EmployerSafety Privacy Policy, version 1.1

This Privacy Policy explains what information EmployerSafety, a division of Globaltek LLC ("EmployerSafety," "we," "us"), collects through the EmployerSafety web application and website (the "Service"), how we use it, whom we share it with, and the choices you have. It applies to the businesses that subscribe to the Service ("Customers"), the people they invite to use it ("Users"), and the employees whose records Customers keep in it ("Employees").

1. The short version

• Customers own the data they put in. We use it to run the Service for them and for nothing else.
• We do not sell personal information and we do not use it for advertising.
• Questions asked of the safety assistant, and the records it reads to answer them, are sent to an AI model provider under a contract that forbids the provider from keeping or training on them.
• Employee records are entered by the employer, who controls them. Employees with questions about their records should ask their employer first; we will help either of them on request.
• We keep data only as long as a Customer's account needs it, plus a short export window.

2. Two roles, two responsibilities

For the personal information of Employees and Users inside a Customer's account (names, job titles, departments, training and certification records, uploaded certificates, training attendance, document acknowledgements, questions asked of the assistant), the Customer decides what is collected and why. In privacy-law terms the Customer is the controller (or "business") and EmployerSafety is the processor (or "service provider") acting on its instructions. For the information we collect about Customers and Users to run the Service itself (account details, billing, security logs, support email), EmployerSafety is the controller.

3. What we collect

3.1 Account and user information. Name, work email address, password (stored only as a hash by our authentication provider), role, organization name, industry, state, and the settings you choose. Provided when an account is created or a user is invited.

3.2 Customer Data. Everything a Customer and its Users enter or upload: employee profiles and employment details, training requirements, credentials and certifications with dates, uploaded certificates and sign-in sheets, training sessions and attendance, written safety programs and documents, company profile answers, reminder settings, and questions asked of the safety assistant together with the assistant's answers and the records it read. We collect this only because the Customer chose to enter it. The Service is not designed to hold medical or diagnostic information; Customers should not upload medical records, and expiry dates of required cards or certificates are the only health-adjacent facts the Service asks for.

3.3 Billing information. Plan, worker count, subscription status and invoices. Card numbers are collected and stored by our payment processor, Stripe; we never see or store full card numbers.

3.4 Technical and usage information. IP address, browser and device type, pages and features used, timestamps, and error reports. We keep an audit log of significant actions in each account (who created, changed, approved or acknowledged what, and when), which the Customer's administrators can review. We record the volume of AI usage (tokens and estimated cost) per organization to manage limits and billing; we do not store the content of assistant conversations in that usage record.

3.5 Support. Anything you send us by email when you ask for help.

3.6 Cookies. The Service uses a small number of strictly necessary cookies to keep you signed in and to protect against request forgery. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics.

4. How we use information

To provide the Service: keep your records, compute training status and reminders, answer assistant questions, draft documents you request, send the emails you enable (digests, reminders, invitations, account notices), and support you.

To operate and protect the Service: authenticate users, enforce access controls between organizations, detect abuse, keep audit logs, monitor errors and performance, and meet our legal obligations.

To bill: manage subscriptions, invoices and payment status through Stripe.

To improve the Service: study how features are used, in aggregate or de-identified form. We do not use Customer Data to train AI models.

We do not use personal information to make automated decisions that have legal or similarly significant effects on any individual. Training statuses and reminders are calculations shown to the employer, who decides what to do with them.

5. The safety assistant and AI

When a User asks the assistant a question, the Service sends to an AI model provider: the question, recent turns of the same conversation, excerpts of regulatory text and of the Customer's own approved documents, and, when the question is about the Customer's records, the specific records the Service read to answer it (for example, the names and training statuses of the employees involved). The provider returns an answer, which the Service checks against the sources before showing it.

Our AI provider contract directs the provider not to store prompts or outputs beyond what is needed to return the answer and not to use them to train models. We record the answer, the sources it cited and the records it referenced in the Customer's account, where administrators can review conversations if the Customer turns that setting on; the Service tells Users when it is on.

Document drafts and toolbox talks the assistant produces are stored as drafts in the Customer's document library, labeled as AI-assisted, until a person reviews them.

6. Whom we share information with

We share personal information only with the service providers we need to run the Service, each under a contract limiting its use to our instructions:

We may also disclose information when required by law, subpoena or court order (with notice to the Customer where lawful), to protect the rights, safety or property of EmployerSafety, our Customers or the public, or in connection with a merger, acquisition or sale of assets, in which case this Policy continues to apply until it is changed with notice.

Verification pages your employer turns on. If your employer turns on verification pages, the information your employer chooses to show is visible to anyone who has the QR code or link your employer issued. That information is your name, your job title, your employer's name, and the certifications and licenses on file, with dates, status and the last four characters of any number. If your employer allows it, it also includes copies of certificates and required-training status. Medical information, drug and alcohol testing records and DOT driver files are never shown. Your employer controls these codes and can retire them at any time. Ask your employer about any code issued for you. We record how many times a code is scanned and when it was last scanned, but not who scanned it.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7. Employees and Users: your rights and how to use them

If you are an Employee whose records are in the Service, your employer controls those records. To see, correct or delete them, ask your employer; we will help your employer respond. If you are a User with an account, you can update your name and email in the Service and can ask your organization's administrator to remove your access.

Residents of states with comprehensive privacy laws (for example California, Colorado, Connecticut, Texas, Virginia and others) may have rights to access, correct, delete or obtain a copy of personal information, to opt out of sale or targeted advertising (we do neither), and not to be discriminated against for exercising those rights. For information we control (section 2), send requests to service@globaltek.ai; we will verify the request and respond within the time the applicable law allows. For information a Customer controls, we forward the request to the Customer.

8. Security

We protect information with encryption in transit (TLS) and at rest, row-level isolation of each organization's data in the database, role-based access inside each organization, least-privilege service accounts, private file storage with short-lived download links, audit logging, and administrative alerts on errors. Access to production systems is limited to the people who operate the Service. No method of transmission or storage is completely secure; if we learn of a breach affecting your information we will notify affected Customers without unreasonable delay and as the law requires.

9. Retention

Account and Customer Data: for the life of the Customer's subscription, then 30 days for export, then deletion from active systems; backups age out within 35 days after that. Audit logs: 24 months, or longer where the Customer's own retention obligations require and the Customer asks. Billing records: as long as tax and accounting law requires (generally seven years). Support email: 24 months. Technical logs: 90 days. Employers should note that occupational safety regulations may require them to keep certain training and medical records for set periods; the Service's retention does not replace those obligations, and Customers should export what they must keep before closing an account.

10. Children

The Service is for businesses and their adult users. We do not knowingly collect personal information from children under 13, and Users must be at least 18. An employer may keep training records for employees under 18 as part of its workforce records; those employees are not Users.

11. Where data is processed

The Service is hosted in the United States and intended for United States employers. If you use it from elsewhere, you understand your information is processed in the United States.

12. Changes to this Policy

We may update this Policy. The current version is always available in the Service with its effective date. For material changes we will notify account administrators by email at least 30 days before they take effect.

13. Contact

EmployerSafety, a division of Globaltek LLC
Office: 1640 Lelia Drive, Suite 105, Jackson, MS 39216
Mailing address: P.O. Box 1955, Brandon, MS 39042
service@globaltek.ai
463-777-2333