Privacy Policy

HazComFast ("we," "our," or "the Company") is committed to protecting your privacy and maintaining the security of your information. This Privacy Policy explains how we collect, use, store, protect, and share information when you use our website and software platform (collectively, the "Platform"). This policy applies to all users of HazComFast, including visitors to our website, trial users, and paid subscribers. By accessing or using our Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy in conjunction with our Terms of Service. If you do not agree with this Privacy Policy, please discontinue use of our Platform immediately.

HazComFast is operated as an independent software service. We act as the data processor for customer data entered into the Platform. Our customers (organizations and businesses) remain the data controllers and are responsible for ensuring their data collection and processing practices comply with applicable laws. For privacy-related questions, please contact: Email: support@hazcomfast.com

We use collected information for the following purposes: • Providing and maintaining the Platform and its features • Processing transactions and managing subscriptions • Sending important service updates, security alerts, and administrative messages • Providing customer support and responding to inquiries • Improving and optimizing the Platform through usage analysis • Detecting, preventing, and addressing technical issues and security threats • Complying with legal obligations and enforcing our Terms of Service • Developing new features and services based on user needs We process personal information based on the following legal grounds: contract performance, legitimate interests, legal compliance, and consent (where applicable).

Customer data is processed and stored in the United States: our database and file storage run in the us-east-1 region and our application servers in the Washington, D.C. area (iad1), on the infrastructure of our cloud service providers. Transactional e-mail is sent from a US region as well. If we ever move a component outside the United States, we will update this policy before doing so. We work with these service providers: • Vercel (website and application hosting) • Supabase (database, file storage and sign-in) • Google Analytics 4 (website visit statistics) • Paddle.com (billing and payments)

We employ comprehensive technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction: • TLS 1.2+ encryption for data in transit • Two-factor authentication, which an admin can require for the whole team • Secure authentication mechanisms with password requirements • Each company sees only its own records While we implement robust security measures, no system is completely secure. We encourage users to maintain strong passwords and protect their account credentials.

We share information only in the following limited circumstances: Service Providers: We share information with the vendors who perform services on our behalf (hosting, analytics, payment processing), named in section 5. Legal Requirements: We may disclose information when required by law, legal process, litigation, or government requests, or to protect our rights, property, safety, or the rights of others. Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, customer information may be transferred. We will notify affected users of any such change in ownership or data control. With Your Consent: We may share information with third parties when you explicitly consent to such sharing.

We retain your information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy: • Account information is retained for the duration of your active subscription • Safety and compliance documents are kept under a retention period set for each record type, up to 30 years for exposure records, and a document under a retention period or a legal hold cannot be deleted • You can export every record and document at any time, on every plan When a subscription is cancelled, the account switches to read-only for 90 days: your records stay visible and the export keeps working, so you leave with everything. After that, or at any time, write to support@hazcomfast.com to have your information deleted, subject to our legal obligations.

Depending on your location, you may have certain rights regarding your personal information: Access: Request copies of your personal information Correction: Update or correct inaccurate information Deletion: Request deletion of your information (subject to legal requirements) Portability: Receive your data in a portable format Objection: Object to certain processing activities Restriction: Request limited processing of your information Withdraw Consent: Withdraw previously given consent To exercise these rights, contact us at support@hazcomfast.com. Some requests may require identity verification to protect your security. You can also: • Update account information through your profile settings • Turn on two-factor authentication in your account settings • Adjust cookie preferences through browser settings

HazComFast is designed for use by businesses and workplace safety professionals. Our Platform is not intended for children under 16 years of age, and we do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 16 without parental consent, we will take steps to delete such information promptly. If you believe we have collected information from a child, please contact us immediately at support@hazcomfast.com.

HazComFast serves businesses in the United States. Your information is stored and processed in the United States, as described in section 5.

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations. The "Effective Date" at the top of this policy indicates when it was last revised. For material changes that significantly affect your rights or how we handle information, we will: • Post a prominent notice on our website • Send email notifications to registered users • Provide at least 30 days' notice before changes take effect Continued use of the Platform after policy updates constitutes acceptance of the revised terms. We encourage you to review this policy periodically to stay informed about how we protect your information.

Customers using HazComFast for OSHA compliance remain responsible, as data controllers, for their own compliance with workplace safety and privacy regulations, including the OSHA recordkeeping privacy rules (29 CFR 1904.29).