Privacy Policy

OmniSpect · Last updated 3 October 2026 · Draft pending review by counsel

This policy explains what OmniSpect collects, why, and how it is handled. It covers the iPad application, the office web application and the website.

What we collect

• Account data: name, work email, role, company, and sign-in records, handled by our identity provider (Clerk).
• Billing data: company billing details and subscription state. Card details are entered on Stripe's hosted pages and never touch our servers.
• Inspection data entered by your company: projects, property addresses, rooms, readings, photos, video, floor plans, LiDAR scans, air samples and laboratory results, findings and reports. Photos may carry location and time stamps. Spatial Evidence sessions store a map of the room's surfaces on the device.
• Location: with your permission, to stamp photos, to check in at a site, and to read the compass at the start of a LiDAR scan for the floor plan's north arrow.
• Calls: voice and video between your company's users run over Cloudflare Calls. Calls are not recorded unless every participant consents in the app. Live captions are kept in the call log, not in evidence packages.
• Usage and diagnostics: server logs and error reports needed to run the Service.

How we use it

To provide the Service to your company, to bill it, to support it, and to keep it secure. AI features send only the text needed for the requested task to our AI processor and return proposed text for a person to accept. We do not sell personal data and do not use customer data to train third-party models.

Who processes it

Railway (application and database hosting, United States), Cloudflare (media storage and call media), Clerk (sign-in), Stripe (billing), OpenAI (AI text proposals), Apple (push notifications for calls), and Google or Dropbox only when your company connects its own account for backups.

Your company's role

Your company controls the inspection data it enters, including data about policyholders and properties. Requests about that data should go to your company; we assist as its processor under the Data Processing terms.

Retention and deletion

Data is kept for the life of the subscription. After termination it can be exported for 30 days and is deleted within 90 days thereafter, except as it persists in routine backups. Media originals are kept for the life of a project plus seven years unless deletion is requested earlier.

Security

Data is segregated per company, media is served only through tokenised links, readings are stored as an append-only history, and access is logged. We notify affected customers without undue delay, and within 72 hours of confirmation, of any security incident affecting their data.

Contact

Questions or requests: see the Support page. Provider: [Provider legal entity and address].