1. Who We Are
TruVex LLC ("TruVex," "we," "us," or "our") provides a cloud-based Health, Safety, and Environment (HSE) management platform and related consulting services. This Privacy Policy explains how we collect, use, store, and protect information when you use our website (truvexhq.com), our platform (app.truvexhq.com), and our services.
Contact: support@truvexhq.com
2. Information We Collect
Information you provide to us:
- Account information: name, email address, job title, phone number
- Organization information: company name, facility names and locations
- HSE records: incident reports, inspection records, training records, permits, corrective actions, and other safety management data entered into the platform by your organization
- Files and attachments: documents, photos, and files uploaded to the platform
- Communications: emails and messages you send to us
Information collected automatically:
- Log data: IP address, browser type, access times, pages viewed
- Device information: operating system, device type
Information we do NOT collect:
- We do not use tracking or advertising cookies
- We do not sell or share personal data with third parties for marketing
- We do not use third-party analytics that track individual users
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the TruVex platform
- Process and store your HSE records as directed by your organization
- Send service-related notifications (inspection reminders, training due dates, system alerts)
- Respond to your requests and provide customer support
- Improve and develop our platform and services
- Comply with legal obligations
We process your organization's HSE data solely on behalf of your organization (the data controller) and according to their instructions. We do not use customer HSE data for any purpose other than providing the service.
4. Legal Basis for Processing (GDPR)
For individuals in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under the following legal bases:
- Contract performance: Processing necessary to provide our platform and services under our agreement with your organization
- Legitimate interests: Processing necessary for our legitimate business interests, such as improving our services and ensuring platform security
- Legal obligation: Processing necessary to comply with applicable laws
- Consent: Where required, we obtain your consent before processing
5. Data Sharing
We do not sell your personal data. We share data only in these limited circumstances:
- Infrastructure providers: Our hosting provider (DigitalOcean) and CDN/security provider (Cloudflare) process data as part of delivering the service. Both maintain SOC 2 Type II and ISO 27001 certifications.
- Email services: Microsoft 365 for service-related email communications
- Legal requirements: When required by law, regulation, or legal process
All third-party providers are contractually obligated to protect your data and use it only for the purposes of providing their services to us.
6. Data Storage and Security
- Location: All data is stored in data centers located in the United States. No data is processed or stored offshore.
- Encryption: Data is encrypted in transit using TLS 1.2/1.3. Storage volumes are encrypted at rest.
- Access control: Role-based access control (RBAC) ensures users only access data relevant to their role and organization.
- Isolation: Each customer organization's data is logically isolated at the database level. No cross-tenant access is possible.
- Audit trail: All actions within the platform are logged with user attribution and timestamps.
- Monitoring: 24/7 uptime monitoring with automated alerting.
7. Data Retention
- Active accounts: Data is retained for the duration of the service agreement with your organization.
- After termination: Upon contract termination, customer data is available for export for 30 days. All data is securely deleted within 90 days of contract end, unless a longer retention period is required by law or requested by the customer.
- Backups: Automated backups are retained for 7 days and then overwritten.
8. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate personal data
- Deletion: Request deletion of your personal data
- Portability: Request your data in a portable format (CSV, PDF)
- Restriction: Request restriction of processing in certain circumstances
- Objection: Object to processing based on legitimate interests
For platform users: Your organization is the data controller. Please contact your organization's administrator for data requests. Your administrator can export or delete your records directly from the platform.
For direct requests: Contact us at support@truvexhq.com. We will respond within 30 days.
9. Cookies
Our website uses only essential cookies required for the platform to function (authentication, session management). We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
10. Children's Privacy
Our platform is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.
11. International Data Transfers
All data is stored and processed in the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. For EU/EEA users, this transfer is governed by our Data Processing Agreement, which includes appropriate safeguards as required by GDPR.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify customers of material changes by email or through the platform. The "Last updated" date at the top of this page reflects the most recent revision.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at:
TruVex LLC
Email: support@truvexhq.com
Web: truvexhq.com