Privacy Policy

Raha Services, Inc. d/b/a RecallsSafe (“Company”, “we”, “us”, or “our”) operates the RecallsSafe mobile application (“App”). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our App.

By using RecallsSafe, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address and name when you create an account.
• Product Inventory: Products you add to your inventory, including barcodes, VINs, product names, categories, and any notes you enter.
• Notification Preferences: Your choices for which categories and severity levels of recalls trigger alerts.
• Healthcare Provider Information: If you use the provider portal, your provider type and any prescription watch lists you configure. We do not collect NPI numbers, patient data, or protected health information (PHI).
• Support Communications: Information you provide when contacting us for support.

1.2 Information Collected Automatically

• Device Information: Device model, operating system version, unique device identifiers (for push notification delivery only), and app version.
• Usage Data: Features used, screens viewed, search queries (anonymized), and interaction timestamps.
• Push Notification Tokens: Firebase Cloud Messaging tokens used solely to deliver recall alerts.
• Crash Reports: Anonymized crash data and error logs to improve app stability.

1.3 Information from Third-Party Services

• Firebase Authentication: Authentication tokens and session data (managed by Google Firebase).
• Barcode Scan Data: When you scan a barcode, the barcode value is sent to our servers for product lookup. Camera images are processed on-device and are not stored or transmitted.

1.4 SMS Opt-In Data

When you provide your phone number and consent to receive SMS recall alerts, we use that information solely to deliver safety notifications for products you have registered. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. You may opt out at any time by replying STOP to any SMS message or by updating your notification preferences in the app.

What we record when you consent. We record that you agreed to receive SMS messages from RecallsSafe: the date and time of your agreement, the version of the consent wording you agreed to, and technical details of the request — the platform you signed up from, the network address your request came from, the forwarding chain behind that address, and a truncated browser or device identifier. We store a one-way fingerprint of the consent wording rather than a second copy of the text, so the record of what you agreed to cannot later be edited. We keep this because a record that we displayed a message to someone is only useful if we can also show when, which version, and roughly from where. This information is kept only for as long as needed to demonstrate your consent to us, to your mobile carrier, or to a regulator, and is not used for any other purpose.

1.5 Information We Do NOT Collect

• We do not collect location data or GPS coordinates.
• We do not collect contacts, call logs, or SMS data beyond what you explicitly provide for recall alerts.
• We do not access your photo library (except when you explicitly choose to attach a product image).
• We do not collect financial or payment information directly — all payments are processed by Google Play or Apple.
• We do not collect biometric data.
• We do not collect NPI numbers, patient data, or PHI through the healthcare provider features.

2. How We Use Your Information

We use collected information for the following purposes:

• Recall Matching & Alerts: To match your product inventory against recall databases and send you relevant notifications.
• Service Delivery: To operate, maintain, and improve the App.
• Personalization: To customize your dashboard, recall categories, and notification preferences.
• Communication: To send service-related messages (account verification, security alerts, support responses).
• Analytics: To understand usage patterns and improve features (using aggregated, anonymized data).
• Safety & Security: To detect and prevent fraud, abuse, or security incidents.

We do not use your information for:

• Targeted advertising
• Selling to data brokers
• Building advertising profiles

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information only in the following limited circumstances:

3.1 Service Providers

We use trusted third-party services to operate the App:

These providers are bound by their own privacy policies and data processing agreements.

3.2 Legal Requirements

We may disclose information if required by law, subpoena, court order, or government request, or to protect the rights, safety, or property of our users or the public.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred. We will notify you before your data is subject to a different privacy policy.

3.4 With Your Consent

We may share information with third parties when you explicitly consent.

4. Data Storage & Security

• Encryption: Data is encrypted in transit (TLS 1.2+) and at rest.
• Access Controls: Only authorized personnel can access user data, and only for service operation purposes.
• Password Security: Passwords are hashed using industry-standard algorithms and are never stored in plain text.
• Infrastructure: Our backend runs on Render.com with managed PostgreSQL on Neon, both of which maintain SOC 2 compliance.
• Retention: We retain your data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law.

While we implement reasonable security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

5. Your Rights & Choices

5.1 Access & Portability

You can view all data associated with your account within the App's Profile section. You may request a copy of your data by contacting us.

5.2 Correction

You can update your account information and product inventory directly in the App.

5.3 Deletion

You can delete your account and all associated data through the App's Profile section or by contacting us. Deletion is processed within 30 days.

5.4 Notification Controls

You can customize which recall categories and severity levels trigger notifications, or disable push notifications entirely through the App's settings or your device settings.

5.5 Opt-Out of Analytics

You can request to opt out of anonymized analytics by contacting us.

6. Children's Privacy

RecallsSafe is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it promptly.

Users between 13 and 18 may use the App with parental or guardian consent.

7. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request the categories and specific pieces of personal information we have collected.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out of Sale: We do not sell personal information, so this right does not apply.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at privacy@recallssafe.com.

8. European Users (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, you have rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on (a) your consent, (b) the necessity to perform our contract with you, and (c) our legitimate interests in operating and improving the App.
• Rights: You have the right to access, rectify, erase, restrict processing, data portability, and object to processing.
• Data Transfers: Your data may be transferred to and stored in the United States. We rely on Standard Contractual Clauses for such transfers.
• Data Protection Officer: Contact us at privacy@recallssafe.com for GDPR-related inquiries.

9. Camera & Permissions

• Camera: Used exclusively for barcode and VIN scanning. Camera images are processed on-device using ML Kit and are never stored, uploaded, or shared.
• Internet: Required to fetch recall data and deliver push notifications.
• Notifications: Used to deliver recall alerts. Can be disabled at any time.
• Vibration: Used for haptic feedback during barcode scanning.

10. Optional Page Translation (Google Translate)

This website can show you a translation in a language other than English. This feature is off by default. Nothing is sent to Google until you choose to use it.

When you click Translate, we load Google's translation service (translate.google.com) into the page. From that point, Google receives the text of the pages you view on this site, along with your IP address and standard browser information such as your browser language. Google handles that information under Google's own privacy policy, not this policy.

We do not send Google your account information, your name, your email address, your household, or your recall alerts. What is sent is the text of the page you are already looking at, so that it can be translated.

Your choice is remembered in your own browser, in a setting named recallsnow_google_translate_consent. We do not store it on our servers. To withdraw it, choose English only in the translation prompt, or clear that browser setting.

Recall safety instructions are excluded from machine translation. Product names, batch and lot codes, barcodes, expiry dates, agency names, recall identifiers, and the hazard and remedy text on a recall are never sent for translation. Machine translation can still be inaccurate elsewhere on a page, so for any safety instruction, check the official recall notice published by the agency before acting.

The translation prompt does not appear on our Privacy Policy, Terms of Service, or account-deletion pages, and those pages are never machine translated.

10A. YouTube API Services

RecallsSafe publishes short recall-alert videos on its own YouTube channel, “RecallsSafe”. To do this, we use YouTube API Services (the YouTube Data API). By using our YouTube videos or anything on this site that links to them, you also agree to be bound by the YouTube Terms of Service.

We do not collect, access, store, or share any information about other YouTube users through YouTube API Services. The only YouTube account connected to RecallsSafe is our own channel. The channel owner authorised it with a single permission, the ability to upload videos (youtube.upload). That permission cannot read, change, or delete anything else in the account, and it does not give us access to anyone's viewing history, subscriptions, comments, or personal details.

What we keep from this connection: a credential (a refresh token) on servers we control, used only to upload our own videos, and the video identifiers of the videos we published. We do not sell this information, share it with advertisers, or use it to build profiles of people.

When you watch one of our videos on YouTube, YouTube and Google collect information about your viewing under the Google Privacy Policy, not under this policy. You can review or revoke access that any app has to your Google account at security.google.com/settings/security/permissions. If you believe we hold information obtained through YouTube API Services that relates to you, or you want any such information deleted, write to privacy@recallssafe.com and we will respond within 30 days.

11. Analytics

We measure how the site is used so we know which pages help people and which signup attempts succeed. This uses Plausible, a cookieless analytics service. No cookie banner is shown because there is no cookie to consent to. Plausible sets no cookies, builds no profile, and does no cross-site tracking, so there is no identifier stored in your browser that follows you to another site.

What the analytics provider receives is:

• the page you viewed, and the site that referred you to it;
• your country, derived from your IP address and then discarded rather than stored;
• your browser, operating system, device type and screen size, in aggregate;
• counts of specific actions, with no detail attached: starting a signup, completing a signup, completing a login, clicking a store badge, and completing a barcode lookup.

Two of those counts carry a small amount of extra detail so we can tell which plan and which billing period a click referred to, and which button on a page was clicked. That detail is limited to a plan name, a billing period, a page name and a button label. We never send your email address, name, phone number, password, or any barcode you type into the lookup box — the code that sends these events rejects any value that looks like an email address or a run of digits, and this is covered by an automated test.

Separately, if you arrive from a marketing link carrying utm_source, utm_medium or utm_campaign, we keep those three values in your own browser under the setting recallsnow_utm_first_touch. The first such link you arrive through is the one kept — a later visit does not overwrite it — and it expires after 30 days. If you then create an account, those three values are saved on your account so we can count how many signups each channel produced. They are not used to show you ads and they are not shared with the analytics provider.

How to opt out. Plausible honours your browser's Do Not Track and Global Privacy Control settings, so turning either on stops our analytics from being loaded. Blocking requests to plausible.io has the same effect. Every measurement on this site is optional: the site works identically with analytics blocked.

We do not send Google your account information, your name, your email address, your household, or your recall alerts. Analytics covers only how the pages are used, never what is in your household.

12. Third-Party Links

The App may contain links to government recall databases, manufacturer websites, or news articles. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App or via email. The “Last Updated” date at the top reflects the most recent revision. Continued use of the App after changes constitutes acceptance.

14. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify affected users within 72 hours of discovery, as required by applicable law, and will provide details about the breach and recommended actions.

15. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your data:

Raha Services, Inc. d/b/a RecallsSafe
Email: privacy@recallssafe.com
General: support@recallssafe.com
Website: https://recallssafe.com

For CCPA/CPRA requests: privacy@recallssafe.com
For GDPR requests: privacy@recallssafe.com