Privacy Policy

Version 2026-09-14 · in effect from 2026-09-15

This policy explains what personal data we collect, why, on what legal basis, how long we keep it, and what you can do about it. It covers the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the CPRA, and the US state privacy laws modelled on it.

Controller and contact

Controller: [CONTROLLER LEGAL NAME]
Address: [CONTROLLER REGISTERED ADDRESS]
Privacy contact: [PRIVACY CONTACT EMAIL]
EU representative: [EU ARTICLE 27 REPRESENTATIVE, IF THE CONTROLLER IS NOT ESTABLISHED IN THE EU]
Data Protection Officer: No Data Protection Officer is appointed. Article 37 requires one only where processing is by a public authority, or where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category data. None applies here. This is recorded as a reasoned position rather than left unstated.

Who is responsible for your data

The controller is the organisation named at the top of this policy. Where you use this product through your employer, your employer is the controller of the inspection records their technicians create, and we act as their processor for that data. We remain the controller of your account and of the operation of the service itself.

That split matters in practice: a request about an inspection record usually has to be answered by the organisation that created it, and we will route it to them rather than acting unilaterally on their records.

What we collect, why, and on what legal basis

Every category below states the GDPR Article 6 basis relied on. "Legitimate interests" is only claimed where a balancing test was actually done, and the interest is named so you can object to it under Article 21.

Data	Why	Legal basis (GDPR Art. 6)
Account data — name, email address, organisation, role, qualifications	To give you access, to place you in your organisation, and to name the qualified person on an inspection record as safety rules require	Art. 6(1)(b) — performance of a contract
Inspection data — equipment photographs, checklist answers, GPS coordinates, digital signature, timestamps	To produce the inspection record, which is the product	Art. 6(1)(b), and Art. 6(1)(c) where a legal record-keeping duty applies
Photographs sent for AI analysis	To pre-fill the checklist with a suggested equipment type, serial number and condition	Art. 6(1)(b) — the technician confirms or corrects every suggestion before signing
Authentication and security data — sign-in events, refresh tokens, IP address on privacy requests	To keep accounts secure, to rate-limit abuse, and to be able to investigate a suspected compromise	Art. 6(1)(f) — our legitimate interest in the security of the service and of your data
Payment data	To manage a subscription. Card numbers are handled by the payment processor and never reach our systems	Art. 6(1)(b)
Cookie and local storage preferences	To remember a theme choice and whether an intro animation has played	Consent — Art. 6(1)(a), and consent under the ePrivacy Directive for the storage itself

We do not use analytics, advertising or third-party tracking, so there is no such category to disclose. If that ever changes, this policy changes first and consent is asked for before anything is set.
We do not knowingly collect data from children. The product is used by qualified technicians at work.

Automated analysis of photographs

When a technician photographs a piece of equipment, that photograph is sent to a third-party vision model, which returns suggestions: a likely equipment type, a possible serial number, an apparent condition. The technician then works through the checklist item by item and signs.

The signature is the operative act. The record that is stored, and that an inspector or insurer relies on, is the technician's checklist — not the model's output. The technician is the inspector of record and is named as such; the AI is never named as the inspector.

This is not automated decision-making within the meaning of Article 22. Nothing is decided by the model; a qualified human decides, having seen and been able to change every suggestion.

Where any part of a record was AI-assisted, that fact is disclosed to the technician before they sign, and the record itself stores which provider and model produced the suggestion. This satisfies Article 50(1) of the EU AI Act. Our classification memo, including the obligation we have not yet met, is published at docs/compliance/ai-act-classification.md.

Where your data goes

The primary database and file storage are hosted in the European Union (Frankfurt). Inspection records rest there.

The vision model providers are established in the United States, so a photograph submitted for analysis is transferred there. That transfer relies on the European Commission's Standard Contractual Clauses, and where the provider is certified, on the EU-US Data Privacy Framework. The transfer is limited to the photograph submitted for analysis; it is not where the record lives.

You may ask us for a copy of the transfer safeguards in place.

How long we keep it

Retention is set by the shortest period that lets us do the job and meet a legal duty, not by the longest we could argue for.

Data	Kept for	Why
Fire extinguisher inspection and maintenance records	One year after the last entry, or the life of the shell, whichever is shorter	29 CFR 1910.157(e)(3). Where NFPA 10 or a local fire code sets a longer period for a particular record, the longer period applies.
Inspection records your organisation asks us to keep longer	As instructed by that organisation	They are the controller of their own records and may have insurance or contractual reasons of their own
Account data	While the account is active, then deleted within 30 days of closure	No longer needed once the contract ends
Sign-in and security events	12 months	Long enough to investigate a compromise, short enough not to become a second dataset worth stealing
Consent records	For as long as the consent is relied on, plus the limitation period afterwards	Art. 7(1) requires us to be able to demonstrate consent was given, which is impossible if the record is deleted with it
Audit log entries	For the life of your organisation’s account; your account reference is removed on erasure	Accountability for changes to safety records (Art. 5(2)) outlives any one member of the organisation, but it does not need to keep identifying them
Data subject request records	Two years from completion	To show a request was received, verified and answered within the deadline
Payment records	As required by tax law in the relevant jurisdiction	A statutory duty we cannot shorten

A correction worth stating plainly: an earlier version of this policy said inspection records were kept for five years under 29 CFR 1904.33. That citation was wrong. 1904.33 governs retention of OSHA injury and illness logs, which is a different record with a different purpose. Fire extinguisher records are governed by 1910.157(e)(3), and the period is one year, not five. Keeping personal data five times longer than the law requires is not caution; it is unlawful under the storage limitation principle in Article 5(1)(e).

Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). Where processing rests on consent you may withdraw it at any time (Art. 7(3)), and withdrawal is as easy as giving it — the control is in Settings and in the cookie banner.

Under the CCPA as amended you have the right to know, to delete, to correct, to opt out of sale or sharing, to limit use of sensitive personal information, and not to be discriminated against for exercising any of them. We do not sell or share, and we do not use sensitive personal information for purposes that trigger the limitation right, but an opt-out request is still recorded and honoured.

Use the request form linked below. You do not need an account and you will not be charged. We answer within one month under the GDPR, or 45 days under the US state laws — whichever you invoke, and where both could apply we hold ourselves to the shorter one.

Before we release or delete anything we must be reasonably satisfied you are who you say you are (Art. 12(6)). That step exists to stop someone else exercising your rights in your name.

If we refuse a request we will tell you why, and you may complain to a supervisory authority. In the EU that is the authority in your country of residence, work, or where the alleged infringement happened; in the UK it is the Information Commissioner's Office.

Make a privacy request

Global Privacy Control

If your browser sends a Global Privacy Control signal we treat it as an opt-out of any optional processing, automatically, without asking you again. From 1 January 2026 California requires that you be able to confirm the signal was received, so the banner tells you when it has been detected and what it did.

In practice, because we run no analytics or advertising, the signal's effect here is limited to optional local storage — which is exactly what we say it does, rather than claiming a broader effect to sound better.

Security

Data is encrypted in transit with TLS and at rest by the hosting platform. Every table is protected by database-level row security, so a query issued on behalf of one organisation cannot return another's rows even if application code is wrong. Signed inspection records cannot be modified or deleted. Evidence photographs and signatures are in private storage and are only reachable through short-lived signed links. The site is served with a Content Security Policy and HSTS.

Security- and compliance-relevant changes are recorded in an append-only audit log: inspections created, edited or erased, changes of role or plan, corrective actions, privacy requests and consent. The database writes each entry itself, in the same transaction as the change, so an entry cannot exist for a change that did not happen and a change cannot be committed without its entry. An entry names the acting account and what changed, never a name, an email address or free text. Only managers and administrators of your own organisation can read it. Nobody using the service — including administrators of your organisation and our own support tools — can edit an entry: the database only accepts changes that remove personal references, and entries are deleted only together with your organisation's account. The operators who maintain the underlying database hold technical access that sits outside these controls; that access is restricted to authorised personnel. When you exercise the right to erasure, your account reference — both where you took an action and where an entry is about you — and any address are removed from the entries, while the record that an action happened is kept.

Two things we will not claim. We do not log every READ of personal data — the audit log records changes, not views — and saying otherwise would be a false security claim. And we do not promise an uptime figure. The architecture documents availability targets for a scaled, redundant deployment, but the service as currently deployed runs on a single server, which does not justify promising one.

No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify the relevant supervisory authority within 72 hours where Article 33 requires it, and tell you directly where Article 34 requires it.

Changes to this policy

When the wording changes, the version date at the top changes with it, and consent given against an earlier version is not carried over — the stored consent record is tied to the version it was given against, so a rewritten policy asks again rather than assuming.

Contact

Privacy questions and requests: use the request form, which records the statutory deadline automatically, or write to the controller at the address at the top of this policy.