Privacy Policy

Data We Collect

When you use HSEKit, we collect the following types of information:

• Account information: Name, email address, and hashed password when you register.
• Organisation data: Company name and contact email for your workspace.
• HSE content: Documents, incident reports, risk assessments, audit records, and training records you upload or create.
• Usage data: Login timestamps, IP addresses for security, and activity logs within the portal.
• Files: Documents and attachments you upload are stored securely on Cloudflare R2 storage.

How We Use Your Data

• To provide and operate the HSEKit service.
• To authenticate users and maintain account security.
• To send OTP verification codes and important system notifications via email.
• To generate PDF reports of your HSE data on demand.
• To maintain audit logs for compliance purposes.
• We do not use your data for advertising or sell it to third parties.

Data Storage & Security

Your data is protected by multiple layers of security:

• All passwords are hashed using bcrypt — we never store plain-text passwords.
• All data in transit is encrypted via TLS/HTTPS.
• Files are stored on Cloudflare R2 and accessible only via time-limited pre-signed URLs.
• Sessions use HTTP-only, SameSite=Strict cookies to prevent XSS and CSRF attacks.
• Login attempts are rate-limited and accounts are locked after repeated failures.
• CSRF tokens protect all form submissions.

Data Sharing

We do not sell, trade, or rent your personal information. Data may be shared only with:

• Cloudflare R2 — for file storage (files are encrypted at rest).
• SMTP Provider — for sending transactional emails (OTP, notifications).
• Legal authorities — only if required by applicable law.

Data Retention

We retain your data for as long as your account is active. Upon account deletion:

• Personal account data is deleted within 30 days.
• Uploaded files are removed from storage within 30 days.
• Activity logs may be retained for up to 90 days for security purposes.
• Company data is retained until the company account is terminated by an administrator.

Your Rights

You have the right to:

• Access and review all personal data we hold about you.
• Correct inaccurate personal information via your Profile page.
• Request deletion of your account and associated data.
• Export your data in a portable format.
• Object to processing of your personal data.

To exercise these rights, contact your organisation administrator or reach us at the address below.

Cookies

HSEKit uses strictly necessary cookies only:

• Session cookie: Keeps you logged in during your browser session. Deleted when you close your browser or log out.
• We do not use tracking, analytics, or advertising cookies.

Contact Us

For privacy-related questions or data requests, contact your organisation's HSE Portal administrator, or reach us at: