AlarmMessage Privacy Policy

Effective date: September 28, 2026

Scope

This policy explains how SCADAReach AlarmMessage handles information when authorized operators use the iPhone or Android app with a configured SCADAReach industrial monitoring service, including related voice-call and SMS alarm notifications and interactions with the SCADAReach AI phone assistant when available.

Information We Process

• Account information: the email address used to create, verify, and authenticate an AlarmMessage account and the internal account identifier assigned to it.
• Device information: an app-specific device identifier and an Apple Push Notification service or Firebase Cloud Messaging token used to register an authorized phone for alarm delivery.
• Service-access information: the monitoring sites an organization has approved for the account.
• Operational information: alarms received from approved monitoring sites and acknowledgment records, including which authorized account acknowledged an alarm and when.
• Voice and SMS information: telephone numbers used for alarm notifications, notification content, and related call and message delivery records, such as timestamps and delivery status.
• AI phone conversations: spoken input processed for speech recognition, the resulting text, AI-generated responses, conversation context, and call identifiers used to manage the interaction.

How We Use Information

We use this information only to authenticate users, authorize access to assigned monitoring sites, display operational alarms, deliver push notifications, automated voice calls, and SMS text messages, record acknowledgments, provide password-reset and account-management functions, protect the service, provide technical support, and process questions and conversation context to generate and speak AI responses when you use the AI phone assistant.

Push Notifications

AlarmMessage uses Apple Push Notification service (APNs) on iPhone and Firebase Cloud Messaging (FCM) on Android to deliver alarms to authorized devices. The app requests notification permission only after sign-in. Notification previews include equipment and alarm details and may appear on the lock screen according to your device settings. Do not include confidential or sensitive personal information in alarm messages. You can change notification-preview settings on your device.

Signing out on iPhone disables push registration locally and attempts to remove the service registration and revoke that login. If connectivity prevents completion, the app reports pending cleanup and keeps the minimum credentials and registration identifiers in device-only secure storage so cleanup can be retried. You can sign in to another account and use its alarms in the meantime, but push notifications stay paused on that iPhone until the service confirms the previous registration was removed. Signing in again to the original account completes that cleanup. If the original account can’t be accessed, SCADAReach Support can remove its registration; push resumes after AlarmMessage confirms it is gone. Cleanup credentials are removed when the operation succeeds. Server removal cannot be guaranteed while the device is offline.

Voice Calls and SMS Text Messages

SCADAReach uses Twilio to deliver automated voice calls and SMS text messages for operational alarm notifications. Telephone numbers, alarm notification content, and related call and message delivery records are processed as needed to deliver these alerts and support service operation. SCADAReach does not enable audio call recording for these features. AI phone conversations use speech-to-text processing as described below.

For assistance with voice or SMS notifications, including requests to update your telephone number or stop receiving alerts, contact your organization’s SCADAReach administrator or email support@scadareach.com.

AI Phone Conversations and Speech Processing

When you speak with the SCADAReach AI phone assistant, Twilio and its speech-recognition providers process your spoken input and convert it to text. SCADAReach sends that text and relevant conversation context to OpenAI to generate a response. Twilio converts the response to speech and plays it during the call.

Speech-to-text processing is transcription, even though SCADAReach does not enable audio call recording. The AI application keeps recent conversation text and responses in temporary server memory to maintain context and handle repeated requests. Call metadata and service-provider request or diagnostic logs may also contain information about the interaction. This policy does not promise that all conversation data is deleted immediately when a call ends.

Twilio and OpenAI may retain data as described in their applicable service terms, data-protection policies, and account settings. See Twilio's Privacy Notice and OpenAI's API data controls. Do not provide passwords, API keys, or other sensitive information to the AI assistant. You can end the call at any time or contact support@scadareach.com for assistance without using the AI phone assistant.

Service Providers and Sharing

AlarmMessage uses Amazon Web Services for authentication, data storage, and service operation, Apple Push Notification service for iPhone notification delivery, Firebase Cloud Messaging for Android notification delivery, Twilio for voice-call and SMS delivery and speech processing, and OpenAI for generating AI phone-assistant responses. We do not sell personal information, use it for advertising, or share it with data brokers. Information is processed by service providers as needed to operate AlarmMessage or disclosed when required by law. Service-provider processing supports the service; it does not authorize those providers to use SMS consent for their own marketing or promotional purposes.

SMS Consent and Mobile Information

We do not sell or share mobile telephone numbers or other mobile information with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent records are not sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. Service providers, including AWS and Twilio, process the information needed to host and operate messaging on our behalf as described above.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

Web enrollment requests: The SCADAReach Alarm Alerts enrollment page records an enrollment request when you submit the form, with SMS either selected or declined. We store your operator name, mobile number, requested site reference, selected or declined SMS preference, server timestamp, exact consent wording and version, and a request reference. We also process request metadata and a daily hashed network address to limit abuse. Website hosting may process ordinary request metadata. The form sends no text or call and does not automatically activate alerts or authorize access to a site.

SCADAReach uses these records to review requests, verify phone ownership and site authorization before activation, demonstrate consent, and manage support or withdrawal. SMS is optional and separate from account creation or service access. Pending requests expire after 90 days and are then scheduled for deletion; removal may take additional processing time. Short-lived abuse counters expire after two days. Active-program consent and opt-out records may be retained as needed to honor your choices and applicable obligations. For access, correction, deletion, or withdrawal requests, contact support@scadareach.com and include your request reference.

When SMS consent is collected verbally, consent records may include the telephone number, date and time, the person obtaining consent, the disclosures provided, and the recipient's response. Manual consent records are separate from the speech-to-text processing used during AI phone conversations.

See our SMS Terms and Conditions for program details, message frequency, charges, and assistance.

Retention and Account Deletion

A signed-in user can open the Settings tab and select Delete Account. Completed deletion removes the user’s AlarmMessage identity, device registrations, and site-subscription records. Organizational alarm events and their acknowledgement times remain, but the deleted account’s personal acknowledgement attribution is removed. A minimal account-deletion security marker remains to prevent stale requests from recreating access or notification registrations; it is not used to identify who acknowledged an alarm. On iPhone, interrupted deletion is shown as unfinished and can be resumed with Finish Account Deletion. A user who cannot access the app can submit a request through the account-deletion page.

Security

AlarmMessage uses encrypted network connections, verified email accounts, authenticated API requests, and account-based authorization. No method of storage or transmission can be guaranteed to be completely secure.

Children

AlarmMessage is an industrial operations app and is not directed to children.

Changes to This Policy

We may update this policy as the service changes. The effective date above identifies the latest revision.

Contact

For privacy questions or assistance, email support@scadareach.com or visit the AlarmMessage Support page.