MissionDock Legal & Privacy

MissionDock Privacy Policy

Effective Date: October 24, 2026 · Last Updated: October 24, 2026

This Privacy Policy explains how MissionDock (https://missiondock.org), operated by Truth Scout Consulting (https://truthscoutai.com), collects, uses, stores, and protects information when authorized staff, administrators, and visitors use the MissionDock nonprofit operations platform and website.

1. Overview & Organization-Managed Access

MissionDock is a multi-tenant workplace operations platform built for nonprofit organizations to manage internal staff requests, room and vehicle reservations, fleet mileage logs, facilities maintenance, staff updates, and shared resources. Access to an organization workspace in MissionDock is managed by that organization’s designated administrators (invite-only and organization-authorized access; public self-signup is disabled).

2. Information We Collect

a. Account & Profile Information

When your organization administrator provisions or invites your account, or when you sign in to MissionDock, we store:

• Full name and work email address associated with your organization.
• Job title, department and program assignments, work location, and work phone number.
• Organization membership, assigned platform roles, and account approval status.

b. Google Sign-In (Google OAuth 2.0) Authentication Data

c. Workplace Operational Data

As you use MissionDock within your organization’s workspace, we store the operational records you create or update, including:

• Internal staff requests (supplies, building and equipment maintenance, IT support, and work orders).
• Room bookings, vehicle reservations, trip check-in/check-out records, and fleet mileage logs.
• Organization updates, announcements, calendar events, vendor directories, and shared resource links.
• Administrative review notes, status updates, and approval workflows.

d. Technical, Security & Session Data

To keep your organization’s workspace secure, we collect authentication session tokens, IP addresses, browser and device metadata, timestamps, and administrative audit logs required for session verification, rate limiting, and multi-tenant isolation.

e. Website & Newsletter Inquiries

If you sign up on https://missiondock.org to receive The Mission Docket or our Nonprofit Operations Checkup PDF, we collect the email address, name, and organization name you submit so we can deliver the requested resource and occasional MissionDock updates. You can unsubscribe at any time.

3. How We Use Information

We use the information we collect strictly to provide, secure, and support the MissionDock service:

• Authentication & Access Control: Verify user identity via email/password or Google Sign-In (through Supabase Authentication) and enforce organization-level role-based access control (RBAC) and database Row-Level Security (RLS).
• Core Workplace Operations: Route, schedule, and track internal requests, room bookings, vehicle reservations, and staff communications inside your organization’s workspace.
• Transactional Notifications: Send essential account emails (such as invitations, password resets, and operational status notifications) and opted-in product updates.
• Security, Auditing & Reliability: Prevent unauthorized access, enforce tenant isolation, troubleshoot technical issues, and maintain administrative audit logs.

4. Google API Services User Data Policy & Limited Use Compliance

MissionDock’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements:

• Google user data (openid, email, and profile) is used exclusively to authenticate authorized users into their MissionDock organization workspace.
• We never sell, license, or rent Google user data or any personal information to third parties.
• We never use Google user data for advertising, ad targeting, market profiling, creditworthiness evaluation, or training generalized artificial intelligence or machine learning models.
• Human review of Google user data is strictly prohibited except where you give explicit permission for a specific support request, where required for security/abuse investigation, or to comply with applicable law.

5. How We Share & Disclose Information

We do not sell personal information and we do not include third-party advertising trackers in MissionDock. Information is shared only in the following circumstances:

• Within Your Authorized Organization Workspace: Your profile details, requests, reservations, and operational entries are accessible to authorized members and administrators of your organization workspace in accordance with your organization’s role permissions.
• Essential Infrastructure Processors: We rely on trusted cloud infrastructure providers acting as data processors under strict security and confidentiality commitments:
  • Supabase: Managed PostgreSQL database, Row-Level Security enforcement, private file storage, and authentication services (including Google OAuth 2.0 callback verification).
  • Cloudflare: DNS, TLS encryption, edge security, and static web asset delivery.
  • Railway: Managed application hosting and runtime infrastructure.
• Legal & Safety Requirements: If required to comply with a valid legal obligation, subpoena, or court order, or to protect the security, rights, or safety of participating organizations and users.

6. Data Storage, Security & Multi-Tenant Isolation

• Encryption: All data transmitted between your browser and MissionDock is encrypted in transit via HTTPS/TLS (TLS 1.2+), and database and storage volumes are encrypted at rest.
• Multi-Tenant Database Isolation: Every organization workspace in MissionDock is logically isolated at the database layer using PostgreSQL Row-Level Security (RLS) policies scoped to the authenticated user’s organization identifier.
• Disabled Public Self-Signup: MissionDock enforces disable_signup: true for workspace authentication. Only users whose email addresses have been provisioned or invited by an organization administrator may sign in.

7. Data Retention, Export & Deletion

We retain account profiles and workplace operational records for the duration of your organization’s active MissionDock workspace agreement or as directed by your organization administrator.

How to Request Data Export or Deletion: You or your organization administrator may request access to, correction of, export of, or permanent deletion of your personal account data (including unlinking and deleting Google Sign-In authentication records) at any time by contacting your organization administrator or emailing us at info@missiondock.org or info@truthscoutai.com. Verified deletion requests are completed within 30 days. You may also revoke MissionDock’s Google Sign-In authorization at any time from your Google Account permissions page (myaccount.google.com/connections).

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory updates. When we make changes, we will update the “Last Updated” date at the top of this page at https://missiondock.org/privacy.

9. Contact Us

If you have questions about this Privacy Policy, Google Sign-In authentication, or our data practices, please contact us:

• Email: info@missiondock.org or info@truthscoutai.com
• Operator: Truth Scout Consulting (https://truthscoutai.com)
• Mailing Address: MissionDock · Truth Scout Consulting · 3550 N Glenstone Ave, Ste C, PMB 1030, Springfield, MO 65803