EmployerSafety Privacy Policy

This Privacy Policy explains what information EmployerSafety, a division of Globaltek LLC ("EmployerSafety," "we," "us"), collects through the EmployerSafety web application and website (the "Service"), how we use it, whom we share it with, and the choices you have. It applies to the businesses that subscribe to the Service ("Customers"), the people they invite to use it ("Users"), and the employees whose records Customers keep in it ("Employees").

1. The short version

• Customers own the data they put in. We use it to run the Service for them and for nothing else.
• We do not sell personal information and we do not use it for advertising.
• Questions asked of the safety assistant, the records it reads to answer them, and the pages of files you upload to import are sent to an AI model provider. We send them with settings that tell the provider not to log them and to route only to model hosts that do not retain or train on data, and we have not opted in to any storage. See section 5.
• Employee records are entered by the employer, who controls them. Employees with questions about their records should ask their employer first; we will help either of them on request.
• We keep data only as long as a Customer's account needs it, plus a short export window.

2. Two roles, two responsibilities

For the personal information of Employees and Users inside a Customer's account (names, job titles, departments, training and certification records, uploaded certificates, training attendance, document acknowledgements, job assignments, scans of signed paper sheets, completed forms, questions asked of the assistant), the Customer decides what is collected and why. In privacy-law terms the Customer is the controller (or "business") and EmployerSafety is the processor (or "service provider") acting on its instructions. For the information we collect about Customers and Users to run the Service itself (account details, billing, security logs, support email), EmployerSafety is the controller.

3. What we collect

3.1 Account and user information. Name, work email address, password (stored only as a hash by our authentication provider), role, organization name, industry, state, and the settings you choose. Provided when an account is created or a user is invited.

3.2 Customer Data. Everything a Customer and its Users enter or upload: employee profiles and employment details, training requirements, credentials and certifications with dates, uploaded certificates and sign-in sheets, training sessions and attendance, written safety programs and documents, jobs and job sites (names and addresses), crew assignments, documents and site rules linked to a job, acknowledgments (including scans of signed paper sheets, which show signatures), completed forms uploaded to a job, files uploaded for import and what was read from them, DOT driver file records (dates and notes), company profile answers, reminder settings, and questions asked of the safety assistant together with the assistant's answers and the records it read. We collect this only because the Customer chose to enter it. The Service is not designed to hold medical or diagnostic information. Customers should not upload medical records, or injury and illness records such as OSHA Form 300 (Log of Work-Related Injuries and Illnesses), Form 300A (Summary of Work-Related Injuries and Illnesses) and Form 301 (Injury and Illness Incident Report), as forms or files. The only health-adjacent facts the Service asks for are expiry dates of required cards or certificates and, for DOT drivers, the dates of medical certificates, drug and alcohol tests and Clearinghouse queries. The Service records that a test or query happened and when, not its result.

3.3 Billing information. Plan, worker count, subscription status and invoices. Card numbers are collected and stored by our payment processor, Stripe; we never see or store full card numbers.

3.4 Technical and usage information. IP address, browser and device type, pages and features used, timestamps, and error reports. We keep an audit log of significant actions in each account (who created, changed, approved or acknowledged what, and when), which the Customer's administrators can review. When a User accepts the Terms and this Policy, we record the version, the time and the IP address. We record the volume of AI usage (tokens and estimated cost) per organization to manage limits and billing; we do not store the content of assistant conversations in that usage record.

3.5 Support. Anything you send us by email or through Help & feedback in the Service, with the page you were on when you sent it, when you ask for help.

3.6 Demo requests. When someone asks for a demonstration on our website: name, company, work email, phone, workforce size and message. To limit abuse we keep a one-way hash of the IP address, not the address itself.

3.7 Cookies. The Service uses a small number of strictly necessary cookies to keep you signed in and to protect against request forgery. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics.

4. How we use information

To provide the Service: keep your records, compute training status and reminders, answer assistant questions, draft documents you request, send the emails you enable (digests, reminders, invitations, account notices) and the legal notices described in section 12, which are sent whatever your email settings, and support you.

To operate and protect the Service: authenticate users, enforce access controls between organizations, detect abuse, keep audit logs, monitor errors and performance, and meet our legal obligations.

To bill: manage subscriptions, invoices and payment status through Stripe.

To improve the Service: study how features are used, in aggregate or de-identified form. We do not use Customer Data to train AI models.

We do not use personal information to make automated decisions that have legal or similarly significant effects on any individual. Training statuses and reminders are calculations shown to the employer, who decides what to do with them.

5. The safety assistant, import and AI

When a User asks the assistant a question, the Service sends to an AI model provider: the question, recent turns of the same conversation, excerpts of regulatory text and of the Customer's own approved documents, and, when the question is about the Customer's records, the specific records the Service read to answer it (for example, the names and training statuses of the employees involved). The provider returns an answer, which the Service checks against the sources before showing it.

When a User uploads files to import training records or written programs, or to read a sign-in sheet, the Service sends each page to an AI model provider: an image of a scanned page, or the text of a page that has text. The provider returns what it reads, the Service checks it, and a person reviews and approves it before anything becomes a record. Pages of a written program that already contain text are read without sending them to the provider.

We use a routing provider, OpenRouter, to reach AI models. Its published terms say it does not store prompts or completions unless the customer opts in, and we have not opted in. Each request we send is marked to route only to model hosts that OpenRouter classifies as not retaining or training on data. We rely on those published terms and classifications; we do not have a separate written agreement with the provider or the hosts, and we do not audit them ourselves. If that changes we will update this Policy.

We record the answer, the sources it cited and the records it referenced in the Customer's account, where administrators can review conversations if the Customer turns that setting on; the Service tells Users when it is on.

Document drafts and toolbox talks the assistant produces are stored as drafts in the Customer's document library, labeled as AI-assisted, until a person reviews them.

6. Whom we share information with

We share personal information only with the service providers we need to run the Service:

We rely on these providers under their published terms and, where they offer one, their data processing addendum, which limit their use of the data to providing their service to us.

We may also disclose information when required by law, subpoena or court order (with notice to the Customer where lawful), to protect the rights, safety or property of EmployerSafety, our Customers or the public, or in connection with a merger, acquisition or sale of assets, in which case this Policy continues to apply until it is changed with notice.

Verification pages your employer turns on. If your employer turns on verification pages, the information your employer chooses to show is visible to anyone who has the QR code or link your employer issued. That information is your name, your job title, your employer's name, and the certifications and licenses on file, with dates, status and the last four characters of any number. If your employer allows it, it also includes copies of certificates and required-training status. A page for a work location or a job also shows the site's name and address and lists the employees assigned there. Medical information, drug and alcohol testing records and DOT driver files are never shown. Your employer controls these codes and can retire them at any time. Ask your employer about any code issued for you. We record how many times a code is scanned and when it was last scanned, but not who scanned it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7. Employees and Users: your rights and how to use them

If you are an Employee whose records are in the Service, your employer controls those records. To see, correct or delete them, ask your employer; we will help your employer respond. If you are a User with an account, you can update your name and email in the Service and can ask your organization's administrator to remove your access.

Residents of states with comprehensive privacy laws (for example California, Colorado, Connecticut, Texas, Virginia and others) may have rights to access, correct, delete or obtain a copy of personal information, to opt out of sale or targeted advertising (we do neither), and not to be discriminated against for exercising those rights. For information we control (section 2), send requests to service@globaltek.ai; we will verify the request and respond within the time the applicable law allows. For information a Customer controls, we forward the request to the Customer.

8. Security

We protect information with encryption in transit (TLS) and at rest, row-level isolation of each organization's data in the database, role-based access inside each organization, least-privilege service accounts, private file storage with short-lived download links, audit logging, and administrative alerts on errors. Access to production systems is limited to the people who operate the Service. No method of transmission or storage is completely secure; if we learn of a breach affecting your information we will notify affected Customers without unreasonable delay and as the law requires.

9. Retention

Account and Customer Data: for the life of the Customer's subscription, then 30 days for export, then deletion from active systems; backups age out within 35 days after that. Audit logs: 24 months, or longer where the Customer's own retention obligations require and the Customer asks. Billing records: as long as tax and accounting law requires (generally seven years). Support requests and email: 24 months. Records of acceptance of the Terms and this Policy, and of the legal notices we send: as long as needed to show the agreement and the notice, including after an account closes. Technical logs: 90 days. Employers should note that occupational safety regulations may require them to keep certain training and medical records for set periods; the Service's retention does not replace those obligations, and Customers should export what they must keep before closing an account.

10. Children

The Service is for businesses and their adult users. We do not knowingly collect personal information from children under 13, and Users must be at least 18. An employer may keep training records for employees under 18 as part of its workforce records; those employees are not Users.

11. Where data is processed

The Service is hosted in the United States and intended for United States employers. If you use it from elsewhere, you understand your information is processed in the United States.

12. Changes to this Policy

We may update this Policy. The current version is always available in the Service with its effective date. For material changes we will notify account administrators by email at least 30 days before they take effect. The Service also asks each User to accept a new version before continuing to use it after the effective date, and an administrator may accept it earlier on behalf of the organization.

13. Contact

EmployerSafety, a division of Globaltek LLC
Office: 1640 Lelia Drive, Suite 105, Jackson, MS 39216
Mailing address: P.O. Box 1955, Brandon, MS 39042
service@globaltek.ai
463-777-2333