Privacy Policy: PraxysEHS Project Manager

Effective date: October 30, 2026

This policy explains what personal information PraxysEHS LLC ("PraxysEHS," "we," "us") collects through PraxysEHS Project Manager, how we use it, and the choices you have.

Two roles, depending on the information.

For our own records (customer accounts, billing, and how the website and Service are used), we decide how information is used. This policy describes that.
For what customers put into the Service (their projects, updates, files and photos, safety committee rosters and minutes, and the people named in them), we handle it on the customer's behalf and follow its instructions. If you're named in a customer's records, for example on a project team or a committee roster, that customer controls the record. Contact them with questions; we'll help them respond.

What we collect

Your account: your name, work email, job title and access level, the companies and sites you work in, and the sites you're limited to, if any. Your company may enter your name and job title when it invites you. We don't use passwords: you sign in with a link we email you.
Two-step sign-in, if you turn it on: the key your authenticator app uses, stored encrypted, and your backup codes, stored only as one-way codes we can't read back.
Billing: your organization's name, billing email, plan and payment history, and the billing address and any tax ID given at checkout, which are used to work out sales tax. Card and bank details are kept by Stripe, never by us.
What customers put in: proposals, plans, tasks, updates, replies and @mentions, changes and decisions, measures and readings, spending and savings figures, close-outs, lessons and 90-day checks, and files and photos. These can name employees, contractors and others.
Hours: the hours a person has for projects each week, and the hours estimated and taken on the tasks they own. They're used to plan the work and show who has hours left. They aren't timekeeping or payroll records.
Safety committee rosters, through customers: each member's name, part on the committee, the area and shift they represent, how they were chosen, term dates and the meetings they attended. Customers can list people who don't have a sign-in, such as hourly employees; those details come from the customer, not from the person.
Injury and health information, where a customer's proposals, updates, measures, minutes or files describe injuries, illnesses or near misses. Customers decide what to include; our terms ask them to include only what the work needs.
Photos are kept as uploaded, including any details the camera saved in them, such as where a photo was taken. Security projects can include camera stills that show people; customers decide what to include.
Activity records: who changed what in a customer's account, and when.
Security and technical information: session details, sign-in records and short-lived request logs kept by our hosting provider.

Cookies: one, which keeps you signed in, plus, if you use two-step sign-in and choose "Trust this device," one that skips the code on that browser for 30 days. Your browser also remembers, on your device only, which site you picked last. No advertising or analytics cookies. Our public pages at praxysehs.com count visits with Cloudflare Web Analytics, which doesn't use cookies.

How we use it

To provide the Service: proposals and go-aheads, plans, tasks, updates, changes, measures, close-outs and 90-day checks, reports, and the Committee Room add-on.
To send the emails the Service sends as part of the work, such as sign-in links, invitations, go-ahead requests, updates, replies that mention you, reminders, the weekday morning email and committee agendas.
To keep the Service secure, bill customers, contact you about your account, and meet legal obligations.
To improve the Service, using counts that don't identify any person or company.
Injury and health information is used only to provide the Service to the customer it came from.

We don't sell personal information or share it for advertising. No artificial intelligence service reads customer records.

Who we share it with

Service providers under contracts that limit their use of it: Cloudflare (hosting, database, file storage, backups, security, email delivery, and visit counts on our public pages), Stripe (payments) and Microsoft (our support inbox, only for what you send to support@praxysehs.com).
Within a customer's account. People a customer adds see what their access allows: admins see every project; members see every project at their sites, or at every site if they aren't limited to some; and guests see only the projects they're added to. A draft proposal shows only to the person writing it and to admins.
Legal requirements, when required by law, subpoena or court order. For customer records, we refer requests to the customer where we can.
Business changes, under protections at least as strong as these.

We'll give customers' admins at least 30 days' notice before adding or replacing a service provider that handles customer records.

How long we keep it

Customer records: while the customer's trial or plan is active. After it ends, read-only for 12 months, then deleted with at least 60 days' notice. A customer can ask us to delete its records sooner.
Deleted and removed items: things deleted or removed in the Service, such as a draft proposal or a person removed from an account, are hidden and kept with the customer's other records until those are deleted. A removed file is different: its stored copy is deleted at once.
Billing records: as tax and accounting law requires, generally seven years.
Backups: Cloudflare's point-in-time restore covers the last 30 days, and our nightly copies of the database, and the copies made before each database update, are kept 90 days. Deleted information stays in these copies until they age out. Files aren't in them.

Where it's stored and how we protect it

PraxysEHS Project Manager is offered for sites in the United States, and in Canada except Québec. Our database and files are stored with Cloudflare in the United States. If you're at a site in Canada, your information is stored and processed in the United States, where courts, law enforcement and national security authorities may be able to access it under US law. Connections are encrypted, stored data is encrypted, each customer's data is kept separate, access follows each person's access level and sites, sign-in links, sessions and backup codes are stored only as one-way codes, two-step keys are stored encrypted, and files open only through links that run out in minutes. No system is perfectly secure; if a breach affects your information, we'll notify affected customers and people as the law requires. For sites in Canada, that includes telling the customer promptly so they can report a breach that creates a real risk of significant harm, as Canadian law requires.

Your choices and rights

Access, correction and deletion. You can change your own name in the Service. For anything else, contact us at support@praxysehs.com. If the information is part of a customer's records, we'll direct your request to that customer.
Emails. You can turn off the weekday morning email on your My work page. Other emails come from your part in a project or committee; ask your company's admins if you no longer need them.
State privacy rights. Depending on where you live, you may have rights to know, access, correct, delete or opt out. We'll honor requests as your state's law requires, and won't treat you differently for making one. An authorized agent can make a request for you; we may ask them and you to confirm it. If we decline a request, you can ask us to reconsider by replying to our answer.
No selling or sharing. We don't sell personal information or share it for cross-context behavioral advertising, as California law defines those terms, so there's nothing to opt out of. We treat a Global Privacy Control signal as an opt-out request anyway.
Canadian privacy rights. If you're in Canada, you can ask to see the personal information we hold about you and to correct it, and you can complain to us or to the Office of the Privacy Commissioner of Canada (or your provincial commissioner). Our Privacy Officer can be reached at support@praxysehs.com, with "Privacy" in the subject line.

Children

PraxysEHS Project Manager is for businesses and isn't directed at children. We don't knowingly collect personal information from anyone under 16.

Changes and contact

We'll post updates here with a new effective date, and tell customers' admins before material changes. PraxysEHS LLC · support@praxysehs.com