Privacy Policy

The short version

• We never see your card. Payment happens on Stripe’s own page; we store only Stripe’s identifiers and the amount.
• We do not sell your data, and there are no advertising or analytics trackers on this site.
• We do not ask for medical information. No field here is for exam results, diagnoses or X-ray readings — please do not type them into a note.
• We are not anonymous: your program content is stored in a readable form so it can be regenerated and versioned.

What we store

Your account

Username, a hash of your password (never the password), and optionally a display name and email address. For each sign-in we keep a session token, the time, your IP address and your browser’s user-agent string. Expired sessions are deleted automatically. To limit abuse we also keep a count of failed sign-in attempts on your account, the IP address a password reset was requested from, and, for 48 hours, the IP address of each attempt to create an account.

Cookies

This site sets two cookies of its own. One keeps you signed in. The other is a session cookie that holds a security token for forms, the “how you found us” details below, and your intake answers while you are part-way through them. Neither is used to follow you onto other websites, and this site sets no third-party cookies.

How you found us

On your first visit we note, in this site’s own session cookie, where you came from: the name of the website that linked to you (not the full address), any campaign tags on the link you followed (utm_source, utm_medium, utm_campaign, utm_term and utm_content), and the page you arrived on. If the link carried the referral code of one of our referral partners (?ref=), we also note that partner and when you arrived. If you then create an account, the referring site, the source, medium and campaign tags, the landing page and any referral partner are copied onto it. A referral code is never added to an account that already exists.

If a referral partner sent you

We record which partner referred your account. If you buy, we record the details of your first payment that we need to work out what we owe the partner: the product, the amount collected, any refund, the dates, and the Stripe identifiers for the purchase. We keep a record of what we paid the partner and when. Nothing you buy costs more, and no discount is given, because a partner referred you.

Your company and your program

Company name, address, industry and employee count; the name, job title, email and contact details of your program administrator; the hazards you identify; where your records are kept; your safety committee’s name, meeting frequency and members; training subjects; equipment; and your answers to the screening questions. Every generated document is kept, along with its version history and the dates it was created and first downloaded.

Each time you download an editable file we record which version it was, when, which of your purchases covered it, and a fingerprint of the file. A refund decision, and your ability to download that same version again after a subscription ends, both rest on that record.

Records you keep here

The compliance calendar: each recurring obligation your programs create, the date you marked it done, and any note you typed with it. For a silica program, the task descriptions, materials and controls you enter in the intake are stored with the rest of your answers.

Medical information — not collected

We do not ask for exam results, diagnoses, X-ray classifications or any medical finding, and no field in the product is designed to hold them. Notes on the compliance calendar and a few intake fields are free text, and we store whatever is typed into them — so please do not type medical information there. Record that a medical exam happened, not what it found.

Built but not in use

The database also has tables for a silica task register, air-monitoring sample results, medical-surveillance schedules (an employee reference, the reason, exam dates and the provider — never findings) and SB 20 attestation records. No screen in the product writes to them today, so they are empty. If a feature starts using them, this page will say so before it does.

Server logs

Like any web server, ours writes a log line for each request: the time, the page address and the IP address it came from. The application also logs events such as sign-ins, failed sign-ins and emails sent, which can include your username and the email address a message went to. These logs are held on our hosting provider’s systems. We do not copy them anywhere else, and we have not set a retention period of our own for them.

Payments

What you bought, when, the amount and currency, and the identifiers Stripe gives us for the customer, payment and subscription. That covers each payment separately — a first purchase, each renewal, an upgrade — any discount applied, any refund, and what Stripe tells us about a subscription: its renewal date, the price it is on, and whether it is set to end. Card numbers never reach our servers — you type them on a page hosted by Stripe.

If you have a subscription and an email address on your account, we email you a notice before it renews, and keep a copy of what was sent and when. If you upgrade, we keep the figures you were shown before you agreed.

If we stop an affected renewal because its required notice could not be provided, we keep the expiration notice and a downloadable copy in your account, together with email-attempt results. An account copy is not proof that it was read, and email-provider acceptance is not proof of inbox delivery. A signed complaint may cause us to stop using that email channel for later notices without erasing the earlier transmission history.

What you agreed to at checkout

Each time you start a paid checkout — when you press the payment button, whether or not you go on to pay — we record:

• the account you are signed in to;
• the product you chose;
• the exact wording of the agreement checkbox you ticked;
• which versions of the Terms of Service, Refund Policy and Privacy Policy applied, including a copy of their text;
• the date and time;
• your IP address;
• your browser’s user-agent string;
• the seller information shown beside the payment button — our legal name, address, refund rule and how to ask for that information by email; and
• the Stripe Checkout Session ID, once Stripe opens a payment page, which links the record to the payment that follows.

For Starter and Pro, which renew automatically, we separately record your agreement to the renewal: the renewal terms you were shown, the exact wording of that checkbox, and the same time, IP address, user-agent string and Checkout Session ID.

Subscription acknowledgments. When a subscription starts or is upgraded, we prepare an acknowledgment of what you bought and agreed to: the plan, the amounts and dates, how to cancel, and the policy versions you accepted. We keep that copy, the email address it was sent to, the attempts to send it and their result, so that you can download it from your billing page. A message our mail server accepted is recorded as sent; that is not proof it reached your inbox.

We keep these records as evidence of the transaction and of the terms you accepted. Nothing deletes them automatically, and we have not set a period after which they are removed.

If you write to us

Your name, email, and any phone number, company and subject you give, plus the message, your IP address and your user-agent string. Contact messages are stored rather than only emailed, so a message cannot be silently lost when mail delivery fails.

Personal information about your employees

Some fields can contain other people’s personal information — committee members, the qualified person who took an air sample, the employee reference on a surveillance schedule. You decide what goes in them. Please use an employee number or initials rather than a full name wherever the record does not need one; nothing in the product requires a full name in those fields. As between us, you are responsible for your employees’ data and we hold it on your behalf.

Who else sees it

Who	What they get
Stripe	Payment processing. Your email, what you bought, your account number with us, and your card details, which they handle and we never receive. Stripe’s payment page is their own site and they collect what it needs there, including your IP address.
Fly.io	Hosting. The application, its database and its logs run on their infrastructure in the United States.
Tigris	Database replication and recovery archives containing the database and generated documents, sent over encrypted connections to object storage provided through Fly.io. Tigris states that it encrypts stored data; we do not add encryption of our own.
Resend	Review reminders, renewal notices, password-reset links and the notice we receive when you use the contact form, when email is configured. That means the addresses involved and the content of those messages.
Porkbun	Hosts our support mailbox, so it holds what you send through the contact form or by email, and our replies.
Google / Gmail	New support mail is also copied to the owner’s Gmail inbox, including its content and attachments. The original remains in Porkbun.
Microsoft Outlook	We use Outlook to read and send support mail. If Microsoft Cloud synchronization is enabled for the mailbox, Microsoft also processes the synchronized mailbox content. We have not enabled additional cloud synchronization as part of this update.
Google Fonts	The typefaces this site uses load from Google, which means Google’s servers see your IP address when a page loads.
Referral partners	Nothing that identifies you. We do not give a partner your name, email, company or anything you enter here. If a partner referred you and you buy, we may tell them the date and amount of the commission they earned.
jsDelivr	A stylesheet this site loads from their CDN, which means their servers see your IP address when a page loads.

Those are the parties that receive data through this site in its ordinary running, and none of them buys it from us. Beyond them, we disclose information only where it is needed: when the law requires it, such as a valid subpoena or court order; to our own professional advisers, such as lawyers and accountants, so they can advise us; to investigate or respond to fraud, a security incident or abuse of the service; to a buyer or successor if the business or its assets are transferred; and to a provider that replaces or is added to one of those above, which we will add to this list.

Tracking across other sites. We do not track you across other websites, and we do not let anyone else use this site to do so. Stripe, Google Fonts and jsDelivr receive your IP address as described above and handle it under their own policies. Because there is no tracking to switch off, this site behaves the same whether or not your browser sends a “Do Not Track” signal.

How long we keep it

We keep account programs and records while the account exists and while our access and download commitments apply. Cancelling a subscription does not itself close your account or remove your access to previously downloaded versions under our terms. Expired sessions are deleted automatically.

Routine support inquiries become eligible for reviewed cleanup 12 months after resolution. Billing, refund, cancellation, complaint, dispute, security, privacy-request and legal records are excluded from routine mail cleanup. We preserve the relevant threads and attachments with the underlying evidence, including necessary referral and commission records.

Our business-record schedule retains necessary contracts, accepted policy versions, consents, payment records and relevant purchased-file versions for at least seven years after the later of account closure or the final transaction. A legal requirement, insurance requirement, preservation hold or continuing access commitment may require longer. This does not mean we keep every draft or unnecessary personal detail for seven years. Customers’ employer recordkeeping obligations may differ; please keep your own required records.

Our ordinary recovery schedule calls for daily restore points for 30 days and monthly checkpoints until they are 90 days old. Required business evidence is preserved separately from ordinary recovery copies. Copies needed for a legal or security matter may be held longer. Existing copies are classified and checked for recovery before reviewed cleanup; we do not automatically erase data or backups when these periods end.

For restore testing, we download a complete copy of the database and generated-file archives into private storage outside this website and outside shared or synchronized folders. Those copies are included in the reviewed recovery schedule and any applicable preservation holds.

Cleanup accounts for copies in our application, Porkbun mailbox, forwarded Gmail and exports. Provider logs and provider-managed backups have separate retention under the providers’ policies. Before resuming service from an older recovery copy, our restore procedure requires reconciliation with the current register of completed deletion and closure actions. There is no automatic cross-mailbox deletion or restore replay today.

Server logs, password-reset records and unfinished drafts do not currently have a separate automatic expiry schedule of our own. They are considered individually for access or deletion requests and applicable preservation needs; the seven-year business-evidence rule is not a blanket rule for them.

The October 19, 2026 Privacy Policy remains available. This update describes our current providers and retention approach; it does not rewrite an earlier recorded agreement.

Access, correction and deletion requests

You may contact us to request access to, correction of, or deletion of information associated with your account — at support@californiasafetyprograms.com. We may need to verify your identity before acting on a request. We respond according to applicable law. Some information may be retained when reasonably necessary to document transactions and accepted terms, prevent fraud or abuse, maintain security, comply with legal obligations, or establish, exercise, or defend legal claims. There is currently no self-service account-deletion feature.

Your generated documents are yours. Download and keep your own copies of anything you want to keep.

Changes

If this changes in a way that affects what we collect or who sees it, we will tell account holders rather than quietly updating the page: the new version is posted here with its date, and we email every account holder who has given us an email address. An account with no email address on it cannot be reached that way, so the date at the top of this page is the thing to check.

Questions about any of this go to support@californiasafetyprograms.com. — and see the terms and the refund policy.