from multi-file uploads is stored in a processing cache, keyed by a hash of the document's contents. There is currently no expiry on that cache — retained text is kept indefinitely.

Derived files are retained. Images extracted from Word documents, and any generated narration audio, are stored in our file-storage provider and are not currently deleted.

Course content you confirm is stored permanently, by design — that is the training material itself.

4. Who can see what

Within a department. Access follows the role the department assigns. Administrators see the whole department. Instructors and training officers see only the members of the groups they are responsible for. Members see their own records.

Between departments — records are never shared. No other department can see your members, their CE hours, their credentials, their evaluations or their test results. There is no setting that changes this and no way to opt into it.

Training content is different, and only if you choose. A department that authors its own training can publish a course or topic to an industry channel — a shared space for agencies in the same discipline. Content published that way becomes visible to other departments in that channel. This is deliberate, it is per item, and nothing is published unless someone in your department publishes it.

Content you have not published stays in your department. A course marked Organization Only, or a topic marked Proprietary, is not visible outside your department regardless of any channel tags it carries. Learning packs are not shared independently at all — they reach another department only as part of a course that department has been given.

Us. Our staff access department data only when necessary to provide support, investigate a problem, or comply with a legal obligation.

Service providers. We use third parties for hosting, email delivery, file storage, and the AI processing described in section 3. They process data on our instructions and are not permitted to use it for their own purposes. If your department needs the current list of these providers by name for a security review, ask us and we will provide it.

Legal obligations. We may disclose information where required by law, and will tell the affected department unless legally prohibited from doing so.

5. Retention and deletion

The department controls retention. Public-safety agencies are frequently required by state law or agency policy to retain training records for a defined period — often several years. Because CaliberStatus may be a department's system of record for those obligations, we do not delete training or credential records on an individual's request.

If you are a member of a department: a request to correct or remove your records goes to your department, not to us. They own the records and are responsible for deciding what their retention obligations permit.

If a department's subscription ends: the department has ninety days to export its complete records. Export is available at any time as CSV without needing our involvement. After ninety days, we delete the department's data unless the department has asked in writing for a longer period.

Account information for a person who leaves a department is retained as part of that department's training record, because a record of who completed what training is not meaningful if the person's identity is removed from it.

6. Security

We protect information in transit with TLS, store passwords using a one-way hash (bcrypt), and enforce role-based access control with authenticated sessions. Administrative actions are recorded in an audit log.

No system is perfectly secure. Departments are responsible for managing who has accounts, what role each account holds, and for removing access when someone leaves.

In the event of a breach affecting a department's data, we will notify the department without undue delay and provide what we know, as required by applicable state law.

7. Where data is held

CaliberStatus is operated from the United States and is intended for use by United States agencies. Our hosting, email and file-storage providers are United States services.

If your department requires written confirmation of data residency for a security review, ask us and we will confirm our current configuration in writing.

8. Members who are minors

CaliberStatus is intended for use by employees and members of public-safety agencies and is not directed to children. Accounts are created by a department for its own personnel.

Where a department operates a cadet, explorer or junior program that includes participants under 18, the department is responsible for obtaining whatever consents its own policies and applicable law require before entering that participant's information into the system.

9. Your rights

Rights over the records in CaliberStatus belong primarily to the department that holds them.

If you are a department: you can access, correct, export or ask us to delete your organisation's data, subject to section 5 and to your own retention obligations.

If you are a member of a department: contact your department. If you believe your department cannot help, or you are raising a concern about CaliberStatus itself rather than about your records, write to us at the address below.

Some state privacy laws grant individual rights that apply regardless of the above. Where they do, we will honour them, working with the relevant department where the law permits.

10. Changes

If we change this policy in a way that materially affects how we handle department data, we will notify departments by email before the change takes effect and update the date at the top of this page.