Back to Home

Privacy Policy

Last Updated: January 2025

1. Introduction

WorkSafe Log ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our workplace incident documentation platform.

By using WorkSafe Log, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address (for authentication and communication)
  • Password (encrypted and never stored in plain text)
  • TOTP secret (for two-factor authentication, encrypted)
  • Account creation date and last login timestamp
  • Theme preferences (light/dark mode)

2.2 Incident Documentation Data

When you document incidents, we collect:

  • Incident details: title, description, date, category, status
  • Narrative information: headline, objective account, subjective reflection, personal notes
  • Classification data: severity, impact, escalation details
  • Reporting information: reported dates, channels, management responses, follow-up dates
  • Metadata: creation timestamps, update timestamps, lock status

2.3 People Records

When you add people to your incidents, we collect:

  • Display names (can be real names or pseudonyms)
  • Contact information: email, phone (optional)
  • Organizational details: title, department (optional)
  • Relationship to you (e.g., supervisor, colleague, witness)

2.5 AI-Generated Data

When you use AI features, we collect:

  • Vector embeddings (768-dimensional semantic representations of incident content)
  • Content hashes (to detect changes and trigger re-embedding)
  • AI interaction logs (for quality improvement)

3. How We Use Your Information

3.1 Primary Purposes

We use your information to:

  • Provide the Service: Enable incident documentation, storage, and retrieval
  • Authenticate you: Verify your identity and secure your account with 2FA
  • Generate reports: Create PDF, DOCX, and JSON exports with your selected redaction level
  • Enable sharing: Generate one-time access links for authorized sharing
  • Power AI features: Provide legal tone revision, PII detection, and related incident detection

3.2 Use of Non-Personal Data

We may use aggregated, anonymized, and non-personal data for:

  • Market research and analytics: To understand usage patterns and improve our services
  • Promotional purposes: To create aggregated statistics and insights about platform usage
  • Product development: To identify features and improvements based on user behavior

Important: This non-personal data does not identify you individually and does not include your incident content, personal information, or any data that can be traced back to you. We will never sell or share your personal data or incident documentation with third parties.

3.3 AI Processing

We use Google Gemini API to:

  • Revise tone: Convert emotional language to professional, legal-appropriate language
  • Detect PII: Identify personally identifiable information for redaction recommendations
  • Find patterns: Generate embeddings to detect related incidents and recurring patterns

Important: Your incident content is sent to Google Gemini API for processing. Google's privacy policy applies to this processing. We do not use your data to train AI models.

4. How We Share Your Information

4.1 We DO NOT Sell Your Data

We will never sell, rent, or trade your personal information to third parties for marketing purposes.

4.2 Sharing with Third-Party Services

We share data with the following service providers who process it on our behalf:

Supabase (Database and Storage)

  • What we share: All user data, incidents, persons, attachments, audit logs
  • Why: Database hosting, file storage, authentication
  • Privacy Policy: https://supabase.com/privacy

Google Gemini API (AI Processing)

  • What we share: Incident content (title, description, narrative) for AI analysis
  • Why: Legal tone revision, PII detection, vector embeddings
  • Privacy Policy: https://policies.google.com/privacy

Vercel (Hosting and Deployment)

4.3 Sharing via User-Generated Links

When you create shared access links:

  • Recipients can view the specific incident you shared
  • Personal notes are NEVER shared (always excluded from shared views)
  • Recipients see data according to the redaction level you selected
  • Access is revoked when the link expires or you delete it

6. Data Security

6.1 Encryption

  • In transit: All data transmitted using TLS 1.2+ encryption
  • At rest: Database encryption enabled in Supabase
  • TOTP secrets: Encrypted before storage using AES-256
  • Passwords: Hashed using bcrypt with salt

6.2 Access Controls

  • Two-factor authentication: Required for all accounts (TOTP)
  • JWT tokens: Short-lived (15 minutes), securely signed
  • Database isolation: Row-level security policies enforce user data separation
  • API authentication: All API endpoints verify JWT tokens
  • User ID filtering: All queries filtered by authenticated user ID

7. Your Privacy Rights

7.1 Access and Portability (GDPR Article 15, 20)

You have the right to:

  • Access your data: View all personal information we hold about you
  • Export your data: Download incidents in JSON, PDF, or DOCX format
  • Receive a copy: Request a complete copy of your data in machine-readable format

7.3 Erasure / Right to be Forgotten (GDPR Article 17)

You have the right to:

  • Delete your account: Permanently remove all data (30-day grace period)
  • Delete specific incidents: Remove individual incident records
  • Delete attachments: Remove uploaded files from storage

7.7 CCPA Rights (California Residents)

California residents have additional rights:

  • Know: What personal information we collect and how it's used
  • Delete: Request deletion of your personal information
  • Opt-out: Opt out of the "sale" of personal information (we don't sell data)
  • Non-discrimination: We will not discriminate against you for exercising your rights

7.8 Exercising Your Rights

To exercise any of these rights:

  • Email us: privacy@worksafelog.com
  • Use the app: Most rights can be exercised directly in Settings
  • Expected response time: 30 days maximum

8. Redaction and Anonymization

8.1 Redaction Levels

When exporting or sharing, you can choose:

None (Full Disclosure)

  • All information included exactly as entered
  • Personal notes included in exports (never in shared links)

Anonymize People (Default for HR)

  • Names replaced with roles (e.g., "Supervisor A", "Witness 1")
  • Contact information (email, phone) removed
  • Department and title preserved
  • Incident content unchanged

Anonymize All PII

  • All names replaced with roles
  • All contact information removed
  • Locations and identifying details redacted
  • AI-detected PII removed or masked

8.3 Personal Notes Protection

  • Personal notes are NEVER included in shared access links
  • Personal notes are only included in exports if you explicitly select "Full Disclosure"
  • Personal notes are always encrypted at rest

13. Contact Information

13.1 Privacy Questions

For privacy-related questions or concerns:

Email: privacy@worksafelog.com

Response time: Within 5 business days

Summary: Your Data, Your Control

What we collect: Account info, incidents, people records, attachments, AI-generated data, usage logs

How we use it: Provide the service, generate reports, enable sharing, power AI features, improve security, and use anonymized non-personal data for market research and analytics

How we protect it: Encryption (in transit and at rest), 2FA, JWT authentication, database isolation, audit logging

Your rights: Access, rectify, delete, export, restrict processing, object to processing

Third parties: Supabase (hosting), Google Gemini (AI), Vercel (deployment) - we don't sell your data

Contact: privacy@worksafelog.com for any privacy concerns

By using WorkSafe Log, you acknowledge that you have read and understood this Privacy Policy.

Read our Terms of Service