Privacy

Each customer company owns the records its people enter. We process them on the company’s behalf to run the service, and for no other purpose. If you are a worker, your employer decides what is collected about you and how long it is kept; questions about your own records usually go to them first.

Each company’s records are isolated from every other company’s at the database level.

• Account details: name, email address, company, role and preferred language.
• Safety records your company creates: talks and signatures, JHAs, inspections and photos, incidents and injury details, corrective actions, equipment, certifications and training, documents, and HR records your company chooses to keep here.
• Location, only with a record: when a field form asks for it, the phone’s location is attached to that record (for example, where an incident was reported). We do not track location in the background.
• Technical data: basic logs (IP address, browser, time of request) used to keep the service secure and working.

• We do not sell personal data or safety records, and we do not share them for advertising.
• We do not use advertising trackers.
• We do not use your company’s records to build products for anyone else.

We use a small number of service providers (subprocessors), each only for the job listed:

• Vercel — hosts the application.
• Supabase — database, sign-in and file storage (photos, documents, signatures).
• Resend — sends email, such as invitations, sign-in links and expiry reminders.

If we add or replace a subprocessor, we will update this page before it handles customer data.

So crews can work without signal, the field app keeps some data on the phone — the day’s forms, the SDS binder if a worker saves it, and entries waiting to sync. Signing out clears it from that phone.

Data is encrypted in transit and at rest by our providers. Access inside the app is limited by role — for example, injury details and HR records are restricted to the people whose job needs them. No system is perfectly secure; if we learn of a breach affecting your data, we will tell the affected company promptly.

We keep a company’s records while it is a customer. Some safety records have legal retention periods (OSHA injury logs, for example, must be kept for five years); your company decides how to meet those.

A company can ask us to export all of its data, or to delete it, at any time. When a company leaves, we delete its data within 90 days unless it asks us to keep it longer or the law requires otherwise.

If this policy changes in a way that matters, we will update the date above and tell customer administrators. For questions, or to request an export or deletion, contact your company’s Field Safety IQ administrator or reach us through the contact details in your agreement. See also our terms.