This Privacy Policy explains how Inspection Hero LLC (“Inspection Hero,” “we,” “us,” or “our“) handles information in connection with the Inspection Hero application for iPhone, iPad and Mac (the “App“).

Inspection Hero is designed as a local-first, offline-capable app. Read on for exactly what that means.

1. Summary

• The App stores your inspections, photos, and account data on your own device — not on our servers.
• We do not operate a backend that collects, transmits, or stores your inspection data.
• We do not include analytics, advertising, or crash-reporting SDKs in the App — nothing in it reports to us (see Section 2.9).
• The App does not contact any server, ours or anyone else’s, just to check whether it is online; it uses the connection status your device’s operating system reports.
• Some optional features — photo GPS-tagging, emailing or sharing reports, backups, team Data Sync (including, on Team plans and above, the license-usage record described in Section 2.10), notification integrations, Single Sign-On, the AI Assistant, and maps — involve data leaving your device. Each one is off until you or your organization turns it on, and each sends data only to a service you choose, as described below. The weather lookup, once you turn it on in Settings, sends only your coordinates, goes to Apple rather than a service you choose, and runs only when you tap its button. When the AI Assistant drafts with Apple Intelligence on your device, nothing leaves the device.

2. Information the App Handles

2.1 Data you create and store locally

When you use the App, you create the following data, which is stored in a local database on your device:

• Inspection records (including who each one is assigned to, who assigned it and when), checklist items (including non-pass/fail answers such as free text, numbers, choices, dates, and item-level signatures), comments, statuses, due dates, and templates
• Schedules your team sets up: each one’s name, template and a copy of its checklist, site, department, who it is assigned to, how often it repeats, how many days each visit has, its start and end dates, whether it is paused, and the time zone it was made in, with who created it and which device last saved it
• Follow-up/corrective-action details you enter on failed items — owner, due date, priority, corrective/preventive classification, root cause, and resolution notes
• Photos, videos, and audio recordings you capture or attach to inspection items
• Freehand photo annotations and drawn signatures
• User accounts you create within the App — name, email address, assigned role (for example Inspector, Supervisor, Team Admin, Integrations Admin, Auditor, or Viewer), reviewer/approver flags, and a securely hashed password that is never stored in plain text. Accounts provisioned via Single Sign-On instead rely on your identity provider and store no password at all.
• An internal audit log of actions taken within the App (for accountability within your organization)
• Branding assets and settings you configure for report exports. A logo you paste as a web address is downloaded once, from that address, when you save or preview your branding, and kept in the App; reports never fetch it again
• Settings for the optional integrations described below (Sections 2.4 through 2.8). The credentials among those settings — API keys, webhook URLs, bot tokens, the email relay password, the sign-in token of a Microsoft 365 or Gmail mailbox connected for email alerts, and the App’s backup-signing secret — are kept in the operating system’s keychain rather than in the database.
• A randomly generated device identifier used to label this device’s changes if you enable Data Sync (and, on Team plans and above, its license-usage record — Section 2.10), your choice of “real work” or “demo” mode on first launch, and your organization’s license key if one has been entered (Section 2.10)

None of this data is transmitted to us. It stays on the device unless you or your organization deliberately export, back up, sync, or share it as described below.

2.2 Device permissions

The App may request the following permissions, used only for the stated purpose:

• Camera — to capture photos and video for inspection items, and to photograph or scan a paper checklist so the App can read its text on your device.
• Microphone — to record audio notes for inspection items and the sound in videos you capture, and to hear answers you speak with Fill by voice.
• Speech Recognition — to turn audio notes and spoken answers into text, on your device. Transcribing an audio note or a spoken answer happens on your device using Apple’s speech recognition; the recording is not sent anywhere. The first time you transcribe, your device downloads Apple’s on-device speech model for your language from Apple, once; that download carries no audio or text.
• Photo library — to attach existing photos/videos to inspection items, and to choose a photo of a paper checklist for the App to read on your device. If you share a record card and choose Save Image, the App asks for permission to add that image to your photo library; that permission only adds images and does not let the App see your library.
• Redact and blur — when you blur part of a photo or use Blur faces, the App finds faces and blurs the areas on your device. No photo is sent anywhere for this and no face data is kept; only the saved photo remains.
• Location — to GPS-tag captured photos (embedded in the photo’s EXIF data and stored alongside the photo), to support optional site-geofencing features that flag photos taken outside a configured site radius, to set an inspection’s site to where you are standing when you tap “Set site to my current location”, to look up the current weather when you tap “Get current weather” beside an inspection’s Weather field, and to order your own Today’s route from where you are when you tap “Start from here” on your Account page. Location data is only captured with photos or on those taps, and only if you grant permission; photo locations are stored locally with your inspection data, and the position read for Today’s route is used once to order the stops and never stored. The App does not track your location in the background.
• Weather lookup — on iPhone, iPad and Mac, once you turn it on in Settings, tapping “Get current weather” sends your device’s current coordinates to Apple’s WeatherKit service, which returns the current conditions. Apple’s own privacy policy governs that request. The App keeps only the resulting line of text (for example “72°F, partly cloudy, wind 8 mph (Apple Weather)”) in the Weather field, not the coordinates, and nothing is sent unless you tap the button. Beside a fresh result the App shows Apple’s Weather mark, which it loads from Apple, and an “Other data sources” link to Apple’s attribution page.
• Notifications — to show local reminders on your device for inspection and follow-up due dates, each naming its inspection, and to tell you about new work someone else gave you: an inspection assigned to you, a submission of yours sent back, an inspection waiting for your review or approval, or a follow-up set to your name. Such a notice names the inspection and who sent it, or that a schedule made it, only when it appears while the App is in use; at any other time, including when the App runs in the background, it names nothing and goes to the last person who used the device. Signing out, “Not you?” and resetting the App clear notices already delivered. These notifications are created and delivered entirely by your device’s operating system; no push-notification service or server of ours is involved.
• Running in the background — from time to time while the App is closed, your device’s operating system may run it briefly, at a time it chooses. In that run the App creates the day’s scheduled inspections, sends due-date alerts and waiting workflow events to the destinations your organization set up (Section 2.4), may fetch other devices’ changes from your organization’s Data Sync storage without sending this device’s changes or downloading media files (Section 2.5), and shows the notices described above. It does not read your location or contact us.
• Face ID / Touch ID — optionally, to unlock the App after it locks. The check is performed entirely by your device’s operating system, which tells the App only whether it succeeded; the App never receives, stores, or transmits any biometric data, and nothing about the check leaves your device or reaches us.
• Local network — only if you point the App at a server on your own network, such as sync storage, an email relay, a Single Sign-On provider, or an AI endpoint. Your device then asks once whether the App may connect to devices on your local network. The App connects only to the servers you set up, does not look for other devices on your network, and sends nothing about your network to us.

You can decline or revoke any of these permissions in your device settings; some features will simply be unavailable if you do.

2.3 Exports, backups, email, and sharing

• PDF/CSV export: Reports are generated on your device. If you choose to email a report, the App opens your device’s native email app — the report is sent from your own email account through your own email provider. If you choose to share or save a report or export, the App hands the file to your device’s share sheet or file picker, and where it goes from there (a cloud drive, a messaging app, a colleague) is your choice. We never see or receive it. Photos in a PDF keep the location stored inside them (Section 2.2) unless “Strip photo location data (GPS) from exports” is turned on in the report options; the report can still print each photo’s coordinates, and a map when maps are on (Section 2.8).
• Backup/restore: Settings → Backup lets an authorized administrator role export a snapshot of your organization’s data (inspections, items, photo and media metadata, comments, templates, schedules, users, the public halves of signing keys, branding and integration settings, and the audit log) to a file of your choosing, and re-import it later. A plain backup never includes password hashes or any credential (API keys, webhook URLs, bot tokens); restored user accounts must have their passwords reset. A passphrase-protected backup is encrypted on your device (AES-256-GCM, key derived from your passphrase with scrypt) before it is written, and when a Supervisor makes one it also carries, inside the encrypted file only, every account’s hashed password and the credentials for Data Sync, notifications, the AI Assistant, and maps — so your organization can fully restore onto a replacement device. Such a file is only as safe as its passphrase; we cannot recover a passphrase you forget, and if the file is lost you should rotate those credentials. The file is created and stored wherever you choose (device storage, cloud drive, etc., at your discretion) — we do not receive a copy.
• Setup links: A Supervisor or Integrations Admin can hand this device’s team settings to another of your organization’s devices as a setup link, shown as a QR code for the other device’s camera or shared as a link through an app you choose. The link carries the Data Sync connection details and, if chosen, the Single Sign-On settings (left out once this device shares them through Data Sync, Section 2.5), the notification, AI Assistant and maps settings described below, including their credentials, and your team’s Smart defaults (default site, department, template and days until due), with the name of the person who made it. All of it is encrypted on the device under a short setup code that is shown only on the originating device and is never part of the link. The link opens for 24 hours, and only with that code: on a device where a Supervisor or Integrations Admin enters it, or on a new installation set up for real work, under “Joining your organization?”, which uses only the link’s Data Sync connection and, if there is one, the person it names: it connects the device to your organization’s Data Sync storage and runs a first sync that brings your organization’s data (Section 2.5) to that device before anyone has signed in there, and that data is then available in the App only to people who sign in there. Where a Supervisor or Integrations Admin enters the code, the settings are stored as described in each section. The person making a setup link may also name who the new device is for: the link then carries that person’s name, email address and role and the name and email address of the person who named them, and that one person may set their own password on the new device, once. If you share the link through a messaging or email app, that app’s own policies apply to the message. Nothing in this passes through us.

2.4 Optional third-party notification integrations

The App lets a Supervisor or Integrations Admin optionally configure outbound notifications to third-party services of their choosing — for example Slack, Microsoft Teams, Discord, Telegram, email, or a generic webhook URL (e.g., pointing at your organization’s own ticketing system, SIEM, or an automation service such as Zapier, Make, Power Automate, or n8n).

If you enable one of these integrations:

• The webhook URL, bot token, signing secret, or other connection details you enter are stored locally on-device (in the keychain — see Section 2.1). They are never sent to us, and they are not shared with your organization’s other devices through Data Sync; only a one-way fingerprint of each destination is, as described below.
• When triggered, inspection-related notifications are sent directly from the App to the third-party endpoint you configured — not through any server we operate. Webhook endpoints must use HTTPS.
• Due-date alerts are checked and sent on their own by each device where they are turned on: when the App starts, when you return to it, every 15 minutes while it is open, and from time to time while it is closed, when iOS runs the App in the background. An alert that cannot be delivered is retried from that device for up to 7 days. When your organization uses Data Sync (Section 2.5), devices share which inspections and follow-ups each destination has been alerted about and when, so that a second device set up for the same destination does not repeat an alert within 24 hours. A destination is identified there only by a one-way fingerprint of its address, token or recipients, which does not reveal them; someone who already knows or guesses a destination could, however, check whether a fingerprint matches it. Email alerts go through the email relay (SMTP server) you configure or, if you connect a Microsoft 365 or Gmail mailbox, through Microsoft’s or Google’s mail service for that mailbox, using a sign-in token kept in the keychain (Section 2.1).
• A due-date alert lists the inspections that are due or overdue by title, and the follow-ups that are due or overdue by item label with their inspection’s title; sent to a generic webhook, it also carries those records’ identifiers. Beyond the titles and labels your team typed, it adds no names, email addresses, notes, photos, or locations.
• That third party’s own privacy policy and terms govern how they handle the data you send them. We have no access to, and no control over, that data.

Workflow events. Separately from due-date alerts, an Integrations Admin can turn on workflow events for a destination on a particular device. That device then sends an event to that destination when, on that device, an inspection is submitted, reviewed, approved, sent back with changes requested, or reopened; when a checklist item is marked a critical failure; or when a failed item’s follow-up is closed. An event contains the inspection’s title, location, area/department, template name, status, score, and due date; the name and role of the person who took the step and any reason they gave; counts of passed, failed, and not-applicable items; up to 25 failed items with their label, section, severity, notes, follow-up status, follow-up owner’s name, and follow-up due date; for a closed follow-up, its resolution notes; and, for a signed step, the signing key’s identifier and the record’s fingerprint. It never contains photos, videos, audio, drawn signatures, or email addresses.

Events are sent only from devices where they were turned on, including while the App is closed when iOS runs it in the background (Section 2.2), and never from the demo workspace (its “Send sample event” button sends a fixed, made-up example only). An event that cannot be delivered is retried from the device that holds it for up to 7 days and is then held back; a restore from backup turns workflow events off until an Integrations Admin turns them on again on that device.

You are responsible for only connecting integrations you trust and for complying with your own organization’s data-handling policies when you do.

2.5 Optional Data Sync (storage you control)

A Supervisor or Integrations Admin can optionally connect the App to storage that your organization controls: a bucket, container or file share at a storage provider your organization contracts with (Amazon S3, an S3-compatible service such as Cloudflare R2 or Backblaze B2, Google Cloud Storage, Azure Blob Storage, Azure Files) or a custom sync endpoint your organization builds and runs. Several devices on your team then share the same inspection data. There is no Inspection Hero cloud; the App only talks to the storage you configure.

If you enable this:

• The connection details you enter (endpoint or bucket, and the access key, SAS URL or API key) are stored locally on-device (the secret part in the keychain). When you save them, the App checks the connection by writing one small file to that storage, holding the device identifier from Section 2.1 and the time, and reading it back; for Azure, it also reads the expiry and permissions stated in the SAS and warns before the SAS ends.
• The App syncs on its own when it starts, when you return to it, every 15 minutes while it is open, and when your device reconnects to a network or moves onto Wi-Fi, as well as whenever someone taps Sync now; while it is closed, a background run may also fetch other devices’ changes, without sending this device’s (Section 2.2). Each sync sends your device’s recent changes to — and fetches other devices’ changes from — that endpoint: inspection records (including who each is assigned to, who assigned it and when), your team’s schedules (Section 2.1), checklist items and answers, comments, the metadata of photos and other media (captions, timestamps, and GPS coordinates where present), the photo, video, audio and drawn-signature files themselves, each stored under a fingerprint of its contents (a file over 5 GB, or larger than your storage accepts in one upload, stays on the device that holds it), and your team’s account records — each account’s name, email address, role, reviewer/approver flags, sign-in provider, whether its role was set by your identity provider, and whether it is active or waiting for a Supervisor’s approval — so that a person added or changed on one device exists with the same role on every device, the public half of each account’s signing key on each device, so that a sign-off signed on one device can be verified on every other, and each inspection’s change history — which account did what to the inspection, its checklist items, comments and media, when, and the previous and new values of the fields that changed — so that the audit trail on every device covers the whole team’s work (events about accounts, templates and backups stay on the device that recorded them), and your organization’s report branding — the company name, tagline, logo, contact details, colors and report wording set in Settings → Branding — so that every device prints the same letterhead, and your organization’s AI Assistant policy — whether the AI Assistant is on, whether people may use their own API keys, and where AI runs, with which account last changed it and when — so that every device follows the same setting, and your organization’s Single Sign-On settings — the identity provider’s address, client ID, allowed sign-in domains, group-to-role mappings and whether admins must sign in with it, with which account last changed them and when — so that every device signs in the same way (Section 2.6), and, for due-date alerts, a one-way fingerprint of each alert destination with the inspections and follow-ups it was alerted about and when (Section 2.4), so that two devices do not repeat the same alert. An account kept on one device only is not sent as an account record, though its name still appears on the work and history it touches, the public half of its signing key is shared, and it is counted in the license-usage record (Section 2.10). Passwords, password hashes, Face ID / Touch ID settings and the private half of a signing key never leave the device that holds them; an account arriving on another device needs a password set there. Other devices on your organization’s Data Sync connection download those files the first time they need them. Each change is labeled with the random device identifier described in Section 2.1 and, periodically, the App writes a full snapshot of those tables to the same endpoint.
• If your organization holds a Team or higher plan, the App also writes two small licensing objects to that same endpoint: a copy of your organization’s license key (so a new device that connects to the endpoint can pick the plan up without anyone re-entering it) and a per-device license-usage record — see Section 2.10.
• Everything sent to that server is under your organization’s control and governed by your organization’s own policies. We have no access to it.
• Data Sync endpoints must use HTTPS. The App will not save a plain “http://” endpoint for any server other than the device itself, because the API key and every inspection record would then travel unencrypted.

2.6 Optional Single Sign-On (SSO)

A Supervisor can optionally configure the App to let your team sign in through an identity provider (IdP) you choose — for example Okta, Auth0, Microsoft Entra ID, or Google — instead of an in-app password. Your administrator may restrict sign-in to your organization’s email domains; an identity outside that list is refused before any account is created.

If you enable this:

• The issuer URL and client ID you enter, with the allowed sign-in domains and any group-to-role mappings, are stored on the device and, if your organization uses Data Sync (Section 2.5), shared with your organization’s other devices through it, so that every device signs in the same way. None of these is a password or key. The issuer URL must use HTTPS.
• Test connection reads your identity provider’s public configuration and signing keys from the issuer URL and the key address it publishes, to check the setup before anyone signs in; nothing about any person is sent. SSO details is a plain-text description of this device’s Single Sign-On setup and of its last sign-in attempt (the issuer, client ID, redirect address, allowed domains and how many groups are mapped, the App version and platform, and the names, never the values, of what the identity provider returned) that you can choose to share with your administrator or with us through the share sheet. Apart from any error text your identity provider sent back, it contains no name, email address, token, or group.
• Signing in sends you directly to the IdP you configured to authenticate — not through any server we operate — and the App receives back your email address and display name as asserted by that IdP and, if your Supervisor maps directory groups to roles, the groups that IdP lists for you, used only to set your role.
• That IdP’s own privacy policy and terms govern how they handle your authentication data. We have no access to, and no control over, that data.

2.7 Optional AI Assistant

The App optionally lets you draft checklist templates and get suggested text for inspection, follow-up, review, and template fields (for example root cause, resolution notes, item notes, an inspection’s description or summary note, a reviewer’s reason for sending an inspection back, or a template’s description and changelog) using Apple Intelligence on your device, where your device supports it, or a third-party AI service you connect yourself (“bring your own key”) — for example OpenAI, or any compatible endpoint you choose, including one running on your own network.

Your organization chooses where AI runs, in Settings → AI Assistant: your AI key first (Apple Intelligence drafts when no key is set or the device is offline), on this device first (your AI key takes what Apple Intelligence on the device can’t, such as longer requests, and photos where Apple Intelligence on your device can’t read them), or only on the device (nothing is sent and AI keys are not used).

When Apple Intelligence drafts on your device:

• The request is processed by Apple’s on-device model. Nothing is sent to us, to Apple, or to any AI service, so no permission is asked.
• Where Apple Intelligence on your device can read photos, Draft from photo runs on the device too, and the photo never leaves it. Where it can’t, Draft from photo uses your AI key, as described below, and is not offered where AI runs only on the device.

When you connect your own AI service:

• The endpoint URL, model name, and API key you enter are stored locally on-device (in the keychain), and are never sent to us.
• When you use one of the App’s AI actions (such as “Generate with AI”, “Organize with AI”, “Suggest”, “Draft follow-ups”, “Fill by voice”, “Draft from photo”, or “Summarize with AI”), the content that action needs is sent directly from the App to the AI endpoint you configured — not through any server we operate — to generate a response, which is shown to you for review before anything is saved. Depending on the action, that is: your prompt describing a checklist; text the App recognized on your device from a photo, scan, or PDF of a checklist you chose, after you reviewed it (the image or file itself is never sent); for an item, its label, type, section, severity, status, recorded value, and the notes, root cause, and resolution notes written so far; for Fill by voice, the text your device transcribed from what you said, with the item details above, its answer choices or scale, and today’s date; for Draft from photo, the photo you chose, resized and with its location data removed, with the item details above; for an inspection, its title, location, area/department, status, template name, and item results, including the failed items’ sections, severity, notes, root causes, and resolution notes, whether each has a follow-up owner, and which required photos are missing; for a report summary, also the inspection’s score and the score and date of the previous approved inspection at the same location; for a report’s Insights page, the facts shown on that page (most-failed checks, checks failing again since the last visit, compliance scores, common root causes, and the number of overdue follow-ups), drawn from the inspection and the approved inspections at the same location in the 12 months before it, or from the inspections selected for a combined report; or for a template, its name, description, sections, and items with their answer type, severity, and photo and on-fail requirements, and, for a changelog, what changed since the saved version (including choices, weight, and which items show only after another item’s answer). The names and email addresses entered as follow-up owners are never included — only whether an owner is set.
• Before the first request a person makes to an AI service (its address, including the path), the App asks that person on that device for permission, naming the service; nothing is sent until they allow it. The answer is remembered for that person on that device only, and can be withdrawn in Settings → AI Assistant. If what the App sends to an AI service widens, you are asked again.
• That AI provider’s own privacy policy and terms govern how they handle the data you send them, including any use for improving their own models. We have no access to, and no control over, that data.
• Sending to an AI service is entirely optional and requires your (or your organization’s) own account and API key with the provider; nothing is sent unless you explicitly trigger one of those actions.

AI drafts are never stored on their own. When you save AI-drafted text, the inspection’s change history records which fields AI drafted and where it ran (on the device or through your AI key); that history syncs and stays with the inspection like the rest of its change history.

AI drafts can contain errors; the App shows each one for your review before anything is saved.

You are responsible for not sending sensitive or regulated content through this feature to a provider whose data-handling terms don’t meet your organization’s requirements.

2.8 Optional maps

A Supervisor or Integrations Admin can optionally turn on maps, so that exported PDF reports show a small map next to each GPS-tagged photo’s coordinates and an inspection’s Site Geofence section shows a small map of its site location. Maps come from the source they choose: Apple Maps (on iPhone, iPad and Mac, no key needed) or their own API key for Google Static Maps or Mapbox. Anyone can also choose Apple Maps for themselves in Settings → Maps; their maps then come from Apple, whatever the team’s choice. Until a source is chosen, the App shows plain coordinate text and no map request is ever made.

If you enable this:

• With your own API key, the key you enter is stored locally on-device (in the keychain).
• When you export a report, the GPS coordinates of each geotagged photo in that report are sent directly from the App to the map source you chose to fetch a map image, which is embedded in the PDF. Nothing else about the inspection is sent.
• When an inspection has a site location set, opening it sends that site’s coordinates and allowed radius directly from the App to the map source you chose to fetch the preview map. Nothing else about the inspection is sent.
• With Apple Maps, the App asks Apple’s Maps service for the map around each of those locations and draws the map on your device; no key or account is involved. Apple’s own privacy policy governs those requests.
• That source’s own privacy policy and terms govern how they handle those coordinates. We have no access to, and no control over, that data.
• Separately from maps, tapping a stop on Today’s route opens it in Apple Maps for directions, which hands that stop’s coordinates to Apple’s Maps app; Apple’s own privacy policy governs it.

2.9 Crash reporting and diagnostics

The App contains no crash-reporting or diagnostics library and sends no error reports anywhere; errors are only written to the device’s own console log. If a future release adds crash reporting, we will update this policy before it ships, and any reports would be limited to technical error details (stack traces and which feature was in use) — never your inspection content, photos, location data, or credentials.

2.10 License keys and license usage

Paid plans are activated with a license key that a Supervisor enters in the App. The key contains your organization’s name, the plan, its user ceiling, issue and expiry dates, and a license identifier — no personal data. The App verifies the key’s signature on your device; it never contacts us to check, activate, or report a key, and we have no record of which devices a key is used on.

Plan purchases happen outside the App and never through an app store. When you buy from us, we receive the order details needed to issue your key and bill for it: the organization name, the plan and any add-ons, a contact name and email address, the billing address, and, if you provide them, a purchase order number and a tax exemption certificate. Any payment processor we use (for example Stripe) receives your payment details under its own privacy policy; we never receive your full card number. We keep order records for as long as tax and accounting law requires. Tapping “See pricing” (or “Renew your plan” when a renewal is due) in Settings → Plan & license opens our pricing or purchase page at inspectionheroapp.com; like any website visit, that request carries your device’s IP address, and the App adds nothing else to it.

On Team plans and above with Data Sync enabled, each of your organization’s devices writes a small license-usage record to your organization’s own Data Sync storage (Section 2.5) when it syncs, and reads the other devices’ records back. A record contains the device identifier from Section 2.1, the license identifier, the plan, the App version, a timestamp, and one-way hashes of the email addresses of the accounts on that device — not the addresses themselves (the account records synced under Section 2.5 carry the address itself). Records are encrypted with a key derived from your license key, so only devices holding your license can read them. The App uses them to count distinct users across your organization against your plan’s ceiling and to show that count to your Supervisors. Nothing in this process is sent to us; retention is governed by your organization (Section 3).

2.11 What we do NOT collect

We do not embed analytics or advertising SDKs in the App, and we do not operate a server that receives your inspection data, photos, location history, account credentials, or license usage. We have no ability to access, sell, or share data we never receive; the license-usage records described in Section 2.10 go to storage your organization runs, not to us.

2.12 If you contact us

If you email us, for example at support@inspectionheroapp.com, we receive your email address, the name your email app sends with it, and whatever you write or attach. Report this draft, under an AI draft, opens a message in your own email app that names only the AI feature, where it ran (on your device or through your AI key) and the App’s version; nothing from your inspection, not even the draft, is included unless you add it, and nothing is sent until you send it. If you share SSO details with us (Section 2.6), we receive that text. If you book guided setup, we also receive what your staff choose to show or tell us during the consult. We use what you send only to answer you and to fix problems, and we keep it while your request is open and for up to 12 months after it is resolved, then delete it, unless the law requires us to keep it longer.

3. Data Retention and Deletion

If you use the app in demo mode (offered on first launch on every platform), the sample data is fictitious, lives in a separate database that “Exit demo” deletes, and is marked DEMO throughout; it is not intended for real inspections. A demo runs for seven days — when that period ends the app deletes the demo database by itself and returns to the first-launch choice.

Because all data lives on your device, you control retention and deletion:

• Deleting an inspection, photo, or user within the App removes it from the local database.
• You can delete your own account in Settings → Account → Delete my account, confirming with your password or, for a Single Sign-On account, by signing in with your identity provider again. That removes the account from the device together with its sign-in details, its Face ID / Touch ID setting, its AI Assistant permission, and the private half of its signing key; if your organization uses Data Sync, the account is also removed from its other devices the next time they sync, and it comes back only if a Supervisor adds it again or, where your organization’s identity provider assigns roles, you sign in with it again. Inspections and sign-offs the account made stay as your organization’s record, since a signed record can’t be altered without breaking its signature, and the public half of its signing key stays so those sign-offs can still be verified. If your organization uses Data Sync and yours is its only Supervisor account, make someone else a Supervisor first. If yours is the last Supervisor account on the device, deleting it also resets the device’s workspace — with Data Sync, only once the deletion has reached your organization’s storage.
• Uninstalling the App, or clearing its app data, permanently deletes all locally stored data (including backups you haven’t separately saved elsewhere). This cannot be undone.
• Backup files you’ve exported persist wherever you saved them until you delete them yourself.
• If your device backs itself up to iCloud or to a computer, the operating system includes the App’s local data in that device backup, under your own backup settings and Apple’s privacy policy; deleting data in the App doesn’t remove it from device backups already made.
• If your organization enabled Data Sync, copies of synced records — and, on Team plans and above, the licensing objects described in Section 2.10 — also live in the storage your organization configured; retention there is governed by your organization and its storage provider, not by us.

4. Data Controller Note for Business/Team Use

If you’re using Inspection Hero as part of an organization (e.g., under a Team, Business, or Enterprise plan), your employer or organization determines what inspection data is entered, who can access it, how it’s retained, and which optional integrations (Data Sync, SSO, AI Assistant, notifications, maps) are connected — Inspection Hero is a software tool provided to that organization, not a party with access to the data it stores. The hashed account email addresses in the license-usage records (Section 2.10) are pseudonymous data held in storage your organization controls; your organization is responsible for that data. Questions about your organization’s specific data-handling practices should go to your organization’s administrator, not to us.

A Supervisor’s Team tab shows each person’s open work (assigned, overdue, follow-ups they own and next due), how their scheduled visits were kept (on time, late or missed), the team’s median time to approve, and recent activity (sign-offs, send-backs with their reasons, reopenings, reassignments, make-ups and closed follow-ups, each with who did it). It is worked out on the Supervisor’s device from records already there and shows no one’s speed or streaks. Its PDF or CSV export names each person with their open work and visits and, like other exports (Section 2.3), goes only where the Supervisor sends it. Nothing is sent to us.

5. Children’s Privacy

The App is intended for business/workplace safety and quality-inspection use and is not directed at children. We do not knowingly collect personal information from children under 13 (or the relevant age of digital consent in your jurisdiction). Since the App does not transmit data to us at all, we have no visibility into who uses it — but if you believe a child has used the App in a way that concerns you, please contact us and we’ll help however we can.

6. Security

Local data is protected by your device’s operating system storage sandboxing. Account passwords are stored using a salted, iterated cryptographic hash (PBKDF2) — never in plain text. Each submission, review, approval, change request and reopening of an inspection is signed with a key that belongs to that account on that device; the private key is sealed under the account’s password (for an account that signs in only through Single Sign-On, under a random secret kept on that device) and held in the operating system keychain, and a signature that no longer matches the record is shown as failed rather than hidden. Integration credentials are held in the operating system keychain; those needed while the App runs in the background (the alert credentials, the mailbox sign-in token and the Data Sync key) can be read once the device has been unlocked after it restarts, and the rest only while the device is unlocked. Backup files include an integrity signature; tampered or unsigned backups require explicit acknowledgment before import, and restored accounts from such files are downgraded to the Inspector role until an administrator re-assigns them. Optional passphrase-protected backups are encrypted with AES-256-GCM under a key derived from a passphrase of at least 15 characters using scrypt, a memory-hard function designed to resist guessing on specialized hardware. Single Sign-On, webhook and Data Sync endpoints must use HTTPS, and the App warns when an AI endpoint does not. No method of storage is 100% secure, and you’re responsible for your device’s own security (passcode, encryption, physical safekeeping) and for the security of any server or third-party service you connect.

7. Changes to This Policy

We may update this Privacy Policy from time to time, for example as features are added. We’ll update the “Last updated” date above when we do. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

8. This Website (inspectionheroapp.com)

Sections 1–7 above describe the Inspection Hero App. This section covers inspectionheroapp.com itself — the site you’re reading right now.

• Contact form. If you use the contact form on this site, we receive the name, email address, and message you submit, in order to respond to you. We keep that submission in our website’s database until we’ve resolved your inquiry and for a reasonable period afterward, or until you ask us to delete it.
• Orders, invoice and quote requests. If you buy a plan, or request an invoice or a quote on this site, we receive the order details described in Section 2.10, the number of users the order or quote is for, and any discount you tell us you qualify for, in order to issue your quote, invoice and license key. Card payments are handled by our payment processor (Stripe), which receives your payment details under its own privacy policy. We keep order records for as long as tax and accounting law requires.
• Cookies. This website does not set analytics, advertising, or tracking cookies. If that changes, we’ll update this section first to name what’s used and how to opt out.
• Server logs. Like virtually every website, our hosting provider automatically logs visitor IP addresses and basic request information (page requested, the requesting software, timestamp) for security and operation. We don’t otherwise track visitors across this site or across other websites.
• Comments and accounts. This website does not offer public comments or visitor account registration, so no comment or account data is collected here.

9. Contact Us

Questions about this Privacy Policy? Contact us at:

support@inspectionheroapp.com

---