Privacy
Privacy Policy
Leopard Dispatch records where your officers are and what happened on a call. That is a lot of trust. This page says exactly what is stored, for how long, and who can see it — with no hedging about "certain information".
Contents
1Two kinds of data, two different roles
For everything your agency puts into the app — calls, officers, positions — your agency is in charge and we just hold it. If you are an officer and you want to know why your position is recorded or want it corrected, ask your agency, not us.
For the handful of things we collect as a company — the signup email, billing, website logs — we are in charge, and you can come straight to us.
In the language of data protection law:
- Agency Data. The Agency is the controller (or "business"). Leopard is the processor (or "service provider"). We act on the Agency's instructions and do not decide what goes in or what it is used for. Our Data Processing Addendum sets the terms.
- Our own records. Account contact details, billing records, support correspondence and website analytics. Here Leopard is the controller.
This split matters in practice. If you are a Member of an agency and you want your data corrected or explained, your agency holds the answer and the authority. We will help them, but we will not go around them.
2What the Service stores
This is the complete list of personal data the Service holds on an agency's behalf.
| Category | Fields |
|---|---|
| Member records | Name, callsign, badge or ID number, the roles they hold, whether they are active, and a sign-in identifier. Members added through the roster get a synthetic address of the form callsign@agency.dispatch.local, which is not a real mailbox and cannot receive mail. Agency founders sign up with a real email address. |
| Credentials | A one-way hash of the Member's password. We never store a password in a readable form and cannot recover one. Also a hash of any outstanding one-time setup code, with its expiry and whether it has been used. |
| Duty status | Whether a Member is available, busy or off duty, and the time that status last changed. |
| Position | A single current latitude and longitude, the time it was recorded, and whether it came from the mobile app, the browser, or a connected GPS receiver. See section 3. |
| Shifts | When a Member started and ended a shift, and a vehicle label if the agency uses one. |
| Calls | Time received, call type, location as typed and as a map position, cross street, free-text notes, status, and time closed. |
| Vehicles on a call | Licence plate and issuing region, colour, make, model and free-text notes. |
| People on a call | Their role on the call (for example reporting party), name, contact details and free-text notes. See section 4. |
| Assignments and history | Which Member was assigned to which call, when, their scene status, how it was cleared, and a timestamped event trail of who did what. |
| Operational configuration | Beats and which Members cover them, points of interest, temporary event areas, call types, dispositions and notification settings. |
| Notification devices | A push token or browser endpoint and its keys, the platform, and the browser user-agent string, so alerts can reach the device. |
| Sign-in attempts | The callsign or agency code tried, a coarse source identifier and the time — kept to rate-limit password guessing. |
The Service does not collect Social Security or government ID numbers, payment card numbers, biometrics, health information, or anything from a Member's device beyond what is listed above. It does not read a device's contacts, photos, microphone or camera.
3Location, in detail
The Service stores one current position per Member, and overwrites it. It does not keep a location history. There is no table of past positions, no breadcrumb trail, and no way — for the agency or for us — to replay where somebody drove last Tuesday.
In detail:
- Only while on duty. A position is recorded only when the Member's duty status is something other than off duty. When a Member goes off duty the stored position is erased, not merely hidden.
- Only with the permission. A Member reports a position only if their role holds the permission to do so. Dispatchers working at a desk do not report positions.
- It is overwritten, not accumulated. Each new fix replaces the previous one. At most one position per Member exists at any moment.
- Written at most every 30 seconds, to limit both data volume and battery use.
- Three possible sources, recorded alongside the position so the agency can tell how reliable it is: the mobile app, the browser's own geolocation, or a GPS receiver plugged into a vehicle tablet. A fix from the phone takes precedence over a desktop or tablet fix that is less than three minutes old.
- The console shows when GPS is active. The header displays a live indicator with the current accuracy whenever a connected receiver is supplying positions.
- Who can see it. Members of the same agency whose roles permit it. Never another agency — every query is scoped to the agency at the database level.
Calls also carry a location, but that is the location of the incident, not of a person.
3.1If you are an officer reading this
Your employer decided to use this system and your employer controls it. Several US states require an employer to give you written notice before tracking you, and California limits vehicle tracking to working hours and to what is strictly necessary for your job. Those obligations fall on your employer, not on us. We publish a plain-language notice setting out what is recorded so that agencies can give it to you and so that you can read it whether or not they do.
What we can tell you plainly: when your duty status is off duty, the Service holds no position for you at all.
4People recorded on calls
The Service lets an agency record details of people connected to a call — a reporting party, a complainant, a person spoken to — including a name, contact details and free-text notes. Those people are not users of the Service and have no relationship with us.
The agency decides what goes in those fields and is responsible for it, including whether it is lawful to record, whether a notice or a legal basis is needed, and how long it should be kept. The notes fields are free text: we cannot control what an agency types into them, which is exactly why an agency should train its dispatchers on what belongs there and what does not.
If you believe an agency has recorded information about you in Leopard Dispatch and you want it corrected or removed, contact that agency. If you cannot identify or reach them, write to us at contact@leopardmfg.com and we will try to put you in touch and will pass your request on.
5What we collect as a company
- Signup and account contact. The name and email address of the person who created the agency account, and the agency's name.
- Billing. Records of what was charged and paid. Card details are handled by our payment processor and are never stored on our systems.
- Support correspondence. Emails you send us and our replies.
- Server and security logs. Ordinary request logs generated by our hosting and database providers, which include IP addresses and timestamps, kept for a short period for security and debugging.
- The marketing website.
leopardmfg.comsets no advertising or tracking cookies and runs no third-party analytics.
6Why we are allowed to hold it
For Agency Data we process on the Agency's documented instructions under a contract with them. For our own records, we rely on performing our contract with the Agency (account and billing), on our legitimate interests in securing and improving the Service (logs, support), and on consent where consent is what applies.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law. We have not done so in the preceding twelve months.
7Who we share it with
We use a small number of service providers to run Leopard Dispatch. Each is bound to protect the data and to use it only to provide its service to us.
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database, authentication, realtime updates | All Agency Data, at rest and in transit |
| Hostinger | Static web hosting and outbound email | Website files; the contents of account emails we send |
| Payment processor | Subscription billing | Billing contact and payment details; no Agency Data |
| Map tile providers | Background map imagery | The map area being viewed, and the viewer's IP address |
| Routing provider | Driving directions between a unit and a call | The two map positions of a requested route |
| Address lookup provider | Turning a typed address into a map position | The address text searched for |
| Push notification services | Delivering alerts to phones and browsers | The device token and the alert content |
Named current providers are listed in the Data Processing Addendum, which is where we keep that list current and where agencies can subscribe to notice of changes.
Note that map, routing and address-lookup requests are made from the browser or app and therefore reveal the viewer's IP address to those providers. Map positions sent for routing and addresses typed into the search box leave our systems; Member names, callsigns, call notes and details of people on calls do not.
Beyond these providers we disclose personal data only where the law requires it, to protect the rights and safety of people or of the Service, or to a successor if the business is sold — in which case we will tell you first.
8How long it is kept
| Data | Kept for |
|---|---|
| A Member's current position | Until the next fix replaces it, or until they go off duty, whichever comes first |
| Calls and their history | As long as the agency keeps them. Agencies can configure automatic deletion of closed calls after a period they choose |
| Member records | For as long as the agency's account is open. Members are deactivated rather than deleted, so the record of who worked which call stays intact |
| One-time setup codes | 30 minutes, then they expire; the hash is discarded once used |
| Sign-in attempt records | A short rolling window, long enough to rate-limit guessing |
| Everything, after the account closes | 30 days for export, then deleted from live systems and allowed to age out of backups |
9How it is protected
- Separation between agencies is enforced by the database, not by the app. Every table carries the agency it belongs to and row-level security policies check it on every read and write, so a bug in the interface cannot show one agency another's calls.
- Passwords are stored only as one-way hashes. No administrator and nobody at Leopard can read, set or recover a Member's password. A reset issues a one-time code, valid for 30 minutes and once only, that lets the Member choose their own.
- Authority is enforced in the database too. Who may edit, assign or remove whom is decided by rank rules that run inside the database, so they apply to every route in, not just the screens that display them.
- Encryption in transit for all connections, and at rest by our database provider.
- Sign-in attempts are rate-limited to frustrate password guessing, and failure messages are written so they cannot be used to discover which callsigns exist.
No system is perfectly secure. If a breach affects personal data we hold, we will notify the affected agency without undue delay and give them what they need to meet their own notification obligations.
10Your rights
Depending on where you live, you may have the right to know what personal information is held about you, to get a copy, to have it corrected or deleted, to limit certain uses, and not to be discriminated against for exercising those rights. California residents have these rights under the CCPA as amended; residents of other US states with comprehensive privacy laws, and of jurisdictions outside the US, have comparable ones.
Where to send a request:
- About data inside an agency's account — including your position, your Member record, and anything on a call — go to that agency. They control it. If they ask us for help extracting or deleting it, we will help.
- About our own records — your signup email, billing, support emails — write to contact@leopardmfg.com. We will respond within the period the applicable law allows, normally 45 days, and will verify your identity before acting.
You may use an authorised agent. If we cannot verify a request we will say so rather than act on it.
11Children
Leopard Dispatch is a workplace tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. Agencies must not add Members under 16, and should consider carefully what applies where Members are minors under local law. If you believe a child's information has been entered into the Service, tell us and we will work with the agency to remove it.
12Where data is held
Agency Data is stored on infrastructure located in the United States. If you are outside the United States, using the Service means your information is transferred there, where privacy laws differ from those in your own country.
13Changes
We will update this page when the Service changes what it collects. Material changes are notified to account owners by email and in the Service at least 30 days ahead. The version and effective date at the top always reflect the current text.
14Contact
Questions, requests and complaints:
Leopard Manufacturing
contact@leopardmfg.com
If you are in the EU or UK and believe we have handled your data improperly, you may also complain to your local supervisory authority.