Privacy Policy

Holler is a workplace notification service operated by Brightstack Labs ("Brightstack Labs," "we," "us," or "Holler"). A worker can send an alert asking for help, and the people designated as responders are notified by push notification and email, and by text message on the paid Pro plan. This policy explains what data we collect, why, who we share it with, and the choices you have.

Questions or requests: privacy@hollerhq.com.

The categories below are the personal data the Service stores.

• Account email. Used as your login identity and to send sign-in confirmation and service messages.
• Password. Stored only as a salted hash by our authentication provider.
• Display name. Shown to others in your group so people know who fired, claimed, or commented on an alert.
• Phone number (optional). Collected so we can text you when an alert needs you. We store a number only if you tick the SMS consent box. Clearing the number removes it from your profile. Text alerts go to US mobile numbers on the Pro plan. Reply STOP to any text and we stop sending them. We then keep the number with texts turned off, so replying START can turn them back on. If you do not enter a phone number, the Service still works over push and email.
• Text message records. When you opt in to texts, we record when. If you text our number, we log the message, the number it came from, and what we did with it, as a record of your opt-out and opt-in choices.
• Terms acceptance. Which version of the Terms you agreed to at signup, and when.
• Invitations.When an admin invites someone, we store that person's email address and send the invitation, even if they never sign up.
• Group and role membership. Which groups you belong to, your roles (Admin, Support, Floor), your shift assignment, and your availability (whether you have marked yourself away). Used to route alerts to the right people.
• Alert content and custom fields. The alert type, priority, location, and any custom field values entered when an alert is fired, plus who fired it, who claimed it, and the cause code and resolution notes recorded when it is resolved. This is free text and is stored as you enter it.
• Comments. Free-text notes added to an alert, shown to everyone in the group and attributed to their author.
• Activity history. A record of status changes on each alert (fired, claimed, resolved, canceled) with timestamps and who acted, used for the history view and reports.
• Device push tokens. When you enable push notifications on a mobile device, we store the push token for that device so we can deliver alerts.
• Billing identifiers. If and when you buy a paid plan, our payment processor assigns identifiers we store to manage your subscription. We do not store full card numbers.
• Logs and error data. Our servers and providers keep operational logs (such as timestamps, request and delivery status, and error messages) used to run, secure, and debug the Service.

You can view and change your display name and phone number in Settings.

• To provide the Service: route alerts, deliver notifications, and track claims and resolutions.
• To authenticate you and keep your account secure.
• To provide reports and history to your group.
• To respond to support requests.
• To operate, maintain, debug, and improve the Service, including aggregated, de-identified statistics that do not identify you.
• To handle billing if you are on a paid plan.
• To meet legal obligations and enforce our Terms.

We do not sell your personal data, and we do not share it with third parties for their own advertising or marketing. We do not share your phone number or text opt-in with anyone for their marketing.

We do not track your activity across other websites or apps over time, and we do not let anyone else do it through Holler. Because we do not do that kind of tracking, we do not respond to browser Do Not Track signals.

We use a small set of service providers (sub-processors) to run the Service. Each one receives the data it uses for its job.

• Supabase. Hosts our database and handles authentication. Stores your account, profile, group, alert, comment, and device-token data, and the hashed password.
• Vercel. Hosts the Holler web app and serves it to your browser. Processes standard request and connection data.
• Resend.Sends our email notifications and invitations. Receives the recipient's email address and the message contents.
• SignalWire.Sends our text messages to US mobile numbers on the Pro plan. Receives the recipient's phone number, the text we send, and any reply.
• Expo. Delivers mobile push notifications. Receives the device push token and the message contents, and passes the message to Apple and Google for delivery.
• Apple Push Notification service and Google Firebase Cloud Messaging. The operating-system push services that deliver notifications to iPhones and Android phones.
• Cloudflare. Manages our domain (DNS) and routes inbound email sent to our addresses.
• Sentry. Receives crash and error reports from the Holler apps, such as the error message, app version, and device type. These reports can include fragments of other data.
• Stripe.Processes payments for the Pro plan. Receives your billing details and your card details, which you enter on Stripe's own checkout page. We never see or store your full card number. Stripe tells us which plan you are on and whether a payment succeeded.

These providers protect the data they receive at a level equal to this policy.

We may also disclose data if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets.

We take reasonable measures to protect your data:

• Data is encrypted in transit (TLS) and at rest on our managed database.
• Passwords are stored only as salted hashes by our authentication provider.
• Data is separated between groups by row-level security, which is designed to keep one group from seeing another group's data.

Your data is not end-to-end encrypted. Alert text, comments, and custom fields are stored as readable text so the Service can display, route, and email them. That means Holler staff and the service providers above can access this data as needed to run the Service. Do not enter anything into Holler that you would not want stored this way, and do not enter export-controlled data (see our Terms of Service). No method of transmission or storage is perfectly secure.

We are based in the United States and process your data there. Some providers may process it in other countries.

We keep your data for as long as your account is active, so your history and reports stay intact.

When you delete your account, we remove your login, your profile (name, email, and phone), your group memberships, your device notification tokens, and invitations sent to your email address.

Because Holler is a workplace tool, the alerts and comments created in a group are that workplace's operational records. They belong to the group, so we keep them after you go, with no set end date, even if no one else is left in the group. They are no longer linked to your account. Your name is removed from the records of who fired, claimed, resolved, or commented. Text that other people typed is left as it is, so if a coworker wrote your name into an alert or a comment, it stays there.

Deleted data may remain in backups for a limited time before it is overwritten.

Operational logs and crash reports held by the providers listed above are not edited when you delete your account, and are kept on each provider's own schedule. Records of texts you sent to our number, such as STOP, are kept with no set end date as a record of your opt-out choices. Our payment processor keeps its own billing records.

You can delete your account yourself in the app right away (see below), or ask us by email.

You can delete your account yourself, at any time, from within the app: go to Settings and choose Delete account. Deletion is immediate and permanent. If you are the only admin of a group that still has members, hand admin to someone else first. The steps, and what is kept or removed, are also on our account deletion page.

If you no longer have the app, email privacy@hollerhq.com from the address on your account, or support@hollerhq.com, and we will delete it as described above.

Holler is a workplace tool meant for adults. It is not directed to children, and we do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, contact privacy@hollerhq.com and we will delete it.

Whether or not the California Consumer Privacy Act, as amended by the CPRA, applies to a business our size, we give California residents these rights:

• Know what personal information we collect about you and how we use and share it.
• Access a copy of your personal information.
• Correct inaccurate personal information.
• Delete your personal information, subject to legal exceptions and to the group records we keep as described in this policy.
• Not be discriminated against for exercising these rights.

We do not sell or share your personal information as those terms are defined under California law, and we do not use sensitive personal information for purposes that would trigger a right to limit. To exercise any of these rights, email privacy@hollerhq.com. We will verify your request using your account email and respond as required by law. You may use an authorized agent where the law allows.

Holler is operated from the United States and is built for U.S. workplaces. We do not target the Service to the European Economic Area or the United Kingdom. If data protection law there applies to you, you may have rights to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. To make a request, contact privacy@hollerhq.com, and we will honor rights that apply to you. Where we process your data, we rely on performing our contract with you, your consent, and our legitimate interest in operating and securing the Service.

We may update this policy. We will post the new version here and change the "Last updated" date above. If a change is material, we will also tell you by email or in the Service.

Privacy requests: privacy@hollerhq.com

Everything else: support@hollerhq.com