This policy explains what personal information Contact Innovations Group LLC ("Contact-IQ", "we", "us") collects when you use Standby, our website at contact-iq.com, and our mobile app, and what we do with it.

The short version: Standby is designed to run on queue figures, not on the conversations your contact center handles. The permissions it's given in your AWS account don't allow it to read recordings, transcripts, chat content, caller phone numbers or contact records, and it doesn't store them. It stores those figures and what your team sets up — names, contact details, rotas and alerts — to reach the right person. Anything your team types into Standby, including names for queues or rules, is stored too, so please keep caller details out of it.

Where your information lives

• In your own AWS account: your Amazon Connect instance and everything in it, the original queue metrics, the records of the voice calls Standby places through your instance, and AWS CloudTrail's record of what Standby did there. You control all of it, and it never leaves your account except as the queue figures described below.
• In Standby: your team's accounts, rotations and settings, copies of queue figures, alert rules, incidents and their history, the actions people take and their results, notification records and the audit trail.
• With our service providers: sign-in and hosting (AWS), payments (Stripe), and delivery of phone notifications (Apple and Google), as listed below.

Two roles, depending on whose data it is

For data in a customer's workspace — the people on their rotas, their alert rules, incidents and audit trail — the customer (usually an employer) decides what goes in and why. We process it on their behalf, as their service provider or processor. If you're a member of a workspace and have a question about your data in it, your organization is the first place to ask; we'll help them answer.

For data about our own customers' accounts — who signed up, billing contacts, support conversations, and visits to our website — we decide how it's used, and this policy covers that directly.

What we collect

About people in a workspace

• Name, work email address and role (member or admin).
• A mobile phone number, if the workspace uses voice paging, so Standby can call you when you're on call.
• Time zone and quiet hours, so you aren't called when you've said not to be.
• Your place on on-call rotations, time off and shift cover.
• For the mobile app: an identifier for your phone, a notification token so we can send it alerts, and a public key used to confirm that actions are approved on your enrolled phone. The matching private key never leaves your phone.
• Sign-in credentials, held by our identity provider (Amazon Cognito). We never see your password. If your organization uses single sign-on, we receive the details your identity provider shares.

About a customer's contact center

• Queue names and identifiers, and counts for each queue: how many contacts are waiting, the longest wait, and how many agents are available or busy. These are totals for a queue, not figures about individual agents; on a queue with very few agents a total can still reveal someone's status.
• The alert rules, rotations, incidents and actions the customer configures and takes, including each incident's history: who was notified or called, who acknowledged it, and what was changed and undone.
• What people type in: names of rules, rotations and people, and short reasons, such as why a rule was turned on early.
• An audit trail of actions in the product, recording who did what and when, including the IP address and device used.

What Standby is designed not to collect: call recordings, transcripts, chat content, caller phone numbers, contact IDs or any other information about the contacts your contact center handles. Standby's permissions in your AWS account don't allow it to read them. Voice pages are placed through the customer's own Amazon Connect instance, so the records of those calls stay in the customer's account. The exception is anything a person types into Standby or names in Amazon Connect — a queue named after a client, for example — which Standby stores like any other text.

About customers and website visitors

• Billing contact details and subscription history. Card payments are handled by our payment processor; we never see or store full card numbers.
• What you send us when you email us or contact support.
• Our website sets no cookies and runs no analytics or advertising trackers. Its fonts are served from our own site, so a visit sends nothing to anyone else.
• The Standby web console sets no cookies either. It keeps your workspace code, theme and time zone in your browser's storage so you don't have to re-enter them, and keeps your sign-in in memory only. Stripe's checkout pages, and your organization's sign-in pages if it uses single sign-on, are run by those companies and may set their own cookies.

How we use it

• To run Standby: to work out who is on call, send notifications and place calls, apply and undo actions, and keep the audit trail.
• To keep it secure, prevent misuse and investigate problems.
• To support customers, bill them and tell them about changes to the service.

We don't sell personal information, share it for advertising, or use it to train AI models.

Notifications

Notifications to phones pass through Google's (Firebase Cloud Messaging, for Android) and Apple's (Apple Push Notification service, for iPhone) delivery networks, which run worldwide. By default a notification carries only an event identifier and a fixed sentence such as "Something needs your attention" — no queue names, rule names, figures or other workspace details — and the app fetches the details over an authenticated, encrypted connection when you open it.

A workspace admin can choose to include queue and rule names and figures in notifications; that setting is off unless they turn it on. If they do, those details pass through Apple's or Google's networks and may show on a phone's lock screen.

Who we share it with

Only with the service providers that help us run Standby, under contracts that limit what they can do with it. The current list, and how we tell customers before it changes, is on our subprocessors page:

We may also disclose information when the law requires it, to protect the rights and safety of our customers or others, or as part of a merger or sale of the business, in which case this policy continues to apply to it.

When Contact-IQ support looks at a workspace to help a customer, it's in a support session the customer can see, with a stated reason and a countdown, which the customer can end at any time. Support sessions are read-only and can't reach the customer's AWS account.

Separately, a small number of Contact-IQ engineers administer the systems Standby runs on. That access is needed to operate, secure and recover the service; it's limited to those people and recorded in our own AWS CloudTrail. We use it to keep Standby running, not to browse customers' data.

Where it's stored

Standby is offered to organizations in the United States. Its application and data are hosted by AWS in the United States, currently in the US East (N. Virginia) region (us-east-1); we may use other US AWS regions for recovery and continuity. Our other providers process information where their services run, as listed above — Apple's and Google's notification networks are worldwide.

How long we keep it

• Workspace data: while the workspace is in use. A workspace — its people's sign-in accounts, phones and notification tokens, rotations, rules, incidents and settings — is deleted 30 days after it is no longer paid for and its Standby stack has been removed: after the subscription ends, or, if there never was one, after the stack is removed. Removing the stack during a subscription only disconnects it, and a workspace whose subscription has ended keeps its data, paused, while the stack is still installed. The 30 days give a customer a window to return without losing their setup, and to download their data first.
• Audit trail: 90 days on the Team plan, and 400 days on Business and Enterprise unless a longer period is agreed in writing. It's a security record, so it isn't deleted early when a workspace closes; it expires on that schedule, subject to legal holds.
• Someone removed from a workspace: their account is deleted. Someone disabled keeps their record, so rotas and the audit trail still make sense, but can no longer sign in.
• Recovery copies: our database keeps a rolling 35-day history so it can be restored after a fault, so deleted data can remain there for up to 35 days.
• Operational logs, which record requests and errors by account and device identifiers rather than names or email addresses: 30 days.
• Support conversations: for as long as we need them to support you and to keep a record for accountability and security. They can contain workspace information if you include it, so please share only what's needed; you can ask us to delete them.
• Billing records: as long as tax and accounting law requires.

We may keep particular records longer where the law requires it, or to resolve a dispute or investigate a security incident.

Before a workspace is deleted, its admins can download its data from the console. Copies an admin has downloaded are theirs to look after. If you're a member of a workspace, requests about your data in it are best made to your organization, which controls it.

Security

Data is encrypted in transit and at rest. Standby holds no long-lived credentials to customers' AWS accounts: it uses temporary, narrowly scoped AWS credentials, and its actions there are recorded in the customer's own AWS CloudTrail under Standby's role. Each session is named with Standby's request ID and carries the requesting person's Standby user ID — on every CloudTrail event, for stacks on version 1.4.3 or later, and on the event that starts the session for older ones. Standby's own audit trail names the person who asked for each action, so the two can be matched. The security page has the details.

Your rights

Depending on where you live and which privacy laws apply, you may have rights to access, correct, delete or obtain a copy of your personal information. We respect these requests and respond in accordance with applicable law.

• Data in a workspace: the organization that runs the workspace generally controls that information, so we'll pass your request to them and help them respond.
• Anything else: email us. We'll confirm who you are before acting, usually by replying to the address we hold.
• Someone acting for you can make a request on your behalf, with your written permission.
• If we can't do what you ask — some records, such as the audit trail and billing records, have to be kept — we'll tell you why.

We won't treat you differently for asking.

Children

Standby is a workplace tool for people 18 and older, using it for their organization's work.

Changes

If we change this policy in a way that matters, we'll tell workspace admins by email before the change takes effect, and update the date at the top.

Contact

Privacy questions: usprivacy@contact-iq.com
Contact Innovations Group LLC, 6545 Market Ave. North, Suite 100, North Canton, OH 44721, USA