FY Force privacy notice
This notice explains how FY Network, Inc. (“FY Network”, “we”, “us”) handles personal information in FY Force, at https://fyforce.com. FY Force is a business service used by New Jersey DDD-licensed or DDD-approved provider organizations (“Customers”) and their staff.
1. Two roles
- For staff records and evidence a Customer uploads, the Customer decides what is collected and why. FY Network handles that information as the Customer’s service provider and processor, only to run the Service for that Customer.
- For account contact data, billing, and usage logs, FY Network decides how the information is used, as described below.
If you are a staff member of a Customer, your employer is responsible for your staff record. Questions or requests about it should go to your employer first.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account contact data | Name, work email, phone, organization name, role | The Customer’s administrators and users |
| Staff records and evidence | Staff names and contact details, job information, resumes, ID scans, CPR cards, certificates, training reports, credential dates | Uploaded or entered by the Customer |
| Billing data | Billing contact, plan, payment status | The Customer and Stripe. We do not receive or store card numbers. |
| Usage logs | Sign-in events, actions taken, access to evidence files, device and browser information | Generated when the Service is used |
| IP hash | A one-way hash of the IP address | Generated on requests, used for rate limiting |
FY Force is designed for workforce and employment records. Customers must not upload protected health information about individuals receiving services unless they have first signed a separate Business Associate Agreement with FY Network.
3. Why we use it
| Purpose | Information used |
|---|---|
| Provide the Service: staff records, readiness rules, renewal reminders, invitations | Staff records and evidence, account contact data |
| Sign users in and keep sessions | Account contact data, cookies |
| Keep the Service secure, prevent abuse, and investigate incidents | Usage logs, IP hash |
| Bill the Customer | Billing data |
| Support and service messages | Account contact data |
| Meet legal obligations | Any of the above, as required |
We do not sell personal information. We do not share it for advertising. We do not use advertising cookies. We do not use Customer data to train AI models, and the Service currently does not use AI on Customer data.
4. Sign-in and cookies
Users sign in with a one-time link sent by email. A link works once and expires after 15 minutes. After sign-in, a session cookie keeps the user signed in. These cookies are necessary for the Service to work. We use no advertising cookies.
5. Who we share it with
| Recipient | Why |
|---|---|
| Amazon Web Services, Inc. | Hosting, storage, backups, and email delivery through Amazon Simple Email Service |
| Stripe, Inc. | Payment processing |
| The Customer | Staff records and usage logs for its own organization |
| Authorities or others | When the law requires it, or to protect rights and safety |
| A successor | If FY Network is part of a merger or sale, subject to this notice |
AWS operates under a signed Business Associate Addendum with FY Network.
6. Where it is stored and how it is protected
Data is hosted on AWS in the us-east-2 (Ohio) region in the United States. It is encrypted at rest with dedicated encryption keys and in transit with TLS. Evidence files are versioned, backups are kept for 35 days, and access to evidence files is logged. Only people who need access to run the Service have it.
7. How long we keep it
| Information | Retention |
|---|---|
| Staff records, evidence, and account data | For the life of the Customer’s subscription. After cancellation, the Customer can export for 30 days; then the data is deleted from the live system and from backups as they expire, within 35 days. |
| Backups | 35 days |
| Usage logs and IP hashes | As long as needed for security and rate limiting, and deleted with the Customer’s data on the schedule above |
| Billing records | As long as tax and accounting law requires |
We keep data longer only where the law requires it or a legal hold applies.
8. Your choices and rights
Staff of a Customer. Requests to access, correct, delete, or export a staff record go to the employer that holds it. If you contact us, we will forward your request to that Customer and help it respond.
Customer administrators and users. You can update your account details in the Service, or write to us to access, correct, or delete your account information.
New Jersey residents. Where the New Jersey Data Privacy Act applies, New Jersey residents may have the right to confirm whether we process their personal data, to access it, correct it, delete it, obtain a portable copy, and opt out of sale, targeted advertising, and certain profiling. We do not sell personal data or use it for targeted advertising. Where we act as a Customer’s processor, we will help the Customer respond. You may appeal a decision on your request by writing to us with “Privacy appeal” in the subject line. If you are not satisfied with the appeal, you may contact the New Jersey Division of Consumer Affairs.
We will not discriminate against anyone for making a request. We may need to verify your identity before acting.
9. Children
FY Force is a business service and is not directed to children.
10. Changes
We will post changes to this notice in the Service and, for material changes, email account administrators at least 30 days before they take effect.
11. Contact
FY Network, Inc.
305 Lechner Circle, Annandale, NJ 08801
admin@fynetwork.com
(973) 649-9368