BasinCheck Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, submit an audit, report an incident, or contact us for support.

This includes:

• Name, email address, and phone number
• Company name and job title
• Audit data, inspection records, incident reports, JSAs, corrective actions, SDS/HazCom records, safety meeting records, training records, permits, and other safety documentation
• Employee or crew member names, roles, signatures, witness statements, photos, attachments, and location or job information entered by a customer
• Payment information (processed securely by Stripe)

Workplace safety records may include personal information and, in some cases, sensitive information about an injury, illness, medical refusal, job assignment, or workplace event. BasinCheck processes that information to provide the safety management service requested by the customer.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Generate customer-requested exports, reports, backups, and safety documentation

We do not sell customer employee data. We do not share customer employee data for cross-context behavioral advertising. Customer safety records are used to operate, secure, support, and improve BasinCheck.

3. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes:

• Tenant-level data isolation
• Role-based access controls and authentication
• Encrypted transport for application traffic
• Private storage controls for safety files and attachments
• Restricted administrative access to customer environments

4. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Safety records may be retained for longer periods as required by OSHA, Cal/OSHA, customer policy, contractual requirements, litigation holds, insurance needs, or other legal obligations.

When a customer requests deletion or offboarding, BasinCheck will coordinate export, deletion, or retention of records according to the customer agreement and applicable recordkeeping obligations. Some records may be archived instead of immediately deleted when retention duties apply.

5. Your Rights

Depending on your location and relationship to a BasinCheck customer, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Opt out of marketing communications

For employee, contractor, or crew safety records, BasinCheck typically coordinates requests through the employer or customer account administrator. This helps preserve required safety records while still supporting access, correction, export, or deletion requests when appropriate.

6. California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). These may include the right to know what personal information is collected, used, disclosed, or shared; the right to request deletion; the right to correct inaccurate information; the right to limit certain uses of sensitive personal information; and the right not to be discriminated against for exercising privacy rights.

BasinCheck processes customer workplace safety records as a service provider/vendor for the customer. We do not sell customer employee data. Requests involving workplace safety records should be submitted through the customer organization where possible, or by contacting privacy@basincheck.com.

7. Third-Party Services

We use trusted third-party services to operate our platform:

• Google Sign-In for authentication
• Supabase for authentication and database
• Stripe for payment processing
• Resend for email communications
• Vercel for hosting

Additional subprocessors may be used for monitoring, analytics, billing, support, or optional product features. BasinCheck maintains a subprocessor list for customer review.

8. Google Sign-In

When you choose to sign in with Google, we receive the following information from your Google account:

• Your email address
• Your name
• Your profile picture (optional)

We use this information solely to create and manage your BasinCheck account. We do not access your Google Drive, Gmail, Calendar, or any other Google services. You can revoke BasinCheck's access to your Google account at any time through your Google Account settings at myaccount.google.com/permissions.

9. Optional Website Analytics

Optional analytics and marketing scripts load only after you allow them. Select Privacy settings to accept, reject, or withdraw that choice. Do Not Track overrides optional analytics consent. Your choice is saved locally in your browser. Withdrawing consent reloads the page to stop scripts already loaded; it cannot recall data previously transmitted.

If allowed, website services may include PostHog, Microsoft Clarity, Umami, Plausible, Google Tag Manager, Snitcher, Tawk, and Sumo. They can process visit and interaction information and use cookies or local storage. Essential authentication, security, and error diagnostics are separate from optional marketing analytics.

Microsoft Clarity can record page interactions for session replay. Optional analytics can measure page views, referral sources, and device information. Sentry session replay and PostHog automatic interaction capture are disabled in this configuration.

10. ChatGPT JSA Drafts

JSA draft validation receives only the draft fields supplied for the requested check and does not persist a source draft or PDF. An explicit export creates a temporary PDF in private storage. The download link grants access to anyone holding it until its 24-hour expiry or early deletion. The database stores a token hash, timestamps, and delivery status; it does not store the source draft JSON or raw token.

The synthetic pilot hosts PDF downloads, deletion, and hourly cleanup independently of the operator's computer. The private ChatGPT tool connection still needs its local runner and tunnel. Successful hourly cleanup normally removes expired PDFs within 25 hours. Outages can delay physical deletion. The hosted download page includes Delete this draft to revoke access and request early deletion without an account. Copies downloaded or forwarded elsewhere cannot be recalled.

Plugin help and download pages use no analytics scripts or campaign tags. Vercel and Supabase may retain operational request metadata and backups under their separate policies. The application does not log draft content or bearer tokens. The current pilot accepts synthetic examples only. See the JSA help and privacy page for details. ChatGPT conversation handling depends separately on your OpenAI account and workspace settings.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at:

JS Consulting (operating as JSC Software)
Debowa 42/10
55-010 Radwanice, Poland
VAT ID: PL764-264-85-45
Email: privacy@basincheck.com