Your records are yours. Here is exactly what that means.

The questions that actually matter

Not a summary of our legal documents. The Privacy Policy and Terms are the binding versions. This is the plain-language one.

Who owns your rescue's data?

You do. Your organization decides what to collect and why; we hold it on your behalf and act on your instructions. In the language of privacy law, your rescue is the controller and RescueSphere is the processor.

We do not sell your data. We do not share it with advertisers or data brokers. We do not mine it to build a product we sell to someone else. Ending your subscription does not change who owns the records — it only changes whether you are paying us to host them.

How do exports work?

From Settings, any administrator can export the organization's full record set as JSON, at any time, without asking us. Animals and finance records additionally export as CSV from their own screens, for the common case of handing a spreadsheet to a board member or an accountant.

There is no export fee, no support ticket, no waiting period, and no reduced export for organizations on the way out. A product that is only easy to leave when you are not leaving is not portable, and the ability to walk away with everything is most of what makes the rest of this page meaningful.

How do backups work?

Your database is backed up automatically and continuously, encrypted with a key we control, and retained for 30 days. That covers the failure people usually mean by "do you have backups" — a database problem on our side.

Uploaded files are a narrower story, and it is worth being precise rather than letting the sentence above cover both. Photos and documents are stored encrypted on Amazon S3 and replicated across facilities, so hardware failure will not lose them. But we do not currently keep point-in-time file history, which means that if someone on your team deletes a photo, we cannot bring it back. That is a real limitation, we are working on it, and you should know about it now rather than on the day it matters.

After you cancel, we keep your data for 30 days so you can come back or pull a final export, then remove it from active systems. Encrypted backups age out on their normal rolling schedule after that.

Do you train AI on our records?

No. Your data is not used to train AI models — not by us, and not by our AI provider.

Dispatch, the assistant built into RescueSphere, runs on Anthropic's Claude models. When you ask Dispatch to summarize a medical note or draft a reply, the content of that request is sent to Anthropic to answer it, and nothing beyond that request goes with it. Anthropic does not train its models on data submitted through its API.

Anthropic is not the only AI provider, and listing only the flattering half of that would defeat the point of this page. The Studio video tools use OpenAI for voiceover and for transcribing audio, or ElevenLabs for voiceover if you pick it in Settings. Those tools are opt-in and gated: if your plan does not include Studio, or you never open it, nothing of yours reaches either company. Both are in the sub-processor table below, on the same footing as everyone else.

Every AI feature also has a non-AI fallback, and the fallback is real rather than a degraded error state — triage falls back to heuristics, bios fall back to templates. RescueSphere runs with AI switched off entirely, which means you are never obliged to send anything to a model to keep working.

Can other rescues see our data?

No. Nothing is shared between organizations, and there is no setting that turns it on.

This is enforced by how the system is built rather than by policy: every organization gets its own separate database, and a request is bound to one organization before it reaches any code that could read a record. Isolation you have to remember to apply eventually fails; this kind does not depend on anyone remembering.

What can RescueSphere staff see?

Here is the honest answer, because a vague one would be worth nothing. A small number of our engineers can reach production systems, which is unavoidable for anyone who has to keep a database running. Beyond that, our support tooling can open a session as a user in your organization — the mechanism that lets someone help you with a problem they cannot otherwise see.

What makes that acceptable rather than alarming is that it is not silent. Every use is written to a central audit log under its own category, so it is a recorded event rather than an invisible one. Inside your own organization, access follows the roles you assign, and your activity log shows who changed what.