This Privacy Policy explains what personal information HazardHarbor collects, how we use and share it, and the choices and rights you have. It applies to our website and the HazardHarbor Service.
Information we collect
Account information: username, email address, optional display name, password (stored only as an Argon2id hash), two-factor settings, plan and workspace membership.
Workspace content: inspections, corrective actions, job safety analyses, incidents, training records, program drafts and similar information you or your workspace members enter. This may include names of people or roles you choose to record.
Billing information: when you subscribe, Stripe collects your payment details. We receive limited information such as your Stripe customer ID, plan, subscription status, billing email and the last four digits and brand of your card where Stripe provides them. We never receive or store full card numbers.
Support communications: the name, email, topic and message you send us.
Security and usage data: IP address, browser user agent, sign-in times, session records and an audit log of security-relevant actions (such as password changes, sign-ins and membership changes), used to protect accounts and the Service.
Cookies: we use only strictly necessary cookies — a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. We do not use advertising or third-party tracking cookies.
How we use information
To provide, maintain and secure the Service; authenticate you; process subscriptions; send transactional emails (verification, password reset, security alerts, invitations, billing notices); respond to support requests; prevent fraud and abuse; comply with law; and improve the Service in aggregate.
We do not sell your personal information, share it for cross-context behavioral advertising, or use your workspace content to train artificial intelligence models.
How we share information
Service providers who process data on our behalf under contractual obligations: Railway (application hosting and database), Stripe (payments and billing), Resend (transactional email delivery) and Google Fonts (web font delivery, which receives your IP address when fonts load).
Your workspace: on the Team plan, members of a shared workspace can see the workspace's records and the usernames and emails of other members.
Legal and safety: where required by law, legal process, or to protect the rights, safety and security of users, the public or us.
Business transfers: in connection with a merger, acquisition or sale of assets, subject to this Policy.
Retention
We keep account and workspace data while your account is active. When you delete your account, your personal account data and (if you own it) your workspace content are deleted from our production database immediately, and from routine backups within 30 days. Details are in our Data & Deletion Policy.
We keep billing records and invoices as required for tax and accounting purposes (generally up to 7 years), security logs for up to 12 months and support messages for up to 24 months.
Security
We use administrative, technical and physical safeguards described on our Security page. No system is perfectly secure; please use a strong unique password and enable two-factor authentication.
Your rights and choices
You can access, correct, export and delete your information from Account settings at any time. You can also email us to request access, correction, deletion or a copy of your data, or to ask questions about how we process it. Depending on where you live (for example, California, Colorado, Virginia, the EU/UK), you may have additional rights, including the right to object to or restrict certain processing and to appeal a decision about your request. We will not discriminate against you for exercising your rights.
We will verify requests by confirming control of your account email. Authorized agents may submit requests with proof of authorization.
Children
The Service is intended for adults and workplace use. It is not directed to children under 16 and we do not knowingly collect their personal information. Contact us if you believe a child has provided information.
International users
We are based in and host data in the United States. If you access the Service from elsewhere, your information will be transferred to and processed in the United States.
Changes
We'll post updates here and notify account holders of material changes by email or in the Service.
Contact
Questions about this policy? Contact us through Contact support or email hazardharbor.online@gmail.com.