Privacy Policy

Hawkeye 247 Solutions Inc. ("Hawkeye," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and your choices. It applies to the Hawkeye website, mobile applications, and the services associated with the Hawkeye Global Intelligence and Operations Center (the "GIOC"), collectively the "Services."

1. Information We Collect

We collect the following categories of information:

Information you provide. When you create an account, request a briefing, complete a form, contact us, or enter into an engagement, you may provide personal information such as your name, email address, phone number, employer, role, emergency contacts, itinerary or travel details, and the substance of your inquiry. Institutional clients may provide information about authorized users and personnel covered under an engagement.

Location and device information. Our mobile applications and platform collect real-time location data, device identifiers, operating system, application version, and similar technical information necessary to deliver monitoring and response services. Location collection can be paused via in-app controls (including Incognito Mode) while keeping SOS access available, except where contractually required to be on.

Communications. When you use SOS, two-way messaging, photo or video transmission, or other communication features, we collect and process the content of those communications to coordinate response, document incidents, and maintain operational records.

Sensor and integration data. Our platform is sensor-agnostic. Through authorized integrations, we may receive data from GPS trackers, IoT devices, fleet systems, access control, cameras, and other sources configured under your engagement.

Automatically collected information. When you visit our website or use our applications, we automatically collect IP address, browser type, pages viewed, referring URLs, and similar log data, typically through cookies and analogous technologies.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Services, including GIOC monitoring, response coordination, and incident documentation.
• Communicate with you about engagements, alerts, briefings, and operational matters.
• Verify identity, authenticate users, and prevent fraud or unauthorized access.
• Comply with legal obligations, regulatory requirements, and lawful requests from authorities.
• Maintain incident records that may be required for insurance, audit, legal, or institutional follow-up.
• Improve and develop our Services, including platform reliability and analytical capabilities.
• Send transactional messages and, where permitted, operational updates or editorial communications you have opted in to receive.

3. Legal Basis for Processing

Where applicable law requires a legal basis (for example, the GDPR), we process personal information based on (a) your consent, (b) the necessity of processing to perform a contract with you or your organization, (c) compliance with legal obligations, or (d) our legitimate interests in operating, securing, and improving the Services.

4. How We Share Information

We do not sell user data. We may share information in the following circumstances:

• With your organization or authorized contacts. For institutional engagements, we share information with the organization, family office, or authorized representatives who retained Hawkeye on your behalf.
• With responders and authorities. During an active incident, we may share information with law enforcement, medical responders, security details, or other parties necessary to coordinate response.
• With service providers. We use vetted third-party providers for hosting, infrastructure, communications, security, analytics, and similar functions. These providers are bound by contractual confidentiality and security obligations.
• For legal reasons. We may disclose information if we believe in good faith that disclosure is required by law, subpoena, court order, or other legal process, or necessary to protect the rights, property, or safety of Hawkeye, our users, or others.
• In connection with a business transaction. If Hawkeye is involved in a merger, acquisition, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to applicable law.

5. Data Retention

We retain personal information for as long as necessary to provide the Services, satisfy our legal and contractual obligations, resolve disputes, enforce our agreements, and maintain operational records. Retention periods vary based on the type of information and the requirements of the relevant engagement. When information is no longer needed, we securely delete or anonymize it.

6. Security

Hawkeye implements administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. These include encryption in transit, access controls, and security monitoring. No security measures are perfect; you use the Services at your own risk and should take reasonable steps to protect your account credentials.

7. Your Choices

Depending on your jurisdiction, you may have rights to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information, subject to legal and operational retention requirements.
• Object to or restrict certain processing.
• Receive a copy of your information in a portable format.
• Withdraw consent, where processing is based on consent.

To exercise these rights, contact us at info@hawkeye247.com. We will respond within the timeframe required by applicable law. Note that some information must be retained to comply with legal obligations or to complete an active engagement.

8. Cookies and Tracking

Our website uses cookies and similar technologies to operate the site, remember preferences, and analyze usage. You can control cookies through your browser settings. Disabling cookies may affect the functionality of certain features.

9. Children's Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, contact us and we will take steps to delete it.

10. International Data Transfers

Hawkeye is based in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States and other jurisdictions where we or our service providers operate. By using the Services, you acknowledge that data protection laws in those jurisdictions may differ from those of your country.

11. California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, the right to opt out of the sale or sharing of personal information (Hawkeye does not sell personal information), and the right not to be discriminated against for exercising your rights. Contact us at info@hawkeye247.com to exercise these rights.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted at the same URL with a revised effective date. Material changes will be communicated through the Services or by other reasonable means.

13. Contact

For privacy questions, requests, or concerns, contact us at:

Hawkeye 247 Solutions Inc.Apex, North Carolinainfo@hawkeye247.com(919) 439-7110

A few specific items I'd flag for the attorney pass before this goes live:

1. The 911 disclaimer in §3 of the Terms is critical — this is the most important sentence in the whole document for a response-services business. An attorney may want to harden the language, add it to additional places, and confirm it satisfies any state-level requirements where you'll operate.
2. The §12 liability cap is set at the typical SaaS floor (greater of fees paid in 12 months or $100). For a response platform some clients will negotiate this up in their MSA — that's fine, just confirm the carve-out language ("separately from and in addition to" the MSA cap) reads the way your counsel wants.
3. FedRAMP / NIST / government claims — the marketing site says "FedRAMP-ready" and "NIST 800-53." These aren't in the legal docs, but if you market specific certifications, counsel may want representations and limitations addressed somewhere.
4. Children's privacy threshold — set to 13 (COPPA standard). If your platform realistically serves anyone under 18 (study abroad students, school groups), counsel may want to revise.
5. Jurisdiction — set to Wake County, NC because Apex is in Wake. Confirm that's where you want disputes heard.
6. California / state privacy laws — only CCPA is referenced explicitly. Counsel will likely add Virginia (VCDPA), Colorado, Connecticut, Utah, and possibly more depending on where your users are.

‍