Privacy Policy

1. Introduction

Sherlock Investigations ("we", "our", or "the App") is a multi-tenant platform used by licensed investigation offices to manage customers, investigators, cases, operations, and case evidence. This Privacy Policy explains how we collect, use, store, and share information when you use our mobile and web applications.

If you use the App because your employer or another organization ("the Office") invited you, the Office is the Data Controller of the data you create or that relates to you, and we operate as the Data Processor on the Office's behalf.

2. Information We Collect

2.1 Information you provide

• Account information: your full name, email address, role, and profile avatar when you accept an invitation to an Office.
• Authentication credentials: handled by Supabase Auth. We do not store your password in plain text.
• Case and investigation data: customer records, investigator records, cases, operations, diary entries, notes (including rich-text and Hebrew content), and any custom fields your Office configures.
• Evidence you capture or upload: photographs, videos, and audio recordings taken with your device camera or microphone, or selected from your device photo library.

2.2 Information collected automatically

• Location data: precise GPS coordinates, collected only while the App is in use and with your permission, when you tag evidence with a location or place yourself on the map.
• Device and diagnostic information: operating system, app version, device model, locale, and crash/error reports needed to diagnose problems.
• Usage events: basic logs of what you opened or edited, used for the audit-log features required by the Office.

2.3 We do not collect

• Banking, credit-card, social-security, passport, or government-ID numbers.
• Biometric identifiers.
• Health data.
• Information about your contacts, calendar, SMS, or call history.
• Advertising identifiers. We do not run ads and we do not track you for advertising.

3. How We Use Your Information

• Provide the Service: authenticate you, render your Office's cases and operations, save evidence, and deliver push notifications about assignments.
• Audit and compliance: maintain tamper-evident audit logs on behalf of the Office, as required for licensed-investigation record-keeping.
• Security and abuse prevention: detect unauthorized access, rate-limit suspicious activity, and investigate incidents.
• Product improvement: diagnose crashes and performance regressions.

We do not sell your data, and we do not use your data to train machine-learning models outside of the specific Office tenant that owns it.

4. Permissions the App Requests

You can revoke any permission at any time in your device settings. The App will still function, but the related feature will be disabled.

5. Sharing and Sub-processors

We share information only with the following parties, and only as needed. We do not share your data with advertisers, data brokers, or any third party beyond this list.

6. Data Storage and Security

All data is stored using Supabase infrastructure (PostgreSQL databases and encrypted file storage) hosted in EU-Central (Frankfurt) data centers. We use industry-standard encryption for data in transit (TLS 1.2+) and at rest.

• Evidence files are stored in an access-controlled Supabase Storage bucket segmented by Office.
• Row-level security isolates each Office's data at the database layer.
• Credentials (Supabase keys, API keys, service-account files) are stored in EAS Secrets or Vercel Environment Variables, never in source code.

No system is perfectly secure. Report suspected vulnerabilities to security@sherlock-investigate.com.

7. Data Retention

• Account data: retained while your Office account is active; deleted within 30 days after Office deletion or upon written request to the Office administrator.
• Case and evidence data: retained per the Office's retention policy (set by the Office, not by us).
• Audit logs: retained at least as long as required by applicable law for licensed-investigation record-keeping.
• Backups: rolling 30-day backups of the production database.

8. Your Rights

Depending on where you live (EEA, UK, Israel, California, and others), you may have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to certain processing. To exercise these rights, contact your Office administrator first. If the Office does not resolve your request, email privacy@sherlock-investigate.com.

9. Children

The App is not directed to children under 16 and we do not knowingly collect data from children. If you believe a child has provided personal information, contact us and we will delete it.

10. International Transfers

Supabase and our other sub-processors operate in the United States, the European Union, and other regions. By using the App you consent to your data being processed in those regions.

11. Changes to This Policy

We will post updates here and change the "Last updated" date at the top. Material changes will also be announced inside the App.

12. Contact

For privacy-related inquiries, contact us at: privacy@sherlock-investigate.com