This policy explains what Oversite Reports collects, why, who else touches it, and what you can do about it. Oversite Technologies operates the Service.
Your name, email address and password credentials, handled by our authentication provider Clerk. We never see your password.
Handled entirely by Stripe. We receive your subscription status, seat count, billing period and the last four digits of your card for display. We never receive or store your full card number.
Server logs of requests to our backend, including IP address, timestamp and the operation requested, kept for security and troubleshooting. We do not run advertising trackers or third-party analytics.
Much of what you record is about people who aren't our customers: your crew, a general contractor's superintendent who signs a ticket, a delivery driver on a receipt.
For that information you decide what is collected and why, and we process it on your behalf under your instructions. Please only record what you actually need, tell people what you're recording where the law requires it, and remove records you no longer need. If someone asks us directly to remove information you entered about them, we'll refer them to you and let you know.
Oversite Reports may process and store workplace safety and incident information submitted by authorized users, including injury-related information and attachments. Such records are stored to provide reporting, retention, synchronization and authorized company access. Access is limited according to account permissions and organizational roles.
In practice that means: these records sync to your account and are retained so your company keeps them — many employers are required to retain workplace injury records for five years after the year they cover, and a record that exists only on one phone is a record you can lose. They are not included in the published-document feed that read-only office viewers browse, and attachments such as scene photographs carry the same restriction.
You remain responsible for deciding what to record, for handling it lawfully, and for telling the people concerned where the law requires. If you're subject to specific obligations for employee medical records, satisfy yourself that recording them here meets them before you do. You can export a complete copy of your records at any time, and nothing is deleted because a subscription lapsed.
| Purpose | What it covers |
|---|---|
| Running the Service | Storing your records, syncing them between your devices, generating PDFs, collecting signatures, sharing documents by link |
| Billing | Taking payment, sending invoices, managing your subscription |
| Form conversion | Turning a blank form you upload into a digital one — only when you use that feature |
| Support | Answering you when you contact us, and diagnosing a problem you report |
| Security and legal | Preventing abuse, and complying with a valid legal obligation |
We do not process your data for advertising, profiling, resale, or AI model training.
We use a small number of providers to run the Service. Each receives only what it needs.
| Provider | What it does | What it sees |
|---|---|---|
| Netlify | Hosting and cloud storage | Your synced records, photos and published PDFs |
| Clerk | Login and accounts | Your name, email and credentials |
| Stripe | Payments | Your name, email and payment details |
| Anthropic | AI for form conversion and reading a crew list from a photo | Only the specific document or image you submit for that purpose |
| Resend | Notification email, where enabled | Recipient email addresses and the notification text |
We don't sell your data, and we don't share it with anyone else except where you ask us to (sending a document to someone), or where a valid legal process requires it — in which case we'll tell you unless we're prohibited from doing so.
On servers in the United States. If you use the Service from outside the US, your information is transferred there.
| Data | Kept |
|---|---|
| Your documents and photos, while your account is open | Until you delete them |
| After you cancel a subscription | Kept indefinitely and still exportable — cancelling never deletes anything |
| After you ask us to delete your account | Removed from live systems within 30 days and from the independent backup within 90 days. Finalised documents that were placed in immutable preservation storage are the exception: those copies are retained for the preservation period (up to seven years from preservation) and cannot be removed earlier, by us or by anyone, because that is what makes them evidence; they are not accessible through the Service after your account is deleted |
| Documents you delete yourself | Moved to Deleted Documents, where you can restore them, together with their history, signatures and photos. Nothing you delete is destroyed by the app; permanent destruction is a separate administrative act on your request, is recorded, and does not reach copies already in immutable preservation |
| Workplace injury and incident records | Retained for the life of the account and exportable at any time — never removed automatically, including if a subscription lapses |
| Signing links | Expire 14 days after being sent, and are single-use |
| Server logs | 90 days |
| Billing records | 7 years, as tax law requires |
Email hello@oversitereports.com from your account address and ask us to delete it. We'll confirm, give you a chance to export first, and then delete as set out above. Billing records we're legally required to keep are the exception.
Deletion is permanent. Export a Project Archive for anything you need first — we can't get it back afterwards.
You can ask us to give you a copy of your data, correct it, or delete it, and you can object to how we use it. Most of this you can do yourself in the app: every project exports a complete archive, and documents and crew records can be edited or removed directly. For anything else, email us and we'll respond within 30 days.
Depending on where you live you may have additional rights — for example under the California Consumer Privacy Act or, if you're in the UK or EU, under the UK GDPR or GDPR. We honour those rights regardless of where you are. We don't sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.
Data travels over HTTPS and is stored encrypted at rest by our providers. Your cloud records are stored under your own account identifier and the server verifies your identity on every request. Read-only office viewers you invite can see only the finished PDFs you publish, never your drafts, your crew records, or any restricted document such as an injury report — that restriction is enforced on our servers, not only in the app.
No system is perfectly secure. If a breach affects your data we'll tell you promptly and explain what happened.
The Service is for people working in construction and is not directed at anyone under 18. We don't knowingly collect information from children. If you believe a child's information has been recorded, contact us and we'll remove it.
We may update this policy. For material changes we'll give at least 30 days' notice by email or in the app, and the date at the top always shows the current version.
Oversite Technologies
hello@oversitereports.com
See also the Terms of Service.