Skip to main content
SpreadTrace by Ironclad Digital

Privacy Policy

Our privacy policy and how we use your data

Effective date: {{EFFECTIVE_DATE}}

This is the pilot-stage privacy policy. The platform is currently available to a limited group of partner-investor pilots. A revised policy reviewed by counsel will be published before broader release.

1. Who we are

{{OPERATOR_DBA}} (the “Platform”) is a business-to- business pipeline construction inspection and reporting tool operated by {{OPERATOR_LEGAL_NAME}} (“we,” “us,” or “Operator”), a {{OPERATOR_JURISDICTION}} entity. We provide the Platform under a written agreement with the pipeline contractor or service provider that subscribes (the “Customer”).

2. Our role with your data

For most data on the Platform, the Customer is the data controller and we are the data processor acting on the Customer’s instructions. If you are an employee, inspector, welder, contractor, or client representative whose information is entered into the Platform, your privacy rights flow primarily through your employer or the Customer that controls the project you work on. Contact your employer or the Customer first for access, correction, or deletion requests.

For account-level data (Customer admin contact details, billing information, system logs, security event records), we are the controller.

3. What we collect

From Customer admins

  • Name, email address, mobile number, role assignment.
  • Authentication metadata (sign-in time, IP address, user-agent string, multi-factor authentication state).
  • Audit-log entries for administrative actions taken in the Platform.

From inspectors and field workers

  • Name, email address, mobile number, role assignment, project assignments.
  • Inspection-report content authored or edited by you, including free-text descriptions, photographs, document attachments, and GPS coordinates of work locations.
  • Acknowledgment timestamps when you receive and acknowledge published safety reports.

From welders and pipeline workers (entered by the Customer)

  • Name, employee identifier, qualification certifications.
  • Drug-test result status (Pass / Fail / N/A) when the Customer configures and uploads it. Visibility of this field is restricted within the Platform.
  • Welder qualification expiration dates.

From client representatives

  • Name, email address, phone number.
  • Acknowledgment receipts when notified about safety events on projects where you are the client.

About incidents

  • Free-text descriptions of near-miss events, good catches, unsafe conditions, and unsafe acts. These descriptions may embed names of witnesses, victims, or third parties.
  • Photographs and document attachments of incident sites and evidence.
  • GPS coordinates and time stamps.

4. Why we collect it

  • To provide and operate the Platform.
  • To support the Customer’s safety, quality, and record-keeping programs.
  • To produce audit-trail evidence required by industry standards and regulations such as DOT 49 CFR Parts 192 and 195.
  • To send sign-off notifications to designated recipients when the Customer publishes a report.
  • To detect and prevent abuse of the Platform (rate limiting, security event logging).
  • To improve reliability, fix bugs, and respond to support requests.

5. Who we share data with

We share data only with subprocessors that are necessary to operate the Platform. The current subprocessor list is published at {{SITE_URL}}/subprocessors and is updated when subprocessors are added or removed.

We do not sell your data. We do not share your data with third-party advertising networks or analytics brokers. We share data with the Customer that employs you (because they are the data controller) and with their authorized administrators.

6. Where data lives and how long we keep it

Platform data is stored in databases located in the United States. The default retention is the project lifetime plus seven years for inspection records, consistent with common industry record-keeping practice. The Customer may instruct us to apply a longer retention or, where lawful, a shorter retention.

Account-level data (admin profiles, audit log) is retained while the account is active and for a reasonable wind-down period after termination. Notable audit-log entries (role changes, published reports, sign-off events) are retained for the full account lifetime.

7. How we secure data

  • All connections use HTTPS with HSTS. The database and storage layers are encrypted at rest by our hosting provider.
  • Each Customer’s data is isolated by row-level security policies on every tenant-scoped table.
  • Multi-factor authentication is supported for all roles and required for the highest-privilege roles.
  • All administrative actions are recorded in an append-only audit log. Soft deletion of audit entries is restricted to tenant administrators acting through a constrained server-side function and is itself logged.
  • Acknowledgment URL tokens expire 30 days after notification creation.
  • We retain incident-response procedures and notify the Customer in writing in the event of a security incident affecting their data, on the timelines required by the Customer’s data processing agreement and applicable law.

8. Your rights

Depending on your jurisdiction and your relationship to the Customer, you may have rights to access, correct, delete, port, or restrict the processing of personal information about you. To exercise these rights, please contact the Customer first (typically your employer or the contracting party that invited you to the Platform). If the Customer cannot resolve your request, contact us at {{OPERATOR_CONTACT_EMAIL}} and we will assist the Customer in responding.

California residents covered by the CCPA / CPRA have additional rights including the right to know what personal information is collected and the right to request deletion. We do not sell or share personal information for cross-context behavioral advertising.

9. Children

The Platform is intended for use by adult workers in a professional setting. We do not knowingly collect data from anyone under 16.

10. Changes to this policy

We will update this policy as the Platform matures. Material changes will be communicated to Customer admins by email and the updated effective date will appear at the top of this page. Continued use of the Platform after notification constitutes acceptance of the updated policy.

11. Contact

Questions, concerns, or requests can be sent to {{OPERATOR_CONTACT_EMAIL}}.

This pilot-stage policy is provided for transparency during the partner-investor pilot. It will be replaced by an attorney-reviewed version before general availability. If a conflict arises between this page and the attorney-reviewed version of the policy, the attorney-reviewed version controls.