Privacy Policy

1. Information We Collect & Purpose

EquipCert AI collects the following categories of personal information for the stated purposes:

• Account information (name, email, organization, role) — to provide access, manage accounts, and assign roles.
• Inspection data (equipment photos, checklist responses, GPS coordinates, digital signatures, device information) — to conduct inspections, generate compliance reports, and meet OSHA record-keeping requirements.
• Usage data (login times, feature usage, browser/device type) — to improve platform performance and user experience.
• Payment information (processed by Stripe; we do not store card numbers) — to manage subscriptions and billing.

2. How We Use Your Information

We use your data to: provide and operate the inspection platform, generate OSHA-compliant safety reports, send notifications about scheduled inspections and corrective actions, process subscription payments, analyze usage to improve features, and comply with legal obligations including OSHA record-keeping requirements (29 CFR 1904.33).

3. Data Sharing & Third Parties

We do NOT sell or share your personal information for cross-context behavioral advertising. We share data only with the following categories of third parties for the stated purposes:

• Your organization's members (managers, admins) — to enable team-based inspections and oversight.
• AI analysis providers (Google, OpenAI, or Anthropic — equipment photos only) — to identify equipment type.
• Payment processor (Stripe) — to process subscription payments.
• Hosting & infrastructure (Vercel, Supabase) — to host and operate the platform.
• Content management (Contentful) — to serve equipment checklists.
• Regulatory authorities (OSHA) — inspection records may be shared during regulatory audits or investigations as required by law.

4. Data Retention

• Inspection records (checklist data, photos, signatures, GPS) — retained for a minimum of 5 years per OSHA requirements (29 CFR 1904.33), even after account closure.
• Account data (name, email, password hash) — retained while active; deleted within 30 days of account closure.
• Usage data — retained for 12 months, then anonymized.
• Payment records — retained per Stripe's policies and applicable tax law.

5. Your Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.):

• Right to Know — Request what personal information we collect, use, disclose, and sell.
• Right to Delete — Request deletion of personal information (subject to OSHA retention requirements).
• Right to Opt-Out of Sale/Sharing — We do not sell your data. If this changes, we will provide an opt-out mechanism.
• Right to Non-Discrimination — We will not discriminate against you for exercising your rights.
• Right to Correct — Request correction of inaccurate personal information.

We honor Global Privacy Control (GPC) signals. When detected, we automatically limit data processing to essential-only. To exercise any right, email [email protected]. We will respond within 45 days.

6. OSHA Regulatory Disclosure

Inspection records created in EquipCert AI may be accessed by OSHA inspectors during regulatory audits or investigations. These records are retained for 5+ years per 29 CFR 1904.33. Data subjects include technicians who perform inspections, managers who review them, and any personnel identified in inspection reports. This data sharing is required by law and cannot be opted out of.

7. Security

We implement industry-standard security: encryption in transit (TLS 1.2+) and at rest, row-level security isolating organization data, audit logging of all access, signed inspection records that cannot be modified (ESIGN compliance), Content Security Policy headers, HSTS enforcement, and regular security reviews.

8. Contact

For privacy inquiries, data requests, or to exercise your CCPA rights:
Email: [email protected]
Response time: within 45 calendar days.