Effective date: July 6, 2026
Operated by: BBC Services INC ("we", "us"), British Columbia, Canada
Contact: minh@aihseauditor.com
1. What this policy covers
This policy describes how we collect, use, and protect personal information when you use aihseauditor.com (the "Service"). We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, British Columbia's Personal Information Protection Act (PIPA).
2. Information we collect
- Account information: name, email address, company, and a password (stored only as a hash by our authentication provider; we never see your password).
- Uploaded documents: HSE documents you submit for assessment (e.g., incident investigation reports, risk assessments, audit findings, job briefings). These documents may contain personal information about individuals named in them.
- Payment information: processed entirely by Stripe. We do not store card numbers.
- Usage data: assessment history, timestamps, and technical logs necessary to operate the Service.
3. How we use uploaded documents
- Documents are analyzed by an AI model to produce a quality assessment.
- Every assessment is reviewed by a qualified human auditor before delivery. This means a member of our team (currently the Lead Auditor) views your document content as part of the review process.
- Documents and assessment results are used solely to deliver the Service to you.
- We do not use your documents to train AI models. Our AI provider (Anthropic) does not train its models on data submitted through its API.
- We may derive anonymized, non-identifying reference data (for example, generic hazard and control phrasings with all names, companies, locations, and identifying details removed) to improve assessment consistency. No personal information and no client-identifiable content is retained in such reference data.
4. Your responsibility for document content
You are responsible for ensuring you have the right to upload the documents you submit. We strongly recommend anonymizing personal information (names of injured persons, witnesses, and similar details) before upload where it is not necessary for the assessment.
5. Service providers (subprocessors)
We use the following providers to operate the Service. Each processes data only as needed to perform its function:
- Anthropic (AI analysis, USA)
- Supabase (database and authentication, US East / N. Virginia, USA)
- Vercel (web hosting, USA)
- Railway (backend hosting, USA)
- Stripe (payments)
- Resend (transactional email)
- Cloudflare (DNS and email routing)
Some providers store data outside Canada. By using the Service you consent to this transfer, which is protected by contractual safeguards with each provider.
6. Retention and deletion
- Uploaded documents and assessment results are retained while your account is active, so you can access your assessment history.
- You may request deletion of any document or your entire account at any time by emailing minh@aihseauditor.com. We delete the data within 30 days, except records we must retain for legal, tax, or billing purposes.
7. Security
Data is encrypted in transit (TLS) and at rest by our hosting providers. Access to customer documents is restricted to personnel who need it to deliver the Service. No method of transmission or storage is completely secure, but we take commercially reasonable measures to protect your information.
8. Your rights
Under PIPEDA you may request access to, correction of, or deletion of your personal information, and may withdraw consent (which may limit our ability to provide the Service). Contact minh@aihseauditor.com. You may also file a complaint with the Office of the Privacy Commissioner of Canada.
9. Changes
We will post any changes to this policy on this page and update the effective date. We will notify you of material changes by email.