Privacy Policy: PraxysEHS Compliance Calendar

Effective date: October 30, 2026

This policy explains what personal information PraxysEHS LLC ("PraxysEHS," "we," "us") collects through PraxysEHS Compliance Calendar, how we use it, and the choices you have.

Two roles, depending on the information.

For our own records (customer accounts, billing, and how the website and Service are used), we decide how information is used. This policy describes that.
For what customers put into the Service (their sites, tasks and records, permits, sample results, events, agency log records, actions, maps, files and photos, and the people named in them), we handle it on the customer's behalf and follow its instructions. If you're named in a customer's records, for example as the person who holds a task or as a site's manager, that customer controls the record. Contact them with questions; we'll help them respond.

What we collect

Your account: your name, work email, job title, phone number if you or your company add it, access level, the companies you work in, the sites and roles you hold, and any out-of-office dates you enter. Your company may enter your name, job title and phone number when it invites you. We don't use passwords: you sign in with a link we email you.
Billing: your organization's name, billing email, plan and payment history, and the billing address and any tax ID given at checkout, which are used to work out sales tax. Card and bank details are kept by Stripe, never by us.
What customers put in: sites and their profile answers, tasks and who holds them, completions and notes, records, permits and their conditions, sample results, events and the reports they owe, agency inspections, notices, letters and calls, actions and their fixes, rule-change decisions and yearly reviews, and files, photos and site maps. These can name employees, contractors, agency staff and others.
Permit documents read with AI, if a customer chooses to read one: the document, what was read from it, who asked for the reading, and each person's decision on each item.
Health and injury information isn't what the Service is for, but a customer's notes, events or files may describe an injury or illness. Customers decide what to include; our terms ask them to include only what the work needs.
Photos are kept as uploaded, including any details the camera saved in them, such as where a photo was taken.
Activity records: who changed what in a customer's account, and when, including every download of a report or audit pack.
Security and technical information: session details, sign-in records, a record of each email the Service sends, and short-lived request logs kept by our hosting provider.
Bot checks: when you ask for a sign-in link, Cloudflare Turnstile checks that a person, not an automated program, is filling in the form. It looks at basic signals from your browser and device to do that, and we receive only a pass or fail.

Cookies: only one, which keeps you signed in. Your browser also remembers, on your device only, which sites you chose to see last. No advertising or analytics cookies. Our public pages at praxysehs.com count visits with Cloudflare Web Analytics, which doesn't use cookies.

How we use it

To provide the Service: each site's calendar, the rule library and rule changes, permits, sampling, events and agency reports, agency visits, fixes, maps, reports and audit packs, and bulk upload.
To send the emails the Service sends as part of the work, such as sign-in links, invitations, the weekly summary, late-work notices, emails with calendar invites when a task or fix is given to you, moved or taken off your calendar, alerts to administrators when an event owes a report, and notices to administrators before a company's records are deleted.
To read a permit with AI when someone on a customer's team asks for it (below).
To look up public records when someone on a customer's team asks: the site name they search for, with the site's state and city, is sent to EPA's public ECHO database to find permits on file, and the street address they enter is sent to the US Census Bureau's address lookup to place the site on a map. The map's area, not the address, is sent to the US Geological Survey for an aerial photo.
To keep the Service secure, bill customers, contact you about your account, and meet legal obligations.
To improve the Service, using counts that don't identify any person or company.
Health and injury information is used only to provide the Service to the customer it came from.

We don't sell personal information or share it for advertising. The only artificial intelligence service that reads customer records is the permit reading a customer chooses to run, described below.

Reading permits with AI. When an administrator or contributor on a customer's team chooses to read a permit with AI, the document, with the permit's name, kind, number, agency and dates already on file, goes to Anthropic only to be read. Under Anthropic's commercial terms, it isn't used to train AI models. Nothing it suggests is added to the customer's permits or calendar until a person confirms it, and every reading and every decision is logged. When someone brings in a spreadsheet in its own layout, we may send Anthropic its column names, a few sample values and the names of activities we couldn't match on our own, only to suggest which is which; never the whole file, and a person confirms each match.

Who we share it with

Service providers under contracts that limit their use of it: Cloudflare (hosting, database, file storage, backups, security, including the Turnstile bot checks, email delivery, and visit counts on our public pages), Stripe (payments), Anthropic (reads a permit document when a customer asks, under terms that bar using it to train AI models) and Microsoft (our support inbox, for what you send to support@praxysehs.com).
Public record services (EPA, the US Census Bureau and the US Geological Survey), only the details described above, only when someone asks for a lookup.
Within a customer's account. People a customer adds see what their access level allows. Everyone in an account can see all of its sites and records and the names of its people, and an administrator's phone number shows to everyone when an event needs a call. Only administrators see agency reports.
People who get an email or calendar invite about a task see that task's details, as part of the customer's work.
Legal requirements, when required by law, subpoena or court order. For customer records, we refer requests to the customer where we can.
Business changes, under protections at least as strong as these.

We'll give customers' administrators at least 30 days' notice before adding or replacing a service provider that handles customer records.

How long we keep it

Customer records: while the customer's trial or plan is active. After it ends, read-only for 12 months, then deleted with at least 60 days' notice to its administrators, by email at 60, 30 and 7 days. A customer can ask us to delete its records sooner once its trial or plan has ended. Sign-ins of people who work only in that customer's account are deleted with it.
Removed items: things removed in the Service, such as a closed site or a person removed from an account, are hidden and kept with the customer's other records until those are deleted. A removed file is different: its stored copy is deleted at once.
Billing records: as tax and accounting law requires, generally seven years.
Backups: Cloudflare's point-in-time restore covers the last 30 days, and our nightly copies of the database, and the copies made before each database update, are kept 90 days. Deleted information stays in these copies until they age out. Files aren't in them.

Where it's stored and how we protect it

PraxysEHS Compliance Calendar is offered for sites in the United States. Our database and files are stored with Cloudflare in the United States. If you use the Service from outside the United States, your information is transferred to and processed in the United States. Connections are encrypted, stored data is encrypted, each customer's data is kept separate, access follows each person's access level, sign-in links and sessions are stored only as one-way codes, and files open only for signed-in people with access. No system is perfectly secure; if a breach affects your information, we'll notify affected customers and people as the law requires.

Your choices and rights

Access, correction and deletion. You can change your own name, phone number and out-of-office dates in the Service. For anything else, contact us at support@praxysehs.com. If the information is part of a customer's records, we'll direct your request to that customer.
Emails. There's no switch to turn off the Service's emails: they come from your part in the work, such as the tasks you hold, your role at a site or your access level. Ask your company's administrators if you no longer need them; they can change who holds a task or a role, or remove you from the account. Out-of-office dates send your reminders to your site's backup while you're away.
State privacy rights. Depending on where you live, you may have rights to know, access, correct, delete or opt out. We'll honor requests as your state's law requires, and won't treat you differently for making one. An authorized agent can make a request for you; we may ask them and you to confirm it. If we decline a request, you can ask us to reconsider by replying to our answer.
No selling or sharing. We don't sell personal information or share it for cross-context behavioral advertising, as California law defines those terms, so there's nothing to opt out of. We treat a Global Privacy Control signal as an opt-out request anyway.

Children

PraxysEHS Compliance Calendar is for businesses and isn't directed at children. We don't knowingly collect personal information from anyone under 16.

Changes and contact

We'll post updates here with a new effective date, and tell customers' administrators before material changes. PraxysEHS LLC · support@praxysehs.com