Privacy Policy

OSHA Paperwork is operated by EMB Marketing LLC, 2030 W Baseline Rd #182-1445, Phoenix, AZ 85041.

What we collect

• Free form downloads: your email address and the consent text you agreed to (“We store your email to provide this download.”). The form contents are not stored.
• Accounts: email address, sign-in times, and the records you enter (establishments, cases, summaries, plan answers).
• Technical: a keyed hash of your IP address for rate limiting, and your browser user agent.

How we protect it

Employee names, addresses, dates of birth, physician and facility details and incident narratives are encrypted at rest using AES-256-GCM. Request bodies are never logged. Analytics payloads never contain emails, names, form contents or case data.

Emails

We send sign-in links. Annual customers may also get compliance reminders: the 300A posting period, the ITA submission deadline, written-plan reviews and the end of their annual plan. We do not send marketing email to free-form downloaders unless you ticked the separate, optional “Contact me about OSHA Paperwork later” box.

Service providers

Vercel hosts the app, Neon stores account and record data, Resend delivers sign-in email, and Stripe processes payments. We store payment and entitlement references, never full card numbers. Injury records and plan answers are not sent to Stripe.

Cookies and analytics

Analytics and advertising tags (Google Analytics, Google Ads and the Meta pixel) load only after you grant consent in the banner, and never on account pages; the payment confirmation page reports the purchase amount. With consent, a free-form download or a purchase is also reported to Meta from our server with the event name, page address without its query string, your IP address, browser user agent and Meta’s own cookies, never your email or form contents. We honor the Global Privacy Control signal as a denial. You can opt out at any time at /legal/do-not-sell.

Retention

OSHA requires injury and illness records to be kept for five years after the year they cover (29 CFR 1904.33). Deleting a case removes it from active logs; a soft-deleted copy remains in the database. Automatic deletion after five years is not currently enabled. You can request deletion of your account data at any time; we will explain what must be retained for legal reasons.

Contact

For support, access, correction, or deletion requests, email evan@emb-automation.com. Do not include employee medical information in ordinary email.