Privacy Policy

1. Who We Are

Safirst ONE is a construction safety operating system developed and operated by Safirst Corporation, an Arizona corporation located at 3820 W Happy Valley Rd, Ste 141-138, Glendale, AZ 85310. Safirst ONE is available as a mobile application on the Apple App Store and Google Play Store and as a web-based admin dashboard at admin.safirst.com.

This Privacy Policy describes how Safirst Corporation collects, uses, discloses, and protects personal information in connection with the Services. It applies to visitors, account users, organization owners and team members, invited users, and other people who interact with the Services. "You" or "your," means any person or entity who uses the Services whether the person or entity is a worker, employer, GC safety manager, sub foreman, Safirst inspector, or holds any other role.

2. Information We Collect

2.1 Information You Provide Directly

• Account and profile name, email address, and phone number
• Billing email, phone number, website, and address
• Employer or organization name, information, roles, and permissions
• Account credentials, including passwords maintained in hashed form
• External credentials — OSHA 10/30 cards, forklift certifications, first aid cards, and similar documents
• Inspection findings, descriptions, severity ratings, and CFR citation references entered during a safety inspection
• Photos captured or uploaded during inspections
• Safety documents uploaded to the Safety Docs Locker
• Quiz answers submitted during LMS training

2.2 Information Collected Automatically. We may automatically collect IP address, user agent, browser and device information, timestamps, authentication and account activity, usage information, security and anti-abuse events, and similar technical information. Certain account, security, compliance, export, and deletion-related events may be recorded in our audit logs. We also maintain diagnostic and operational logs used to troubleshoot errors, monitor performance, and operate the Services.

• GPS location coordinates — Captured automatically when you submit an inspection finding. Location is tied to the finding, not continuously tracked.
• Video watch progress — Tracked via the Vimeo API and stored server-side
• Quiz attempt data — Your scores, which questions you answered, pass/fail status, and timestamp of each attempt
• Device information — Device type, operating system version, and app version for troubleshooting purposes
• Usage data — Screen visits, log in times, and interactions with the Services
• IP address, user agent, browser, device information, time stamps, diagnostic logs, session, cookie, authentication, rate-limit, anti-abuse, fraud-prevention, security suspension, audit-log, export/download, and deletion workflow records — Recorded in our audit log for security and compliance purposes
• Plan, trial, subscription status, and customer portal metadata

2.3 Information from Third Parties

• Payment information — Processed by Apple In-App Purchase (iOS) or Google Play Billing (Android) for course purchases. We do not store your payment card numbers. We receive confirmation of purchase and transaction ID only.
• Video delivery — Training videos are hosted on Vimeo. Vimeo's own privacy policy applies to video playback.

3. How We Use Information

We use the information we collect to:

• Provide, maintain, secure, and improve the Services
• Create and manage your account and verify your identity
• Authenticate users and secure accounts
• Store and serve uploaded files and attachments
• Provide AI-assisted features
• Deliver training courses, track your progress, and issue certificates of completion
• Record and store inspection findings, photos, and safety documents in your organization's Safety Docs Locker
• Generate PDF inspection reports and certificates of completion
• Send push notifications for certificate expiration and inspection updates
• Email certificates of completion to your registered email address
• Enable your employer or Safirst Corporation to view your training records and credentials as permitted by your role
• Maintain audit logs of certain account, safety, compliance, security, and administrative events for recordkeeping, regulatory compliance, security, and legal purposes
• Improve the Services, diagnose technical issues, and develop new features
• Communicate about account, product, support, legal, billing, and service updates
• Prevent, detect, investigate, and respond to fraud, abuse, security incidents, unauthorized access, rate-limit events, document abuse reports, and policy violations
• Create and maintain audit logs, status history, and business records
• Analyze reliability, performance, usage, and product quality
• Comply with applicable laws and regulations including OSHA recordkeeping requirements

4. Legal Bases (where applicable)

If GDPR/UK GDPR applies, our legal bases include:

• Contract performance
• Legitimate interests (service operations, security, product improvement)
• Consent (where required)
• Legal obligations

5. How We Collect Information

We collect information:

• Directly from you when you create an account, configure an organization, upload files, contact support, submit forms, or use the Services
• From organization owners, administrators, or other users who invite you, assign roles, enter records, or send documents
• Automatically through cookies, logs, security systems, rate limits, analytics, and similar technologies
• From service providers, including authentication, payment, email, hosting, database, storage, analytics, security, and AI model providers, when needed to operate the Services

6. Sharing of Information

We may share your information with the following individuals and entities for the following purposes.

6.1 Your Organization

Your training records, credential status, and inspection data are visible to other users within your organization according to their role permissions. GC Safety Managers can see training records for workers in their organization. Safirst Corporation administrators can see data across all organizations for compliance and Services management purposes.

6.2 Safirst Corporation

As the Services operator, Safirst Corporation and its authorized staff have access to all data related to the Services for the purpose of operating the service, conducting Track A safety inspections, reviewing and approving inspection reports, and providing customer support.

6.3 Service Providers

We may disclose personal information to service providers and subprocessors that perform services on our behalf or help us operate, support, secure, and improve the Services. These providers may include cloud hosting, database and file-storage providers; authentication and security providers; payment and subscription processors; video-hosting and content-delivery providers; analytics and diagnostic providers; communications and support providers; mobile application infrastructure providers; and artificial intelligence service providers.

These service providers may process personal information only as necessary to provide services to us and subject to applicable contractual terms and data-processing obligations. They are not authorized to use Customer Data for their own marketing purposes. For purposes of this Policy, "Customer Data" means information, records, documents, content, and other data submitted to, uploaded to, generated through, or otherwise processed through the Services by or on behalf of Safirst customers, organizations, administrators, or users. Customer Data may include personal information but is not limited to personal information.

6.4 Others

• Professional advisors (legal, audit, compliance)
• A successor entity in a merger, acquisition, or asset sale

6.5 For Legal Compliance Purposes

We may disclose your information when required by law, court order, or government authority including in response to OSHA or ADOSH regulatory proceedings. We may also disclose information to protect the rights, safety, or property of Safirst Corporation, our users, or the public.

6.6 We Do Not Sell Your Data

Safirst Corporation does not sell, rent, or trade your personal information to third parties for marketing purposes or money. We do not knowingly share personal information for cross-context behavioral advertising. If our practices change, we will update this Policy and provide any required choices.

We may disclose personal information in response to lawful subpoenas, court orders, warrants, or other legal process. Where legally permitted and reasonably practicable, we may notify the affected customer before disclosing Customer Data.

6.7 SMS / Text Messaging

When an organization administrator invites a worker by text message, the phone number and opt-in consent are used to deliver the one-time invite code and related transactional account messages. No mobile information or SMS opt-in data will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties. Message frequency is limited to invitation and account messages; message and data rates may apply. Reply STOP to opt out or HELP for help.

7. Cookies and Similar Technologies

We may use analytics, diagnostic, and performance-monitoring technologies to understand use of the Services, identify errors, monitor performance, maintain security, and improve functionality. These technologies may collect information such as device and browser information, IP address, usage information, page or screen activity, and diagnostic or error data, depending on the service and configuration used. We do not currently use cookie banners, marketing trackers, or advertising pixels on our websites. If we add non-essential tracking technologies in the future, such as advertising pixels or marketing analytics tools, we will update this Policy and request consent where required.

Where required by law, we request consent before setting non-essential cookies or using non-essential tracking technologies. You can control cookies through your browser settings, but some features may not work without essential cookies.

Because there is not currently a uniform industry standard for responding to browser-based "Do Not Track" signals, the Services do not currently respond to such signals.

8. Data Retention, Export, and Deletion

We retain personal information for as long as reasonably necessary to provide and secure the Services, fulfill the purposes described in this Privacy Policy, comply with applicable legal and regulatory requirements, maintain appropriate business, safety, and compliance records, resolve disputes, enforce our agreements, and protect our rights and the rights of our customers and users.

Because the Services are designed in part to create and maintain workplace safety, training, inspection, certification, and compliance records, certain records are retained on a long-term or indefinite basis even after an individual account is deleted or an organization's use of the Services ends. This is intended to preserve the integrity and historical record of safety and compliance activities and to support audits, investigations, regulatory requirements, and the establishment, exercise, or defense of legal claims.

Our general retention practices include:

Training, Certification, and Inspection Records. Training records, quiz attempts, certifications, credentials, inspection reports and findings, inspection photographs, corrective-action records, safety documents, and related records may be retained indefinitely as part of the historical safety and compliance record maintained through the Services. Applicable laws, regulations, contractual requirements, or customer requirements may also affect the period for which particular records are retained.

Immutable and Filed Records. Certain records, including audit-log entries, completed quiz attempts, filed documents, and submitted inspection records, may be maintained in an immutable or otherwise restricted format to preserve their integrity and history. These records may not be capable of modification or deletion through ordinary account functionality.

Audit Logs and Security Records. Audit logs and certain access and security records may be retained indefinitely to preserve the historical integrity of activity occurring through the Services and to support security, fraud and abuse prevention, regulatory compliance, dispute resolution, and protection of the Services.

Account Information. We retain account and profile information while an account is active. If an individual deletes an account, we disable access to the account and remove or disassociate certain current profile identifiers, such as the individual's name, email address, telephone number, job title, and certain account credentials or notification identifiers. Account deletion does not necessarily delete historical records associated with the individual, including inspection records, training records, quiz attempts, certificates, previously generated reports or PDFs, payment records, audit logs, or other compliance records. Historical records may continue to contain identifying information where necessary to preserve the integrity of the record.

Uploaded Files and Attachments. Files, photographs, documents, and other materials uploaded to or generated through the Services may be retained with the records to which they relate, including on a long-term or indefinite basis where they form part of a safety, training, inspection, certification, or compliance record.

AI-Assisted Feature Records. Information submitted to or generated through AI-assisted features may be retained for the period reasonably necessary to provide and secure those features, maintain appropriate records, troubleshoot and prevent abuse, and comply with applicable legal and contractual requirements. Information processed by third-party AI service providers may also be subject to their applicable retention practices and our agreements with those providers.

Support, Privacy, and Abuse-Report Records. We retain communications and records relating to customer support, privacy requests, complaints, and reports of suspected fraud or abuse for as long as reasonably necessary to respond to the matter, maintain appropriate business records, establish or defend legal claims, and comply with applicable law.

Diagnostic and Operational Logs. Certain temporary diagnostic and operational logs are retained for shorter periods based on their operational purpose. Current retention periods include approximately 90 days for application diagnostic logs and 14 days for certain internal job-processing logs. These periods may change as our systems and operational requirements evolve.

Information may also remain in backups, archives, or other systems after it is removed from active systems. We may retain information for longer where required or permitted by law, necessary to establish, exercise, or defend legal claims, or reasonably necessary for security, fraud prevention, compliance, or other legitimate business purposes.

Data Export and Privacy Requests. Organizations may request exports of certain records maintained through the Services. Individuals who wish to request access to, correction of, deletion of, or other action regarding their personal information may contact us as described in the "Your Privacy Rights" section below. The availability and scope of a request may depend on applicable law and may be limited where information must or may be retained as part of a historical safety, compliance, transaction, security, or legal record.

9. Security; Security Incidents

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. These safeguards may include authentication controls, organization permissions, private file handling, secure document links, OTP flows, audit logs, monitoring, rate limits, and access controls. No method of transmission or storage is completely secure.

We implement industry-standard security measures to protect your information including:

• All data is encrypted in transit using TLS 1.2 or higher
• Data at rest is encrypted in Supabase using AES-256 encryption
• Row Level Security (RLS) is enforced at the database layer — users can only access data their role permits
• Passwords are hashed using bcrypt — we never store plaintext passwords
• All API keys and secrets are stored as environment variables — never in code or version control
• Access to the admin dashboard is restricted to authorized Safirst Corporation personnel only

If we become aware of a confirmed security incident involving personal information that we are required by applicable law to notify you about, we will provide notice in accordance with applicable law. The timing and content of any notification will take into account the legitimate needs of law enforcement, the scope of the incident, and measures necessary to determine the nature and extent of the incident and restore the integrity of the Services. If you believe your account has been compromised, contact us immediately at privacy@safirst.one.

10. Automated Processing and Artificial Intelligence

AI-Assisted Processing and Automated Systems

We use automated systems to operate, administer, and secure the Services, including to authenticate users, manage permissions and subscriptions, control access to documents and accounts, maintain audit and security logs, send reminders and notifications, process certain requests, and prevent or detect fraud, misuse, or security threats. These routine automated functions do not necessarily involve artificial intelligence.

We also use, and may make available through the Services, artificial intelligence and machine-learning technologies to assist with certain functions. For example, AI-assisted tools may be used to help draft or review workplace safety plans, review regulatory citations or other safety-related content, prepare narrative portions of reports, and perform similar content-generation, review, or analysis functions.

To provide these functions, information processed through the Services may be transmitted to third-party AI service providers acting on our behalf. Depending on the function, this information may include organization and jobsite information, jobsite addresses, scope-of-work information, responses or information provided in connection with safety-plan preparation, employer information, incident descriptions, regulatory text, and other content relevant to the requested or supported function. We design our systems to limit the information provided to an AI service to information reasonably relevant to the applicable function. For example, certain AI-assisted reporting workflows are designed to exclude injured-worker names. However, personal or other sensitive information included within free-text fields may be processed if it is included in content submitted for AI-assisted processing.

Safirst Corporation does not use Customer Data to train general-purpose artificial intelligence models. Third-party AI service providers may process and retain information submitted to them in accordance with our agreements with those providers and their applicable terms and data-processing practices.

Some AI-assisted functionality may be used internally by Safirst personnel rather than being directly available to customers or individual users. We may add, modify, or discontinue AI-assisted functionality as the Services evolve.

AI-generated or AI-assisted content may be inaccurate, incomplete, outdated, duplicative, non-unique, or otherwise unsuitable for a particular purpose. AI-assisted content should be reviewed and evaluated by an appropriately qualified person before it is used or relied upon, particularly in connection with workplace safety, regulatory compliance, or other matters where inaccurate information could create risk. AI-generated or AI-assisted content does not constitute legal, regulatory, safety, tax, accounting, financial, or other professional advice.

We do not use AI-assisted features to make decisions that produce legal or similarly significant effects concerning individuals without human involvement where such involvement is required by applicable law.

11. International Transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers, such as data processing agreements, Standard Contractual Clauses, and similar transfer mechanisms.

12. Your Rights

Depending on your location, you may have rights to:

• Access, correct, or delete your personal information
• Object to or restrict processing
• Data portability
• Withdraw consent (where processing is based on consent)
• Opt out of certain processing, where applicable
• Appeal or complain to a data protection authority, where applicable

To exercise any of these rights, contact us at privacy@safirst.one. We will respond within 30 days. Certain information may not be deleted where retention is required or permitted by applicable law or reasonably necessary to preserve historical safety, compliance, transaction, security, or legal records, as further described in Section 8.

13. Privacy Requests

To exercise privacy rights, submit a privacy request to privacy@safirst.one with the subject line "Privacy Request." We may need to verify your identity before completing a request. If your request concerns Customer Data controlled by an organization, we may direct you to that organization or work with the organization to respond.

We aim to respond to privacy requests without undue delay and, where GDPR or UK GDPR applies, within 1 month unless an extension is permitted by law.

14. Children's Privacy

Our Services are intended for use by adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact us at privacy@safirst.one. We will take appropriate steps to address the information in accordance with applicable law, subject to any legal, safety, compliance, or recordkeeping obligations that may require or permit us to retain certain information.

15. Location Data

The Safirst ONE mobile app requests access to your device's location when you conduct a safety inspection. Location data is used solely to record the GPS coordinates of inspection findings and is not used for advertising or continuous tracking. You may deny location permissions but inspection GPS capture will be unavailable.

16. U.S. State Privacy Notices

If you are a resident of a U.S. state with privacy laws (including, without limitation, California, Colorado, Virginia, Connecticut, or Utah), you may have additional rights under applicable law. We will honor verified requests as required.

For California residents, this may include the right to know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and non-discrimination for exercising privacy rights. We do not sell personal information for money or knowingly share personal information for cross-context behavioral advertising.

The categories of personal information we collect, sources, purposes, disclosures, and retention criteria are described in this Policy.

17. Sensitive Personal Information

Some information entered into the Services may be considered sensitive personal information under applicable law, such as account login information, tax identifiers, payment metadata, precise content of communications, or information users choose to include in attachments, notes, invoice comments, support requests, disputes, or other free-text fields. We use sensitive personal information only as reasonably necessary to provide, secure, support, and improve the Services, comply with law, prevent abuse, and fulfill other purposes described in this Policy.

18. Communications

We may send transactional and service communications, such as account notices, OTP codes, invitations, reminders, support replies, billing notices, security alerts, and legal updates. You may be able to manage some communication preferences in the Services. Essential transactional, security, and legal notices may still be sent where necessary.

19. Aggregated or De-Identified Information

We may create aggregated or de-identified information from Service usage and Customer Data. We may use this information for analytics, product improvement, security, reporting, and other lawful business purposes, provided it does not identify you.

20. Third-Party Links

The Services may contain links to third-party websites or tools. We are not responsible for their privacy practices.

21. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version is effective when posted with a revised Effective Date. Disputes relating to this Privacy Policy are governed by the dispute resolution provisions, including any applicable arbitration agreement and class action waiver, contained in our Terms of Service, except where prohibited by applicable law. Your continued use of our Services after a posted change constitutes acceptance of the updated policy.

22. Contact Us

For privacy questions, data requests, or to report a concern:

• Email: privacy@safirst.one
• Mail: Safirst Corporation, 3820 W Happy Valley Rd, Ste 141-138, Glendale, AZ 85310
• Phone: (602) 373-0393