Data HSESteward may process
| Category | Examples | Main purpose | When collected |
|---|---|---|---|
| Personal information | Name, email, user ID, role | Account management, authentication, role-based access | Required for authenticated accounts |
| Workforce/organization information | Organization, project, crew, employee/token number, designation, RC/Civil ID reference, work-readiness fields | HSE operations and workforce administration | Entered by authorized users/admins |
| Precise location | GPS coordinates linked to field/closure evidence | Safety evidence, traceability, location verification | Only when a supported location feature is used and permission is granted |
| Photos | Site evidence, observation evidence, closure proof | HSE documentation and verification | When the user captures/selects a photo |
| Files and documents | Controlled documents, certificates and related metadata | Document control and permit/workflow support | When uploaded by an authorized user |
| Other user-generated content | TBTs, checklists, reports, observations, actions, ePTW records, comments | Core HSE functionality, reports and Safety Intelligence | As users perform HSE workflows |
| Technical/security information | Authentication/session and infrastructure logs | Security, reliability, troubleshooting | Generated as needed by the service and providers |
Security practices
- Firebase Authentication for authenticated accounts.
- Tenant-, organization- and project-scoped Firestore access controls.
- Role-based permissions for Organization Admins, managers, field users and Platform Owner functions.
- Encrypted HTTPS/TLS connections for supported cloud communications.
- Separate organization workspaces and controlled Demo/Organization workspace access.
- Audit-oriented safety records and explicit current-revision verification for controlled documents.
How data is used
Data is used for app functionality, account management, safety reporting, HSE administration, ePTW, evidence management, security, support and Safety Intelligence. HSESteward does not sell personal information and does not use operational HSE data for third-party behavioral advertising.
Service providers
HSESteward relies on service providers to operate the platform, including cloud authentication/database/storage, website hosting, communications/forms and, for selected Safety Intelligence functions, cloud/AI processing. Service-provider processing is limited to providing or securing the service under the relevant configuration and agreements.
Deletion
Users can request account and associated personal-data deletion through the Account & Data Deletion page. Certain organization-owned HSE records may be retained where required for legitimate safety, legal, contractual, investigation or audit purposes, as explained in the Privacy Policy.