Compliance & Privacy

TapAlert is an operational safety alert system for warehouse and distribution centre environments. A hard-wired button press broadcasts an instant vibration alert — with zone and incident type — to all Samsung Galaxy Watch 7 wristbands on the floor. No worker identity, login, or enrollment is required at any point.

TapAlert covers four incident categories: equipment failure (conveyor jams, forklift breakdown), spill response (hazmat, liquids), medical assist (injury, fatigue), and security (unauthorized access). Each alert is logged with zone, timestamp, and resolution time — giving operations teams a full incident history exportable as CSV.

TapAlert acts as a technical safety aid helping employers meet their obligations under U.S. workplace-safety and accessibility law — OSHA's employee-alarm standard (29 CFR 1910.165), the emergency action plan rule (1910.38), and the ADA's reasonable-accommodation duty — ensuring every worker, including those who cannot see or hear a conventional alarm, can perceive and signal an operational emergency (equipment failure, spill, medical assist, or security breach) regardless of noise level, distance, or available communication equipment.

Because no personal data about individual workers is processed, TapAlert is not subject to worker-data obligations under privacy law (GDPR, CCPA/CPRA, or similar) for worker data. A data processing agreement for worker data is therefore not applicable.

Purpose limitation. TapAlert is a safety alert system only. It is not a time-and-attendance system, does not track worker location or movement, and performs no profiling or automated decision-making about individuals.

Legal basis for contact/demo form data. When a potential customer submits a demo request via tapalert.se, TapAlert (Techzola LLC) processes contact information for business communication purposes, and honors access, deletion, and opt-out requests under applicable U.S. privacy laws (e.g. the CCPA/CPRA).

Data processing location. For U.S. customers, TapAlert is deployed in a U.S. Google Cloud region — alert data and device management stay in the United States. Data residency is U.S.-first:

• Firebase Firestore & Cloud Functions: United States (Google Cloud, us-central1)
• Firebase Hosting: U.S. CDN nodes
• Samsung Knox Manage: U.S. data residency

The system stores no worker personal data — only anonymous device tokens and alert logs. Sensitive worker data never leaves the U.S. deployment; there is no cross-border transfer to manage.

Privacy by Design & Data Minimization. TapAlert is architected from the ground up to collect the minimum data necessary for the system to function. Specifically:

• Wristbands hold only an FCM device token — a random string with no link to any worker identity
• Alert logs record which zone triggered and which device tokens received the push — never which person was wearing a specific watch
• No names, employee IDs, biometrics, or locations are ever collected, stored, or transmitted

This architecture significantly reduces or eliminates the need for customers to conduct a Data Protection Impact Assessment (DPIA) for TapAlert, since no personal data about workers is involved. Customers' own Data Protection Officers (DPOs) can verify this directly from the sub-processor table and data inventory below.

Shelly Cloud and Samsung Knox receive no personal data — only device identifiers and operational commands. They are listed here for completeness of data flows.

Retention periods are configured in the system and enforced automatically. On contract termination, all customer-related data (alert logs, device enrollment) is deleted within 30 days.

Data portability & exit. Customers own their alert history and device configuration. Prior to contract termination, alert log data can be exported in JSON or CSV format on request. No vendor lock-in — the underlying hardware (Shelly buttons, Samsung watches) remains the customer's property throughout the agreement.

Data in transit. All communication uses HTTPS/TLS 1.2+. The Shelly → Firebase webhook uses a pre-shared secret for request authentication. FCM push delivery uses Google's encrypted transport.

Data at rest. Firestore data is encrypted at rest by Google (AES-256, Google-managed keys). No sensitive personal data is stored — the only stored data is alert timestamps and anonymous device IDs.

Device security — Samsung Knox. All Galaxy Watch 7 units are managed under Samsung Knox Manage, the same MDM platform used by government and military organisations. Knox provides:

• Centralised fleet management — no on-site IT required
• Remote device lock, wipe, and unenrollment
• App installation restricted to TapAlert-approved apps only
• OTA firmware and app updates, centrally controlled
• Device attestation and tamper detection

Firebase security rules. Firestore rules deny all direct client access. All reads and writes go through authenticated Cloud Functions only.

Alert button hardware. Shelly i4 Gen3 buttons run on hard-wired 12–24V DC power (no battery failure risk). Firmware is updated centrally via Shelly Cloud. No personal data passes through the button hardware.

Access control. The TapAlert admin interface (Firebase Console + Knox portal) is accessible only to authorised TapAlert personnel. Customer access to alert history is available on request via a read-only view.

Hardware certifications. All TapAlert hardware components are authorized for use in the United States under FCC Part 15 (and additionally carry international CE marking):

• Shelly i4 Gen3 — FCC Part 15 authorized (radio/EMC). Rated for continuous 12–24V DC operation. IP20. No interference with other industrial equipment.
• Samsung Galaxy Watch 7 — FCC authorized. Wi-Fi 802.11 a/b/g/n/ac, BT 5.3. SAR certified within FCC limits.

Declarations of conformity are available from the respective manufacturers (Allterco Robotics / Samsung Electronics) upon request.

TapAlert does not operate a persistent server. All backend logic runs as serverless Firebase Cloud Functions — there is no VM or container to maintain, patch, or restart. Google manages all infrastructure security, patching, and availability for the cloud components.

Scope of service — important limitation. TapAlert is a supplementary alert system and does not replace statutory safety installations (fire alarms, emergency lighting, evacuation systems) required under building codes or insurance conditions. Alert delivery depends on warehouse WiFi coverage. TapAlert's liability is limited to the service subscription value in accordance with the service agreement.

TapAlert is designed to help U.S. employers meet their safety and accessibility obligations for a workforce that includes employees who cannot perceive a conventional audible or visual alarm — including deaf, hard-of-hearing, blind, and DeafBlind staff.

TapAlert does not replace organizational safety measures (policies, training, staffing) or certified life-safety systems (fire alarms, exits, emergency lighting) required by OSHA, the ADA, NFPA 72, and local codes — it is a technical complement that enables a faster, perceivable response when an incident occurs.

Since TapAlert processes no personal data about warehouse workers, a Data Processing Agreement for worker data is not required or applicable.

For the demo/contact form data where TapAlert acts as data controller: data subjects may request access, rectification, or deletion by contacting us at the address below.

For enterprise deployments where a DPA covering system operation data (alert logs, device metrics) is required for compliance purposes, TapAlert can provide a DPA on request.

This document is reviewed and updated with each material change to the TapAlert system. Current version: 1.0 (2026-06-22).