BasinCheck Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, submit an audit, report an incident, or contact us for support.

This includes:

• Name, email address, and phone number
• Company name and job title
• Audit data, inspection records, incident reports, JSAs, corrective actions, SDS/HazCom records, safety meeting records, training records, permits, and other safety documentation
• Employee or crew member names, roles, signatures, witness statements, photos, attachments, and location or job information entered by a customer
• Payment information (processed securely by Stripe)

Workplace safety records may include personal information and, in some cases, sensitive information about an injury, illness, medical refusal, job assignment, or workplace event. BasinCheck processes that information to provide the safety management service requested by the customer.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Generate customer-requested exports, reports, backups, and safety documentation

We do not sell customer employee data. We do not share customer employee data for cross-context behavioral advertising. Customer safety records are used to operate, secure, support, and improve BasinCheck.

3. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes:

• Tenant-level data isolation
• Role-based access controls and authentication
• Encrypted transport for application traffic
• Private storage controls for safety files and attachments
• Restricted administrative access to customer environments

4. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Safety records may be retained for longer periods as required by OSHA, Cal/OSHA, customer policy, contractual requirements, litigation holds, insurance needs, or other legal obligations.

When a customer requests deletion or offboarding, BasinCheck will coordinate export, deletion, or retention of records according to the customer agreement and applicable recordkeeping obligations. Some records may be archived instead of immediately deleted when retention duties apply.

5. Your Rights

Depending on your location and relationship to a BasinCheck customer, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of marketing communications

For employee, contractor, or crew safety records, BasinCheck typically coordinates requests through the employer or customer account administrator. This helps preserve required safety records while still supporting access, correction, export, or deletion requests when appropriate.

6. California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). These may include the right to know what personal information is collected, used, disclosed, or shared; the right to request deletion; the right to correct inaccurate information; the right to limit certain uses of sensitive personal information; and the right not to be discriminated against for exercising privacy rights.

BasinCheck processes customer workplace safety records as a service provider/vendor for the customer. We do not sell customer employee data. Requests involving workplace safety records should be submitted through the customer organization where possible, or by contacting privacy@basincheck.com.

7. Third-Party Services

We use trusted third-party services to operate our platform:

• Google Sign-In for authentication
• Supabase for authentication and database
• Stripe for payment processing
• Resend for email communications
• Vercel for hosting

Additional subprocessors may be used for monitoring, analytics, billing, support, or optional product features. BasinCheck maintains a subprocessor list for customer review.

8. Google Sign-In

When you choose to sign in with Google, we receive the following information from your Google account:

• Your email address
• Your name
• Your profile picture (optional)

We use this information solely to create and manage your BasinCheck account. We do not access your Google Drive, Gmail, Calendar, or any other Google services. You can revoke BasinCheck's access to your Google account at any time through your Google Account settings at myaccount.google.com/permissions.

9. Contact Us

If you have questions about this Privacy Policy, please contact us at:

JS Consulting (operating as JSC Software)
Debowa 42/10
55-010 Radwanice, Poland
VAT ID: PL764-264-85-45
Email: privacy@basincheck.com