Privacy Policy

Ready to Serve Technologies LLC

Effective Date: March 28, 2026

Last Updated: October 18, 2026

1. Introduction and Scope

Ready to Serve Technologies LLC ("Company," "we," "us," or "our") operates readytoserve.io (the "Platform"), a two-sided SaaS marketplace connecting first responder and military candidates with recruiting agencies.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website, use our mobile applications (including the RTS-OS mobile app), and interact with our services. It applies to all users, including candidates and recruiting agencies.

If you do not agree with this Privacy Policy, please do not use the Platform.

2. Definitions

"Candidate" means an individual user of the RTS-OS mobile app or Platform who is developing their qualifications for first responder or military positions.

"Agency" or "Recruiter" means an organization or individual using the Grow Your Force subscription product to search for and connect with candidates.

"Personal Information" means information that identifies, relates to, or could reasonably be linked with a particular individual or household.

"Sensitive Personal Information" means personal information that reveals race, color, religious creed, national origin, sex, sexual orientation, gender identity, genetic information, biometric information, health information, or criminal history.

"Baseball Card" means the candidate profile on the Platform. A new account's card is private until you publish it. After you publish, agencies may see the public fields you choose to show.

"Service Providers" means third parties that process data on our behalf under contractual obligations, including Stripe (payment processing), Supabase (backend services), Vercel (hosting), Resend (email), and Constant Contact (the Denton Fire Department recruiting list on /denton-fire).

3. Information We Collect

3.1 Candidate Information

When you create a candidate account by email, we collect:

Required: first name, last name, email, password, date of birth (must show you are 18 or older), career pathway, fitness level, at least one goal, and your agreement to the Terms and Privacy Policy.
Optional on that form: phone, city, state, military branch, certification labels you choose to list, and how you heard about us.

Google sign-in collects the Google account identifiers Google sends us, plus the same 18+ Terms/Privacy agreement.

The categories below are collected only if you later fill them in or use a feature that asks for them. We do not collect DD214s, polygraph results, background-check results, or salary at account creation.

Depending on the features you later use, we may collect:

Identity Information: Full name, email address, phone number, date of birth, and address you provide
Military Information: Service branch and, if you upload it later, discharge documentation
Employment History: Current and previous employers, job titles, employment dates, salary information (optional)
Education History: Schools attended, degrees earned, graduation dates
Fitness Data: Physical Fitness Test (PFT) scores, Candidate Physical Ability Test (CPAT) scores, and workout logs you enter
Credential Information: Certifications and training records you add
Photos: If you upload a profile photo, we store it and show it as you uploaded it. We do not run face detection on it.
Behavioral Data: Career pathway milestones, fitness goals, and other entries you make
Account Settings: Password hash (not stored in plain text), two-factor authentication preferences, notification preferences

3.2 Agency/Recruiter Information

When agencies subscribe to Grow Your Force or register on the Platform, we collect:

Organization Information: Legal organization name, physical address, phone number, website
Contact Information: Recruiter names, email addresses, phone numbers, job titles
Billing Information: Billing address, subscription tier (Starter, Professional, or Enterprise), billing cycle, payment method (processed by Stripe, not stored by us)
Account Activity: Login history, candidate searches, saved candidate lists, outreach messages, connection requests
Usage Data: Features accessed, dashboard activity, analytics viewed

3.3 Usage Data and Cookies

We automatically collect information about your interaction with the Platform:

Device Information: Device type, operating system, browser type and version, IP address, device identifiers
Usage Analytics: Pages visited, features accessed, time spent on features, click patterns, search queries, filter selections
Cookies: Session identifiers, authentication tokens, user preferences, language settings, analytics tracking (Google Analytics)
Log Data: Access logs, error logs, API request data with timestamps and user identifiers

3.4 Information Provided by Third Parties

We may receive information about you from:

Background Check Providers: Background check results and status
Civil Service Testing Agencies: Exam scores and results
Credential Verification Services: Confirmation of certifications and licenses
Agencies: When an agency uploads candidate information, personal history statements, or assessment results
Service Integrations: Connected fitness trackers, financial services (Phase 2)

3.5 Denton Fire Department Recruiting Page

The page at /denton-fire is a Denton Fire Department recruiting page hosted by Ready to Serve Technologies LLC. Ready to Serve is not the Denton Fire Department. Submitting the form does not create a City of Denton or department employment application, and it does not create a Ready to Serve Platform account.

When you submit that form, we collect:

First name
Last name
Email address
Phone number
Date of birth
State of residence
Your answer to "Where are you right now?"
Your age range, if you choose to give it
Fire certification status
EMS certification status
The recruiting link or ad you arrived from, if the link carries one

Our server also records the IP address and browser type (user agent) the form was sent from. We use them to block automated submissions and to troubleshoot failed signups.

The form includes a hidden field used to catch automated submissions. If that field is filled in, we discard the submission and do not send it to any destination described in this section.

If the submission is accepted, we use the information as follows:

Denton Fire Department Constant Contact list. When Constant Contact accepts the form, we send your name, email address, phone number, and certification statuses to the Denton Fire Department recruiting list in Constant Contact so the department can send recruiting updates. When the department's list is set up to receive them, we also send your state of residence, your answer to "Where are you right now?", and your age range. We collect the phone number as a second way for the department to reach you if email fails. This form does not consent to text messages.
Ready to Serve backup record. We also save everything listed above on our side, including the phone number, date of birth, IP address, and browser type, so a Constant Contact failure does not drop you.
One-time reading-list email. After a successful save, we try to send one transactional email from Ready to Serve at ready@simpli-fi-os.com with a reading list of public Ready to Serve pages. That email is from Ready to Serve, not from the department. If it does not send, the form was still received.

The form is received if the department list accepts it, or if we save it on our side after a list failure. The reading-list email is attempted after that save.

4. How We Use Your Information

4.1 Candidate Information Uses

We use candidate information to:

Operate and maintain the RTS-OS mobile app and Platform
Create and manage your Baseball Card profile (private until you publish it)
Calculate and display PFT/CPAT scores and fitness progression
Track credential status, expiration dates, and recertification reminders
Match you with recruiting agencies based on your qualifications, location, and career preferences
Facilitate communication between you and recruiting agencies
Provide candidate development content, career pathway guidance, and fitness programming
Process payment for premium features or career services
Send notifications, reminders, and communications related to your account
Monitor and enhance your experience with the Platform
Conduct data analytics and research to improve our services
Comply with legal obligations and respond to lawful requests
Prevent fraud and maintain security of the Platform
Marketing communications (with your consent)

4.2 Agency Information Uses

We use agency information to:

Provide access to the Grow Your Force recruiter dashboard
Process subscription payments and billing
Manage recruiter accounts and permissions
Enable candidate search, filtering, and connection features
Track recruiter outreach and hiring pipeline
Provide analytics and reporting on recruiter activity
Facilitate communication between recruiters and candidates
Monitor subscription usage and enforce service limits
Conduct data analytics to improve the Platform
Comply with legal obligations and respond to lawful requests
Prevent fraud and maintain security of the Platform

4.3 General Uses

For all users:

Improve and optimize the Platform, features, and user experience
Personalize content and recommendations
Conduct research, analytics, and measurement
Debug and troubleshoot technical issues
Monitor system performance and uptime
Enforce our Terms of Service and other agreements
Protect our rights, privacy, safety, or property
Respond to your requests and inquiries

5. Data Sharing and Disclosure

5.1 Candidate Information Shared with Agencies

A new candidate account's Baseball Card is private. Agencies do not see it until you publish it. After you publish, agencies may see the public fields you choose to show. That can include:

Public profile elements (name, photo, basic location)
PFT and CPAT scores
Credential status and expiration dates
Career milestones and training completion
Any information you elect to make visible on your profile

When an agency expresses interest in connecting with you, they may receive additional information you have shared, subject to your privacy settings.

5.2 Service Providers

We share information with service providers that process data on our behalf, under each provider's published terms:

Stripe: Payment processing (name, email, billing address, transaction history)
Supabase: Database and authentication services (all user data stored in encrypted form)
Vercel: Application hosting and CDN (application logs, analytics)
Resend: Email delivery (name, email address, email preferences)
Google Workspace: Our working mailbox, ready@simpli-fi-os.com (the messages you send us and your email address)
Constant Contact: Denton Fire Department recruiting list for /denton-fire signups (name, email address, phone number, and certification statuses; state of residence, the "Where are you right now?" answer, and age range when those fields are configured)
Google: Sign-in if you use Continue with Google, and Analytics
Cloudflare Turnstile: Bot protection on signup forms
Google Analytics: Website and app analytics (usage data, device information, anonymized identifiers)

All service providers are contractually obligated to use data only for providing the services requested and to maintain confidentiality and security of the information.

5.3 Legal Requirements and Lawful Process

We may disclose your information when required by law, legal process, or governmental request, such as:

Court orders, subpoenas, or warrants
Federal, state, or local law enforcement requests
Government agency investigations
Compliance with tax or regulatory obligations
Protection of law enforcement interests

We will attempt to provide notice before disclosing information unless prohibited by law.

5.4 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of Company assets, your information may be transferred as part of that transaction. You will be notified of any change in ownership or control of your information.

5.5 Aggregated and De-identified Data

We may share aggregated or de-identified data that cannot reasonably be used to identify you with third parties for research, marketing, analytics, and other purposes.

5.6 With Your Consent

We will share your information with third parties when you provide explicit consent, such as authorizing a service integration, connecting your account to a financial service provider, or requesting a specific action.

6. Data Security

6.1 Security Measures

We implement administrative, technical, and physical security controls to protect your information:

Encryption: Data is encrypted in transit using TLS/SSL protocols and at rest using AES-256 encryption in our database
Authentication: Passwords are hashed using industry-standard algorithms; we support multi-factor authentication
Access Controls: Role-based access control (RBAC) limits data access to authorized employees and service providers based on job function
Vendor Standards: We select service providers that we believe can protect the data they process for us

6.2 Limitations

While we implement security measures designed to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the confidentiality of your password.

6.3 Data Breach Notification

If we discover a breach of security that compromises the confidentiality or integrity of your personal information, we will notify affected individuals in accordance with applicable state and federal laws:

Texas: We will notify affected individuals without unreasonable delay and not later than the 60th day after we determine that a breach of sensitive personal information occurred, in accordance with Texas Business & Commerce Code § 521.053. If the breach involves at least 250 Texas residents, we will also notify the Texas Attorney General as soon as practicable and not later than the 30th day after that determination.
California: When California Civil Code § 1798.82 applies, we will notify affected California residents within 30 calendar days of discovery or notification of the breach, subject to delays permitted for law-enforcement needs or to determine the scope of the breach and restore the reasonable integrity of the data system. If a single breach requires notice to more than 500 California residents, we will electronically submit a sample copy of that notice to the California Attorney General within 15 calendar days of notifying affected consumers.
Other States: We will comply with the notification requirements of all other applicable state laws.

For all breaches involving candidate data, we will notify affected first responder agencies as appropriate. Notifications will describe the nature of the breach, the types of information affected, the measures being taken to prevent future breaches, and steps you can take to protect yourself.

7. Data Retention

7.1 Candidate Data Retention After Account Deletion

When a candidate account is deleted, we follow this retention schedule:

Baseball Card Profile: Deleted or de-identified within 30 days of account deletion
Fitness and Health Data: Deleted or de-identified within 30 days of account deletion
Messages and Communications: Deleted within 30 days of account deletion
Account Logs and Access Records: Retained for 1 year for security, fraud prevention, and audit purposes
Legal and Tax Records: Retained for 7 years if the candidate had a paid subscription, in compliance with tax and employment law requirements
Backup Data: We maintain backups for 30 days after deletion for disaster recovery purposes only
Anonymized Analytics: Retained indefinitely (cannot be linked to individual)
Legal Holds: If litigation or government investigation is pending, we retain data as required by law

7.2 Active Candidate Account

While your candidate account is active, we retain full data necessary to provide Platform services.

7.3 Agency Data

Active Subscription: We retain recruiter data while the subscription is active
Cancelled Subscription: We retain data for 90 days after cancellation for billing, audit, and dispute resolution
Business Records: Recruiter activity logs and hiring records may be retained longer for compliance and analytics purposes

7.4 Fitness and Credential Data

Fitness scores, workout logs, and credential records are tied to your candidate account. When your account is deleted, this data is deleted or de-identified within 30 days according to the schedule above. If an agency has saved this information in their own systems, those records are governed by the agency's retention policies.

7.5 Cookies and Tracking

Session cookies are deleted when you log out. Persistent cookies are retained for up to one year unless you clear them sooner. You can manage cookie preferences in your browser settings.

8. User Rights and Choices

8.1 Access and Portability

You have the right to request access to the personal information we hold about you. You may request a copy of your data in a portable format (such as CSV or JSON) suitable for transfer to another service. Submit requests to ready@simpli-fi-os.com.

8.2 Correction and Updates

You may update, correct, or amend your information at any time by logging into your account and editing your profile. If you need assistance, contact ready@simpli-fi-os.com.

8.3 Deletion

You have the right to request deletion of your account and associated information. Email ready@simpli-fi-os.com. There is not currently an in-product delete button. Upon a verified request, we will delete your account and de-identify your personal information within 30 days, subject to legal retention obligations. Some information may be retained in aggregated or anonymized form.

Texas Business and Commerce Code Chapter 541 (the Texas Data Privacy and Security Act) applies to some Texas businesses that are not small businesses under SBA size standards. We have not determined that status here. Independently of that determination, we do not sell sensitive personal data.

8.4 Opt-Out of Marketing Communications

We will not send you marketing communications unless you opt in. If you receive marketing emails from us and wish to unsubscribe, click the unsubscribe link in the email or adjust your notification preferences in your account settings. You may also contact ready@simpli-fi-os.com to opt out.

8.5 Cookie Preferences

Most browsers allow you to control cookies through settings. You can:

Delete cookies stored on your device
Block cookies from specific websites
Block third-party cookies
Block all cookies (note: this may affect Platform functionality)

If you disable cookies, you may not be able to use all features of the Platform.

8.6 Do Not Track

Some browsers include a "Do Not Track" feature. Currently, the Platform does not respond to Do Not Track signals. We encourage you to review your browser and privacy settings to understand your options.

8.7 Responding to Requests

We will respond to verified requests for access, deletion, correction, or portability within the timeframe required by applicable law (typically 30-45 days). We may ask you to verify your identity before processing your request.

9. California Privacy Rights

California's Consumer Privacy Act (CCPA/CPRA) applies to a "business" that meets the thresholds in California Civil Code § 1798.140(d). We do not assert that we currently meet those thresholds. If you are a California resident, you may still use the request methods below:

9.1 Right to Know

You have the right to request what personal information we have collected, the categories of sources, and our business purposes for collection. We will disclose:

All information we have collected about you in the past 12 months
The categories of information
The purposes for which we collected it
The categories of third parties with whom we share it

9.2 Right to Delete

You have the right to request that we delete personal information collected from you, except where exceptions apply (such as legal obligations, fraud prevention, or legitimate business interests).

9.3 Right to Opt-Out of Sale or Sharing

We do not sell your personal information. We do not share your information with third parties for cross-context behavioral advertising. If our practices change, we will provide notice and obtain consent where required.

9.4 Right to Correct

You have the right to request correction of inaccurate personal information we maintain about you.

9.5 Right to Limit Use and Disclosure

You may ask us to limit our use of your sensitive personal information to purposes necessary to perform services you request or as otherwise permitted by law. We honor this request whether or not the CPRA applies to us.

Sensitive personal information we may hold includes:

Fitness data and health information
Any other information that reveals health or medical conditions

You may submit a request to limit use of sensitive personal information by contacting ready@simpli-fi-os.com with "Limit Sensitive Data Use" in the subject line.

9.6 Right to Correct Inaccurate Information

You may ask us to correct inaccurate personal information we maintain about you, whether or not the CPRA applies to us. You may submit a correction request by contacting ready@simpli-fi-os.com with "Correct Personal Information" in the subject line. We will verify your identity and respond within 45 days.

9.7 Right to Non-Discrimination

We will not discriminate against you for making any of the requests in this section. We will not deny goods or services, charge different prices, or provide lower quality service based on your exercise of privacy rights.

9.8 How to Submit CCPA/CPRA Requests

To submit a California Consumer Privacy Act request, contact:

ready@simpli-fi-os.com

Include "CCPA Request" in the subject line and specify whether you are requesting to know, delete, opt-out, correct, or limit use. We will verify your identity and respond within 45 days.

You may also authorize an agent to submit requests on your behalf by providing valid power of attorney documentation.

10. Children's and Minors' Privacy

Ready to Serve Technologies recognizes that the Platform serves candidates of varying ages who are preparing for first responder and military careers. We distinguish between different age groups in our privacy practices:

10.1 Children under 13

The Platform is not directed to children under 13. Candidate accounts require the user to be 18 or older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we have collected information from a child under 13, contact ready@simpli-fi-os.com and we will delete it.

COPPA (15 U.S.C. §§ 6501–6502; 16 C.F.R. Part 312) applies to operators of child-directed services and to operators with actual knowledge they collect from a child under 13. This section describes our 18+ account rule. It is not a claim of “COPPA compliance.”

10.2 Minors Ages 13-17 (Future Parental Consent Path)

Ready to Serve Technologies recognizes that minors ages 13-17 may have legitimate interest in exploring first responder and military career pathways. At launch, candidate accounts are limited to users 18 and older. Accounts for minors ages 13-17 are not currently enabled.

If Ready to Serve later enables a minor pathway, we will require verifiable parental consent before collecting personal information from any user under 18. Parents or guardians must affirmatively consent to their child's use of the Platform and data collection. We use reasonable measures to verify parental consent, which may include:

Email confirmation from a verified parent/guardian email address
Parental acknowledgment of our Terms of Service and Privacy Policy
Phone or SMS verification

Data Minimization for Minors: If minor accounts are enabled in the future, we will limit data collection to what is necessary to provide the Platform services:

We do not collect sensitive personal information (health data, biometric data, criminal history assessments) from minors without express parental consent
We do not use minor users' data for targeted behavioral advertising
We limit fitness and health data collection to basic progress tracking (with parental consent)

Parental Access and Control Rights: Parents or guardians of minor users (under 18) have the right to:

Request access to all information we have collected from their child
Request correction or deletion of their child's information
Revoke consent and require deletion of their child's account and data
Opt out of non-essential data uses and marketing communications on behalf of their child

To exercise these rights, parents/guardians should contact ready@simpli-fi-os.com with proof of parental relationship and identification.

Account Deletion: When a minor user's account is deleted at parental request, we will delete or de-identify the minor's personal information within 30 days, consistent with our general data retention practices, except where retention is required by law.

10.3 Users 18 and Older

Users 18 and older are subject to the standard terms of this Privacy Policy and consent to all data collection and use practices described herein.

10A. Biometric Information

We do not run face detection on profile photos you upload, and the Platform does not collect fingerprints, voiceprints, or retina or iris scans. Profile photos are stored and shown as you upload them. Fitness entries you choose to make, such as practice test times, are described in Section 3 and are not biometric identifiers.

11. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, and services that are not operated by Ready to Serve Technologies LLC. This Privacy Policy applies only to information we collect through the Platform. We are not responsible for the privacy practices of third-party services.

When you leave our Platform and access third-party services, the privacy policies and terms of service of those services apply. We encourage you to review the privacy policies of any third-party services before providing your information.

Examples of third-party services that may be integrated include:

Payment processors (Stripe)
Fitness tracking applications
Financial services (Phase 2)
Civil service testing agencies
Background check providers

12. Data Subject Rights

We do not currently target users in the EEA or the United Kingdom. GDPR applicability is fact-specific, so we do not state that the Platform is or is not subject to the GDPR. We offer the following request methods to all users:

Right to Access: You may request access to your personal information
Right to Rectification: You may request correction of inaccurate information
Right to Erasure: You may request deletion of your information
Right to Restrict Processing: You may request that we limit how we use your information
Right to Data Portability: You may request your data in a portable format
Right to Object: You may object to processing for marketing or analytics purposes

To exercise these rights, contact ready@simpli-fi-os.com.

13. Policy Changes and Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

Posting the updated policy on the Platform
Updating the "Last Updated" date at the top of this policy
Sending a notice to your email address if the changes materially affect your rights

Continued use of the Platform after changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically to stay informed about how we protect your information.

13A. Agency listing claims and representative evidence

If you request access to review a public department or academy listing, Ready to Serve collects:

Your account identifier and verified email
The listing kind and slug you requested
Your certification, optional relationship disclosure, and the clickwrap version and time
Multi-factor authentication status needed to submit a request

This information is used only to review representative authority and to prevent unauthorized publication. It is not shown on public listing pages, maps, search, metadata, or analytics events. Authority documents stay private. Retention follows the operational need to investigate, approve, reject, or revoke a request, then the period required for security and legal records.

A listing request does not publish automatically. An independent Ready to Serve reviewer must act before any public field, badge, or version changes. Agency administrators cannot approve, publish, or issue a badge for their own request.

You may request correction or deletion of a pending claim request by emailing ready@simpli-fi-os.com. Revoked or rejected requests remain in the audit record.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact:

Ready to Serve Technologies LLC

Email: ready@simpli-fi-os.com

Website: readytoserve.io

We will respond to your inquiry within 15 business days.

15A. AI and Automated Decision-Making

15A.1 Disclosure of AI-Powered Features

Ready to Serve Technologies uses artificial intelligence and automated decision-making in certain Platform features:

Candidate Matching: We use algorithmic matching to recommend candidates to agencies based on:

Qualifications, credentials, and fitness scores
Career preferences and location
Historical hiring patterns and agency needs

Readiness Scoring: We may calculate automated "readiness" scores based on factors such as:

Completion of career pathway milestones
Credential status and currency
Fitness test performance
Assessment and exam scores

15A.2 Right to Human Review

You have the right to request human review of any automated decision that significantly affects your access to Platform features or opportunities. This includes:

Candidate matching decisions
Readiness scores
Account suspension or removal due to automated systems

To request human review, contact ready@simpli-fi-os.com with "Request Human Review" in the subject line and describe the decision you are challenging.

15A.3 No Fully Automated Legal Decisions

We do not make fully automated decisions with legal or similarly significant effects on your rights or opportunities without human review and oversight. Any decision that could materially affect your ability to access Platform opportunities will include or be subject to human oversight.

15A.4 Transparency in Automated Processing

We are committed to transparency regarding our use of AI and automated decision-making:

We disclose when AI-powered features are used in matching, scoring, or decision-making
You may request explanation of how automated decisions were made
You may request correction of inaccurate data used in automated decisions

15. Jurisdiction and Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict of law principles. By using the Platform, you consent to the jurisdiction of the Texas state courts for any disputes arising from this Privacy Policy or our privacy practices.

16. Entire Agreement

This Privacy Policy, together with our Terms of Service, constitutes the entire agreement between you and Ready to Serve Technologies LLC regarding the protection of your information. If any provision of this Privacy Policy is found to be unenforceable, the remaining provisions will remain in effect.