Privacy Policy

1. Who we are

ENSURE ("we", "us") provides cloud-based Health, Safety & Environment (HSE) management software. This policy explains how we handle personal data of users of our platform and visitors to our website.

If you have any questions, contact us at privacy@ensureqhse.com.

2. Data we collect

Account data

Name, email address, role, and company you are associated with
Authentication credentials (handled by our identity provider, Supabase Auth)

Operational data

Records you create in the platform: incidents, CAPAs, NCRs, risk assessments, JHAs, permits, training records, inspections, KPIs, chemicals, contractors, and related attachments
Timestamps and audit trail for changes you make

Technical data

IP address, browser type, device, and pages visited (for security and abuse prevention)
Cookies strictly necessary for authentication and session management

3. How we use your data

To provide the service and the features you sign up for
To authenticate you and keep your account secure
To communicate with you about your account, security issues, and service updates
To comply with our legal obligations

We do not sell your data. We do not use your operational data to train AI models.

4. Legal basis (GDPR)

Where GDPR applies, we process personal data under the following bases: (a) performance of a contract: to deliver the service you signed up for; (b) legitimate interests: to secure and improve the platform; (c) legal obligation: to comply with applicable law; (d) consent: where you have given it (e.g. marketing).

5. Sharing and sub-processors

We share data only with the sub-processors necessary to run the service. Each one is contractually bound to handle data with appropriate security and confidentiality.

Sub-processor	Purpose	Data region
Supabase	Database, authentication, file storage, edge functions	EU (eu-west-1, Ireland)
Vercel	Web hosting and CDN for the marketing site and app shell	Global edge, primary region: EU
Cloudflare	DNS resolution and domain registrar	Global anycast network
Resend	Transactional email delivery (notifications, contact form replies)	EU
Anthropic	AI features only: hazard analysis (JHA) and SDS extraction. We use the Anthropic API tier; submitted data is not used for model training by default.	United States
OpenAI	AI features only: text embeddings for recurrence detection and Ask-ENSURE conversational search, and Legal Register clause extraction. We use the OpenAI API tier; submitted data is not used for model training by default.	United States

We will notify customers in writing at least 30 days before adding or replacing a sub-processor that has access to customer data. Removing a sub-processor does not require notice.

6. Where your data is stored

Data is stored on infrastructure operated by our sub-processors. Where possible, we select EU regions to keep data within the EEA. Transfers outside the EEA, where they occur, are protected by Standard Contractual Clauses.

7. Retention

We retain operational data for as long as your account is active. If you close your account, we delete personal data within 90 days, except where we are legally required to retain it (e.g. invoicing records).

8. Your rights

You have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise these rights, email privacy@ensureqhse.com. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We use TLS in transit, encryption at rest, row-level security in the database, and a least-privilege access model. No system is perfect. If you discover a vulnerability, please report it to security@ensureqhse.com.

10. Children

ENSURE is not intended for use by children under 16. We do not knowingly collect data from children.

11. Changes to this policy

If we make material changes, we will notify account holders by email and update the "Last updated" date above.