Privacy Policy

1. Our Role

OSHA Guidance is a business service used by organizations and authorized users to conduct compliance research. When a customer organization submits questions, workplace facts, report metadata, or other content, that organization controls the content it chooses to provide. We process that content to provide, maintain, secure, and support the Service.

For account information about users who sign in to the Service, such as email address, organization membership, role, and authentication records, we act as the business or controller responsible for operating the Service.

2. Information We Collect

Account information

We collect information needed to create and manage user accounts, including email address, organization, role, authentication status, invite status, password-reset status, and related account-administration details. Passwords are handled through our authentication provider and are not stored by us in plain text.

Research content

We store or process the OSHA research content users submit or generate through the Service. This may include questions, selected jurisdiction, employer sector, industry, guided workflow responses, answer snapshots, citations, caveats, source coverage indicators, and answer history.

PDF report metadata

When a user exports a PDF research memo, the Service may process optional report metadata such as company or organization name, location, jobsite, prepared-by name, and reviewed-by name. PDF files are generated for immediate download and are not stored by the application unless we later state otherwise in the Service or in a written agreement.

Usage and technical logs

We collect routine technical information such as IP address, browser and device information, timestamps, session events, error diagnostics, security logs, and administrative activity needed to operate and protect the Service.

Cookies and similar technologies

The Service uses cookies and similar technologies that are necessary for authentication, session management, security, and application functionality. We do not use advertising cookies, third-party analytics cookies, or cross-site behavioral tracking cookies in the current Service. Disabling necessary cookies may prevent sign-in or core application features from working.

Communications

If you contact us for support, sales, legal, or privacy questions, we collect the contact details and message content needed to respond and maintain business records.

3. Information Customers Should Not Submit

The Service is not designed to collect highly sensitive personal information. Customers and users should not submit Social Security numbers, driver's license numbers, passport numbers, financial account numbers, protected health information under HIPAA, medical or workers' compensation details, union membership, immigration documents, precise geolocation data, or other sensitive personal information unless we have expressly agreed to that use in writing.

Users should also avoid placing confidential incident details, trade secrets, or personally identifying employee facts into OSHA research questions unless the customer has determined that doing so is appropriate and lawful.

4. How We Use Information

• Provide, maintain, secure, and support the Service.
• Authenticate users and enforce organization-level access controls.
• Generate OSHA research answers, citations, source coverage indicators, and PDF research memos.
• Save answer history for the signed-in user where that feature is enabled.
• Monitor source coverage, ingestion health, security events, and application reliability.
• Respond to support, sales, legal, security, and privacy requests.
• Comply with law, enforce our agreements, and protect the Service from misuse.
• Improve the Service using aggregated or de-identified information that does not reasonably identify an individual or customer.

We do not sell personal information, share personal information for cross-context behavioral advertising, or use customer research content for advertising. We do not use customer research content to train artificial intelligence models controlled by Clever Solutions for use outside the Service.

5. AI-Assisted Research Processing

Some OSHA Guidance features may use third-party artificial intelligence or model providers to generate research summaries from user questions, selected workplace facts, and retrieved or curated source material. Those providers process the submitted content only as needed to operate the AI-assisted feature and under the provider terms or contracts applicable to the Service.

Because OSHA answers can involve legal, regulatory, and site-specific judgment, users should avoid submitting unnecessary personal information and should review all AI-assisted outputs before relying on them.

6. How We Share Information

• Within the Service. Answer history is tied to the signed-in user. Authorized customer or platform administrators may manage accounts, organization membership, and access to the Service.
• Service providers. We use trusted providers for authentication, database services, hosting, email delivery, AI-assisted processing, security, logging, and support. Current providers include services such as Supabase, Vercel, OpenAI or other model providers when enabled, and Mailgun.
• Legal and safety. We may disclose information when we believe disclosure is required by law, legal process, or to protect the rights, property, security, or safety of Clever Solutions, our customers, users, or others.
• Business transfers. Information may be transferred in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to reasonable confidentiality protections.

7. Data Location and Storage

The Service is intended for use by customers in the United States. Account information, customer research content, answer snapshots, and operational logs may be stored or processed using managed cloud services in the United States and other locations where we or our service providers operate, subject to appropriate safeguards.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information in the Service. These measures include encryption in transit, authentication controls, role-based administrative access, server-side authorization checks, tenant-aware data access, restricted service credentials, and monitoring of operational and source-ingestion health.

No system can be guaranteed to be perfectly secure. Customers are responsible for managing their authorized users, protecting credentials, and promptly disabling access for users who no longer need the Service.

9. Retention

We retain account information and customer research content for as long as needed to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, and maintain reasonable business records. Users may clear their answer history where the Service provides that feature. Upon termination of a customer account, we will delete customer research content within a commercially reasonable period, except that residual copies may remain in backup media for a limited retention cycle or where retention is required by law.

Customers are responsible for exporting and retaining OSHA research memos, citations, answer history, and related records as needed for their own legal, regulatory, insurance, employment, and business requirements.

10. Your Rights and Choices

Depending on where you reside, you may have rights to access, correct, delete, restrict, or receive a copy of personal information. If your account is managed by your employer or another customer organization, please contact that organization first. You may also contact us using the information below, and we will support customers in responding to applicable privacy requests.

11. Children

The Service is intended for business use and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided personal information through the Service, contact us and we will take appropriate steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Service, by email to customer administrators, or by another commercially reasonable method. The updated policy will apply from the effective date stated on the page.

13. Contact Us

Questions or requests about this Privacy Policy may be directed to: