eSafety Privacy Policy
The short version: your health and safety information belongs to you and your company. We use it to operate eSafety, keep the service secure, provide support and run the services needed to make the platform work. We do not sell customer records.
1. Information we collect
eSafety stores information your company and its authorised users enter, create or upload while using the service.
- Worker and contractor information. This can include names, contact details, roles and information entered into company health and safety records.
- Sites and workplaces. Information about company sites, client sites and other locations managed through eSafety.
- Health and safety records. This can include inductions, incidents, forms, acknowledgements, policies, risk information and other workplace safety records.
- Uploaded files. Companies may store documents, photographs, PDFs and other files required for their records.
- Signatures and confirmations. Some workflows allow users, workers or contractors to sign, acknowledge or confirm records.
- Company information. This can include company name, contact details, logos, billing details and account settings.
- User account information. We use account information to identify users and provide access to the correct companies and features.
2. How we use information
We use company and user information to operate eSafety and provide the services requested by our customers.
- To run eSafety. Information is used to provide the health and safety functions, records and workflows available through the platform.
- To control access. Authorised users can access company information according to their company membership and assigned access level.
- To provide support. Information may be used when investigating problems, responding to support requests or helping a company use the service.
- To keep the service secure. Account and system information may be used to protect eSafety, customer records and user accounts.
- To manage subscriptions and payments. Information required for subscription administration may be supplied to Stripe and other service providers involved in running eSafety.
3. Where information is stored
eSafety uses Google Firebase and related Google cloud services for application hosting, authentication, databases and file storage.
In other words: proper managed cloud infrastructure — not a shoebox under a desk.
We take reasonable technical and organisational steps to protect information stored through eSafety and to restrict access to authorised users and systems.
4. Who can access company information
Company information is intended to be available only to authorised users associated with that company and to eSafety personnel or service providers where access is reasonably required to operate, secure or support the service.
eSafety uses company membership and access levels to control which parts of the application a user can access.
Company administrators are responsible for granting access to the right people and removing that access when it is no longer required.
5. Service providers
We use service providers where reasonably required to operate eSafety. They may process the information required to perform their particular service.
- Google / Firebase. Used for application hosting, databases, authentication and file storage.
- Email providers. Used to send invitations, notifications, reminders, forms and support messages.
- Stripe. Used for paid subscriptions, payment methods, invoices, payments, refunds and related billing services.
Stripe handles card-payment details through its payment systems. eSafety does not need to store your full card number.
Customer health and safety records are not supplied to these providers for advertising or sold to them for their own marketing.
6. Retention and deletion
Records remain in eSafety while they are reasonably required to provide the service, maintain the company's records, satisfy legitimate operational requirements or meet applicable obligations.
When an authorised user permanently deletes a record or file through an eSafety feature intended to delete it, eSafety removes the corresponding active application record or stored file where applicable.
Backups, security logs and third-party service records may take longer to expire than the active application copy. Computers are annoyingly literal creatures; "gone from the app" and "every backup block on earth instantly evaporated" are not quite the same thing.
Whole-company deletion is handled separately from deleting individual records. A company with no valid paid or free access may become eligible for permanent company-data deletion after the applicable closure period.
Closing or deleting one company does not necessarily delete a person's login identity because the same person may belong to another eSafety company.
Stripe and other financial records may be retained separately where reasonably required for payment, accounting, fraud-prevention, dispute or legal purposes.
7. Access and correction
If you need access to information held in your company account, want something corrected or believe information should be removed, contact your company administrator in the first instance.
Company administrators can manage much of their organisation's information directly through eSafety.
Questions relating to information held or processed by eSafety can be sent through the eSafety Contact Us page.
8. Account security
Users are responsible for protecting their login details and the email account associated with their eSafety login.
Use a strong password, protect your devices and tell eSafety promptly if you believe an account or login may have been compromised.
And, yes, please don't use password123, you absolute legend.
9. Changes to this policy
We may update this Privacy Policy as eSafety changes or as our service providers and operational requirements change.
The latest public version will be made available on this page.