JSA drafts: help and privacy
Synthetic pilot. PDF downloads, deletion, and scheduled cleanup run on a hosted service. The current private ChatGPT connection still needs the operator's local runner and tunnel for tool calls. Use synthetic examples only.
This tool checks the format of job safety analysis drafts and creates PDFs. It does not assess safety, certify compliance, approve a JSA, or authorize work. Responsible site personnel must review the draft against actual conditions.
What the tool receives
ChatGPT sends the draft fields needed for your requested validation or export: job steps, possible hazards, proposed controls, any supplied risk ratings, PPE, and notes. Keep names, medical details, site identifiers, credentials, and other sensitive information out of drafts. The current pilot is for synthetic examples only.
Validation runs in memory and does not save a source draft or PDF. Export creates a temporary PDF only when you request it. The tool cannot access BasinCheck accounts, tenant records, or incident reports. Your conversation in ChatGPT is governed separately by your OpenAI account and workspace settings.
Temporary PDFs and sharing
PDFs are stored in a private Supabase bucket. The database stores a hash of each download token, creation and expiry times, and delivery status. It does not store the source draft JSON or the raw download token.
Anyone holding your original download link can read that PDF until its 24-hour access period expires or you delete it. Repeated downloads are allowed. Sharing the link shares access. Opening the link removes its token from the browser address bar; use the original ChatGPT link to reopen it.
Expiry and deletion
Access expires 24 hours after export. The host schedules cleanup hourly to remove expired PDFs and metadata, normally within 25 hours of export. Outages can delay physical deletion. New exports pause when cleanup is unhealthy. Downloaded or forwarded copies cannot be recalled.
To delete earlier, open the original ChatGPT download link, select Delete this draft, then confirm. No BasinCheck account is required. Access is revoked before storage deletion. If deletion fails, access may already be revoked; retry the deletion or contact privacy@basincheck.com. Do not email draft content, credentials, or the full bearer link. Support can explain the deletion process without collecting those details.
Website tracking and infrastructure logs
These help and download pages load no analytics, marketing pixels, session replay, or advertising scripts. PDF links contain no campaign tags, personal identifiers, or document tracking. The download token stays in the URL fragment and is sent to this host only in an encrypted request body when you request a download or deletion.
The host uses Vercel for hosting and Supabase for database and PDF storage. Their infrastructure can retain request times, paths, IP addresses, status codes, and security metadata. The application does not write draft content or bearer tokens to logs. Backend storage paths contain token hashes. Operational metadata supports delivery, abuse prevention, and troubleshooting; it is not used to profile plugin users or attribute marketing campaigns.
Provider logs and backups have separate retention rules. Deleting a PDF does not erase all infrastructure records, and this pilot does not promise zero retention. Use synthetic information only while provider retention and the pilot's broader privacy assessment are being finalized.
Contact
BasinCheck is operated by JS Consulting, trading as JSC Software, Debowa 42/10, 55-010 Radwanice, Poland. For privacy or deletion questions, contact privacy@basincheck.com.