Safety Signal

1. What We Collect

We collect the following categories of data:

Account data — email address and password (hashed) when you sign up.
Company data — company name, logo, and subscription details you provide.
Incident and safety data — reports, observations, training records, certifications, and photos submitted by you or your team.
Usage data — pages visited, features used, and session metadata collected automatically to improve the product.
Payment data — handled directly by Stripe; we never see or store raw card numbers.

2. How We Use Your Data

To provide, operate, and improve the Safety Signal service;
To send transactional emails (account confirmation, billing receipts);
To generate anonymized, aggregated safety insights that power cross-company learning features;
To comply with legal obligations.

We do not use your data for advertising. We do not sell your data to any third party. See our Terms of Service §4 for the full data license explanation.

3. How We Store and Protect Data

All data is stored in Supabase (hosted on AWS) with encryption at rest and in transit. Incident photos are stored in private cloud storage and served only via short-lived signed URLs. Access is restricted by row-level security so users can only read their own company's data.

4. Third-Party Services

We share limited data with the following processors to operate the Service:

Supabase — database and authentication hosting;
Vercel — application hosting and edge delivery;
Stripe — payment processing;
Anthropic — AI model used to generate safety briefings (incident narratives are sent; no account-identifying data is included).

Each processor is contractually bound to use your data only as needed to provide their service to us.

5. Your Rights

You have the right to:

Access — request a copy of all data we hold about you;
Correction — update inaccurate information from within the app;
Deletion — cancel your account and have all Company Data permanently deleted within 30 days;
Portability — export your incident records as CSV from the OSHA 300 screen.

To exercise any of these rights, email hello@safety-signal.com.

6. Data Retention

We retain your data for as long as your account is active. If you cancel, data is retained for 30 days to allow export, then permanently deleted. Anonymized aggregate data derived from your submissions may be retained indefinitely as it contains no identifying information.

7. Children

Safety Signal is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it promptly.

8. Changes to This Policy

We will notify you by email or in-app notice before making material changes to this policy. The effective date at the top of this page reflects the date of the most recent revision.

9. Contact

Privacy questions or requests: hello@safety-signal.com
Morgan Software LLC, Louisiana, USA

Privacy Policy