Privacy Policy

1. What we collect

• Account info: your name and email address, used to create your account and send you your documents.
• Company info: the details you give Guy during intake — company name, trade, jurisdiction, hazards, workforce details, and similar facts necessary to generate your compliance documents.
• Payment info: payments are processed through Stripe. We see and store enough metadata to associate your purchase with your account (last four digits, card brand, billing email) but we do not store full card numbers. Stripe holds the sensitive payment data under their own compliance program.
• Usage data: basic information about how you use the site — pages viewed, features used, errors encountered — so we can fix bugs and improve the product.

2. How we use it

• To generate and deliver your compliance documents.
• To send you transactional emails — receipts, document delivery, account notifications, edit-window reminders, and regulatory update alerts.
• To support you when you contact us with questions or edit requests.
• To improve the product — for example, to identify which intake questions confuse people and fix the conversation.

3. Third parties we share with

We share data only with the service providers we need to run the business:

• Stripe — processes payments and subscriptions. Subject to Stripe’s privacy policy.
• Resend — sends transactional emails (receipts, document delivery, account notifications).
• PostHog — product analytics. We anonymize identifiers and use it to understand aggregate usage; we do not use it for advertising.

We don’t share your personal information with anyone else except where required by law (subpoena, court order, valid legal process) or to protect our rights, our users, or the public.

4. We do not sell your data

We don’t sell, rent, or trade your personal information. We don’t share it with advertisers. We don’t hand it to data brokers.

5. Data retention

We retain your account data and your generated documents as long as your account is active so you can come back and download them or edit them. If you ask us to delete your account, we’ll delete your personal information and your documents within a reasonable period, unless we’re required by law to retain certain records (for example, payment and tax records).

6. California resident rights (CCPA)

If you’re a California resident, the California Consumer Privacy Act gives you the right to:

• Know what personal information we’ve collected about you and how we use it.
• Delete the personal information we hold about you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale of your personal information — though as noted above, we don’t sell personal information in the first place.
• Non-discrimination — we won’t treat you differently for exercising any of these rights.

To exercise any of these rights, email [email protected] from the address on your account.

7. Cookies

We use a single session cookie (sid) to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party cookies for cross-site tracking.

8. Security

We use reasonable technical and organizational safeguards to protect your data — encrypted connections, restricted internal access, and trusted payment infrastructure (Stripe). No system is perfectly secure; if we ever learn of a breach affecting your data, we’ll notify you in line with applicable law.

9. Children

The service is for businesses and adults. We don’t knowingly collect personal information from anyone under 16. If you think a minor has given us information, contact us and we’ll delete it.

10. Changes to this policy

We may update this policy from time to time. When we do, we’ll update the “Last updated” date at the top of this page.

11. Contact

Privacy questions, requests, or concerns? Email us at [email protected].