KARM.SAFETY Back
Legal

Privacy Policy

Effective date · July 9, 2026
Notice. This document was generated as a starting point and should be reviewed by qualified legal counsel before any commercial deployment. It is provided in good faith but does not constitute legal advice.

WHO WE ARE

KARM LLC ("KARM," "we," "us," or "our") operates the KARM Safety application at karmsafety.app and its iOS / Android companion apps ("Service"). This Privacy Policy explains what information we collect, how we use it, and the rights you have over it.

You can contact us any time at shane@karmsafety.com.

INFORMATION WE COLLECT

We collect only what the Service needs to function:

  • Account data — name, email address, hashed password, role (owner, admin, supervisor, employee).
  • Company data — your company name, trade classification, access code, and administrator contact.
  • Employee roster data — names, trades, optional email and phone, active/inactive status.
  • Certification data — certification type, issue date, expiration date, issuer name, and optionally an uploaded photograph of the physical credential.
  • Job site assignments — project names, locations, dates, and assigned employees.
  • Device data (mobile only) — push notification token, device platform (iOS/Android), and OS version.
  • Log data — IP address, browser or device model, timestamps, and endpoints accessed for security auditing.

We do NOT collect: precise location, contacts, calendar, health, financial, or biometric data.

HOW WE USE YOUR INFORMATION

We use the data above to:

  • Provide, maintain, and improve the Service (roster management, certification tracking, job assignments).
  • Send transactional emails via Resend (e.g., expiration digest emails to administrators who opt in).
  • Send push notifications to registered mobile devices about expiring certifications.
  • Authenticate users and secure accounts (bcrypt password hashing, JWT session tokens, HTTPS transport).
  • Detect fraud, abuse, and security threats.
  • Comply with legal obligations (subpoenas, court orders, tax law).

We do not sell your data, we do not use it for advertising, and we do not share it with third parties for their own marketing.

LEGAL BASES FOR PROCESSING (GDPR)

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases:

  • Contract — to deliver the Service you signed up for.
  • Legitimate interests — to secure our systems, prevent fraud, and improve the product.
  • Consent — for optional email digests and push notifications; you can withdraw consent any time in Settings.
  • Legal obligation — to comply with applicable laws.

DATA SHARING

We share data only with the service providers that make KARM Safety work:

  • MongoDB Atlas — encrypted database storage.
  • Resend, Inc. — transactional email delivery (opt-in digests).
  • Cloud storage provider — encrypted storage for uploaded certification photos.
  • Apple / Google — push notification delivery (APNs / FCM) when you install our mobile app.

Each provider is contractually bound to use your data only to deliver the service to us and is required to apply industry-standard security controls. A current list of subprocessors is available upon request at shane@karmsafety.com.

We may also disclose data if required by law, to protect our rights, or in connection with a corporate transaction (merger, acquisition, sale of assets), in which case we will notify you.

DATA RETENTION

We keep account, roster, and certification data for as long as your company account is active plus 90 days after cancellation, unless a longer retention period is required by law. Certain records related to OSHA training documentation may be retained for up to five (5) years to support employer record-keeping requirements.

You may request earlier deletion by emailing shane@karmsafety.com — see "Your rights" below.

SECURITY

We take reasonable technical and organizational measures to protect your data:

  • All traffic between your device and our servers is encrypted with HTTPS/TLS.
  • Passwords are stored using industry-standard bcrypt hashing — we never store plaintext passwords.
  • Session tokens are stored in HTTP-only cookies to reduce cross-site scripting risk.
  • Access to production databases is restricted to designated personnel and logged.

No security system is perfect. If you believe your account has been compromised, contact us immediately at shane@karmsafety.com.

YOUR RIGHTS

Depending on where you live, you may have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate data (most fields are self-serve in Settings).
  • Deletion — ask us to delete your data (subject to our retention obligations).
  • Portability — receive your data in a machine-readable format.
  • Objection / restriction — object to certain processing activities.
  • Withdraw consent — turn off email digests and push notifications any time in Settings.
  • Non-discrimination — we will not degrade the Service if you exercise these rights.
  • Lodge a complaint — with your local data protection authority (EU) or the California Privacy Protection Agency.

To exercise any right, email shane@karmsafety.com. We will respond within 30 days.

CALIFORNIA RESIDENTS (CCPA / CPRA)

In the past 12 months we have collected the categories of personal information described in "Information we collect." We do not sell or share personal information for cross-context behavioral advertising. California residents have the right to know, delete, correct, and limit use of sensitive personal information as described in "Your rights."

CHILDREN

KARM Safety is not directed to individuals under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us data, email shane@karmsafety.com and we will delete it.

INTERNATIONAL TRANSFERS

We may transfer, store, and process your data in the United States. Where required by law, we rely on Standard Contractual Clauses or equivalent safeguards.

CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes will be announced in-app or via email at least seven (7) days before they take effect. Continued use of the Service after the effective date constitutes acceptance.

CONTACT US

Questions or requests: KARM LLC — shane@karmsafety.com