Last updated October 1, 2026
Who we are and what this covers
Unified Alerts delivers alarm notifications from building management systems (BMS) to the people responsible for those buildings. This policy covers the Unified Alerts apps for iPhone and Android, and the service behind them that receives alarm emails and routes them to the app or on as email.
The service is operated by Western Allied Corporation (“we”, “us”), 12046 Florence Ave, Santa Fe Springs, CA 90670. Questions about this policy or your data: privacy@wasocal.com.
We built Unified Alerts to do one job, getting alarms to the right people. We collect only what that job needs, we show no ads, and we never sell your data.
What we collect
We collect the information you give us when you use the app, plus the alarms building systems send to your addresses.
| Data | What it is | Where it comes from |
|---|---|---|
| Account | Username, your name, and your password, which we store only as a salted hash and never in readable form | You, at sign-up and in Settings |
| Email addresses | Addresses you add to receive alarms, and whether each is verified | You, in Addresses. We email each one a 6-digit code to confirm it |
| Phone numbers | 10-digit numbers you add, so alarms texted to them arrive in the app instead | You, in Addresses |
| Delivery choices | For each address: on or off, and push, email or both. Whether to combine duplicate alarms | You, in the app |
| Alarms | The content of alarm emails sent to your addresses: the site, the equipment or point, its state and value, the time, the sender, and the message text | Building systems that send to your addresses |
| Your actions on alarms | When you acknowledge or resolve an alarm, your name, the time, and any note you add | You, in the app |
| Device | A push notification token, the device’s name or model (for example “iPhone” or “Pixel 9”), and whether it uses Apple or Google push | Your phone, when you sign in and allow notifications |
| Sign-in sessions | Session tokens that keep you signed in, and failed sign-in counts used to lock out password guessing | The app and our servers |
| Technical logs | Request records with IP address, time, the address requested and the response code; and records of each received alarm email and how it was routed | Our servers, automatically |
We don’t collect your location, contacts, photos or files. We don’t use analytics, advertising or tracking tools, and we don’t build a profile of you.
How we use it
We use your data only to run the service you signed up for:
- Route alarms. When a building system emails an alarm, we match each recipient address to the account that registered it. We then notify you on your phone, forward the email to you, or both, as you chose. An alarm sent to an address nobody has registered is passed on as ordinary email, unchanged.
- Send notifications to the devices you’re signed in on.
- Show you your alarms and their history in the app.
- Share your actions on an alarm with the other people who received the same alarm (see below).
- Run your account: sign-in, password reset, and confirming the email addresses you add, by sending you a code.
- Keep the service secure and working: blocking repeated wrong passwords, finding and fixing faults, and answering your support requests.
We don’t use your data for advertising or marketing, and we don’t sell or rent it to anyone.
Who we share it with
We share data only with the service providers that run Unified Alerts for us, and with the other people on an alarm. We never share it for their own marketing.
| Recipient | What they receive | Why |
|---|---|---|
| Amazon Web Services | Everything above | Hosts our servers, database and logs (United States, us-west-2 region) |
| Mailgun | Alarm emails we forward, and the codes and reset emails we send you | Delivers email |
| Apple (iPhone) or Google Firebase (Android) | Your device’s push token and the text of each notification: alarm title, site and summary | Delivers push notifications to your phone |
| Others who received the same alarm | Your name, and the time and any note when you acknowledge or resolve it | So everyone on an alarm sees that someone has it |
Others on the same alarm can include people at other organisations, when a building system sends one alarm to several companies. They see your name, not your email address or phone number.
We may also disclose data where the law requires it, or to protect the safety of people or the service.
How long we keep it
Alarms are deleted automatically after one year, and everything else is kept only while you have an account or for a short fixed period.
| Data | Kept for |
|---|---|
| Account, addresses, delivery choices, devices | Until you delete your account or remove them |
| Alarms in the app, and the record of how each alarm email was routed | 365 days from receipt, then deleted automatically |
| The original alarm email as received | 30 days |
| Server and request logs, including IP addresses | 30 days |
| Sign-in sessions | Up to 90 days, or until you sign out or change your password |
| Email confirmation and password reset codes | 15 minutes |
| Database backups | Up to 35 days |
When you delete your account, its data is removed from the live service at once. It disappears from backups and logs as those periods run out. Routing records of alarms you received age out with the alarm, within 365 days.
Your choices and rights
You can see, change and delete your data yourself in the app, at any time:
- Change your name or password in Settings.
- Add, remove or turn off addresses in Settings → Addresses, and choose push, email or both for each email address.
- Turn off notifications in your phone’s settings, or sign out. Signing out removes that phone from your account.
- Delete your account in Settings → Delete account. It deletes your account, every address on it, your devices and your alarm history. Alarms sent to those addresses stop reaching you, and email addresses go back to receiving them as ordinary email.
Depending on where you live, you may also have the right to ask for a copy of your data, to have it corrected or deleted, or to object to how we use it. Email privacy@wasocal.com. We’ll answer within 30 days, and you can also complain to your local data protection authority.
Security, children, and changes
Security. The app talks to our servers only over encrypted connections (HTTPS). Data is encrypted at rest in our hosting provider. Passwords are stored only as salted hashes. On your phone, the token that keeps you signed in is kept in the iPhone Keychain or encrypted with a key held in Android’s Keystore. Repeated wrong passwords lock the account temporarily. No system is perfectly secure; if we learn of a breach affecting your data, we’ll tell you as the law requires.
Children. Unified Alerts is a tool for building and facilities professionals. It isn’t directed at children under 16, and we don’t knowingly collect their data.
Where data is stored. Our servers are in the United States. If you use the service from elsewhere, your data is transferred to and processed in the United States.
Changes. If we change this policy, we’ll update the date at the top, and we’ll tell you in the app before any significant change takes effect.
Contact. Western Allied Corporation, 12046 Florence Ave, Santa Fe Springs, CA 90670, privacy@wasocal.com.