Privacy Policy
Draft for legal review. This page describes how Corr3ctive Action works today, but it isn’t final. Highlighted items need to be confirmed or filled in before launch.
1. Who we are
Corr3ctive Action is operated by [LEGAL ENTITY], based in Monroe, North Carolina (“we,” “us”). This policy explains what information we collect through this website and through the Corr3ctive Action service, and how we use it.
2. This website
When you book a walkthrough, we collect what you enter in the form: your name, work email, restaurant group, role, number of locations, region, the areas you want to improve and any message you include. If you request a walkthrough from the page linked on our business card, we collect your name, mobile phone number and/or email, and number of locations, and we may call, text or email you to arrange a time. We use this information only to respond to you and set up a walkthrough. We don’t sell it or share it for advertising.
Our website host keeps standard server logs (such as IP address, browser type and pages requested) to run and secure the site. [Confirm: no analytics or advertising cookies are used. If analytics are added, describe them here.]
3. The Corr3ctive Action service
Restaurant groups (“customers”) use Corr3ctive Action to document employee discipline. Inside the service, the customer decides what is recorded. We process that information on the customer’s behalf and only to provide the service.
| Information | Examples | Why |
|---|---|---|
| Account details | Name, email, role, assigned location | Sign-in, access control, naming who issued a document |
| Employee records | Employee name, job code, location, contact email for invites | Attaching incidents and warnings to the right person |
| Discipline records | Incidents, notes, corrective actions, witnesses, signatures with role, method and time | The documentation the service exists to create |
| Audit ledger | A record of who did what and when, linked by cryptographic hashes | Showing the record hasn’t been altered |
| Sign-in data | Passkey public keys, sign-in link requests | Passwordless sign-in. Face ID and fingerprints never leave your device. |
Employees whose records are kept in Corr3ctive Action should contact their employer about their records. The employer controls that information, and we’ll support the employer in responding.
Customers should record only what’s needed to document conduct and performance. Medical details and information about protected characteristics generally don’t belong in a disciplinary record.
4. Voice logging
When a manager uses Log by voice, the recording is sent to a transcription provider and the text is sent to an AI provider to suggest the form fields. The manager reviews and confirms before anything is saved. The audio is discarded after transcription and isn’t stored in Corr3ctive Action. The confirmed note becomes part of the record. [Confirm provider data-retention settings.]
5. Service providers
We use a small number of providers to run the service. They process information only on our instructions.
- Supabase: database, authentication and server functions
- Netlify: website and app hosting, and the walkthrough request form
- Deepgram: voice transcription [confirm]
- Anthropic: structuring voice transcripts into form fields [confirm]
- [Email delivery provider, if separate from Supabase]
We may disclose information if required by law, or to protect the rights and safety of our customers, their employees or us.
6. Security
Access is invite-only. Each person sees only the part of their organization their role covers, enforced in the database. Signed records are append-only, and the audit ledger is hash-chained so changes can be detected. Data is encrypted in transit. No system is perfectly secure, and we’ll notify affected customers of a breach as required by law.
7. Retention
Walkthrough requests are kept while we’re in discussion with you and for [period] after. Customer records are kept for the life of the customer’s account. When an account ends, the customer can export its records first. [Deletion timing after account closure, once the record-retention changes are final.]
8. Your choices
You can ask us to access, correct or delete the information you gave us through this website by emailing [contact email]. Depending on where you live, you may have additional rights under state law, and we’ll honor requests as those laws require.
Corr3ctive Action is a business service and isn’t directed to children.
9. Changes and contact
If we change this policy, we’ll update the effective date above and, for material changes, notify customers. Questions: [contact email], [mailing address].