Privacy Policy

1. Who We Are

Safirst ONE is a construction safety operating system developed and operated by Safirst Corporation, an Arizona corporation located at 3820 W Happy Valley Rd, Ste 141-138, Glendale, AZ 85310. Safirst ONE is available as a mobile application on the Apple App Store and Google Play Store and as a web-based admin dashboard at admin.safirst.com.

When we say "Safirst ONE," "we," "us," or "our" in this Privacy Policy, we mean Safirst Corporation. When we say "you" or "your," we mean any person who uses the Safirst ONE platform — whether as a worker, employer, GC safety manager, sub foreman, Safirst inspector, or any other role.

2. Information We Collect

2.1 Information You Provide Directly

• Name, email address, and phone number when you create an account
• Employer or organization name and your role within that organization
• Password (stored encrypted — we never see your actual password)
• External credentials you upload manually — OSHA 10/30 cards, forklift certifications, first aid cards, and similar documents
• Inspection findings, descriptions, severity ratings, and CFR citation references you enter during a safety inspection
• Photos you capture or upload during inspections
• Safety documents you upload to the Safety Docs Locker
• Quiz answers you submit during LMS training

2.2 Information Collected Automatically

• GPS location coordinates — captured automatically when you submit an inspection finding. Location is tied to the finding, not continuously tracked.
• Video watch progress — how much of each training video you have watched, tracked via the Vimeo API and stored server-side
• Quiz attempt data — your scores, which questions you answered, pass/fail status, and timestamp of each attempt
• Device information — device type, operating system version, and app version for troubleshooting purposes
• Usage data — which screens you visit, when you log in, and how you interact with the platform
• IP address — recorded in our audit log for security and compliance purposes

2.3 Information from Third Parties

• Payment information — processed by Apple In-App Purchase (iOS) or Google Play Billing (Android) for course purchases. We do not store your payment card number. We receive confirmation of purchase and transaction ID only.
• Video delivery — training videos are hosted on Vimeo. Vimeo's own privacy policy applies to video playback.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and verify your identity
• Deliver training courses, track your progress, and issue certificates of completion
• Record and store inspection findings, photos, and safety documents in your organization's Safety Docs Locker
• Generate PDF inspection reports and certificates of completion
• Send push notifications for certificate expiration and inspection updates
• Email certificates of completion to your registered email address
• Enable your employer or Safirst Corporation to view your training records and credentials as permitted by your role
• Maintain an immutable audit log of all platform events for regulatory compliance and ADOSH defense purposes
• Improve the platform, diagnose technical issues, and develop new features
• Comply with applicable laws and regulations including OSHA recordkeeping requirements

4. How We Share Your Information

4.1 Within Your Organization

Your training records, credential status, and inspection data are visible to other users within your organization according to their role permissions. GC Safety Managers can see training records for workers in their organization. Safirst Corporation administrators can see data across all organizations for compliance and platform management purposes.

4.2 With Safirst Corporation

As the platform operator, Safirst Corporation and its authorized staff have access to all data on the platform for the purpose of operating the service, conducting Track A safety inspections, reviewing and approving inspection reports, and providing customer support.

4.3 With Service Providers

We share data with the following service providers who help us operate the platform. Each is bound by data processing agreements consistent with this Privacy Policy:

• Supabase — database hosting, file storage, and authentication
• Vimeo — video hosting and delivery
• Apple / Google — payment processing for course purchases
• RevenueCat — in-app purchase management
• Vercel — admin dashboard hosting
• Expo / EAS — mobile app build and delivery

4.4 For Legal Compliance

We may disclose your information when required by law, court order, or government authority — including in response to OSHA or ADOSH regulatory proceedings. We may also disclose information to protect the rights, safety, or property of Safirst Corporation, our users, or the public.

4.5 We Do Not Sell Your Data

Safirst Corporation does not sell, rent, or trade your personal information to third parties for marketing purposes. Ever.

4.6 SMS / Text Messaging

When an organization administrator invites a worker by text message, the phone number and opt-in consent are used solely to deliver the one-time invite code and related transactional account messages. No mobile information or SMS opt-in data will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties under any circumstances. Message frequency is limited to invitation and account messages; message and data rates may apply. Reply STOP to opt out or HELP for help.

5. Data Retention

We retain your data for as long as required by applicable law and regulation. Key retention periods:

• Training records and certificates: retained as required by OSHA recordkeeping regulations — minimum 5 years for most records, longer where required by specific standards
• Inspection reports and safety documents: retained as required by applicable OSHA and ADOSH regulations
• Audit log entries: retained for the life of your organization's account plus 5 years
• Account information: retained while your account is active and for 5 years after closure
• Inactive records: automatically archived after 12 months of inactivity. Archived records remain retrievable but are moved to long-term storage.

When retention periods expire, data is securely deleted or anonymized.

6. Data Security

We implement industry-standard security measures to protect your information:

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted in Supabase using AES-256 encryption
• Row Level Security (RLS) is enforced at the database layer — users can only access data their role permits
• Passwords are hashed using bcrypt — we never store plaintext passwords
• All API keys and secrets are stored as environment variables — never in code or version control
• Access to the admin dashboard is restricted to authorized Safirst Corporation personnel only

No security system is perfect. If you believe your account has been compromised, contact us immediately at privacy@safirst.one.

7. Your Rights

You have the following rights regarding your personal information:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate information
• Deletion: request deletion of your account and personal information, subject to our legal retention obligations
• Portability: request your training records and certificates in a portable format
• Objection: object to certain uses of your information

To exercise any of these rights, contact us at privacy@safirst.one. We will respond within 30 days. Note that some information cannot be deleted if required to be retained by law.

8. Children's Privacy

Safirst ONE is intended for use by adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us at privacy@safirst.one and we will delete it promptly.

9. Location Data

The Safirst ONE mobile app requests access to your device's location when you conduct a safety inspection. Location data is used solely to record the GPS coordinates of inspection findings and is not used for advertising or continuous tracking. You may deny location permission but inspection GPS capture will be unavailable.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice in the app and updating the Effective Date above. Your continued use of Safirst ONE after a change constitutes acceptance of the updated policy.

11. Contact Us

For privacy questions, data requests, or to report a concern:

• Email: privacy@safirst.one
• Mail: Safirst Corporation, 3820 W Happy Valley Rd, Ste 141-138, Glendale, AZ 85310
• Phone: (602) 373-0393