Privacy Policy

We collect what we need to run a contractor-management platform — company profiles, safety metrics, training records, and contact details — and nothing we don’t. We don’t sell your data. We don’t share it with advertisers. Hiring clients you connect with see your compliance profile; nobody else does.

• Account information — company name, contact name, email, phone, and business identifiers (DUNS, SIC codes) you provide during signup or prequalification.
• Compliance data — safety metrics (TRIR, DART, EMR, hours worked), training records, certificates of insurance, written safety programs, and prequalification form responses you or your team upload.
• Worker records — names and training completions for workers you add to your roster. You are responsible for having the right to share this information.
• Site-orientation records — when a worker completes a hiring client’s site orientation on their own device, we record the name, email, and phone they enter, their quiz answers, the typed attestation signature, and the IP address and browser identifier of the device used, so the hiring client has an auditable completion record. The hiring client that published the orientation, and the worker’s employer, can see it.
• Usage data — pages viewed and actions taken, collected first-party (no third-party ad trackers). On our public marketing pages this includes a first-party cookie named idn_vid (a random visitor identifier, kept for up to one year), the referring page, and any campaign (UTM) tags in the URL, so we can tell which pages and campaigns bring visitors. Some gated pages set a cookie remembering that you unlocked them. Our public blog posts are written in a third-party publishing service (Soro) and rendered by our own servers; no script from that service runs in your browser.
• Billing data — payment is processed by Stripe; we never see or store full card numbers.
• Marketing consent records — when you tick the “I agree to receive emails” box on one of our forms, we store your email address, the exact wording you agreed to and its version, which form you used, the time, your browser identifier, the page you were on, and a salted one-way hash of your IP address (not the address itself). If you unsubscribe, we keep your address on a suppression list so we do not email you again; that list is the one record we never delete on request, because deleting it would let us mail you by mistake.

• To compute your compliance score and surface it to hiring clients you apply to or connect with.
• To verify workforce size against public and commercial sources (Dun & Bradstreet, OSHA ITA) for plan sizing.
• To prepare quotes, invoices, and compliance reminders inside the product.
• To email you about Idoneity only if you ticked the consent box on a form, and only the kind of email that box described. Our email provider (Resend) processes the message on our behalf and sees your address and the message content; it does not use either for its own purposes. Every marketing email has an unsubscribe link, which works without logging in, and we honour it within ten business days. See the Terms (“Marketing email”) for the full statement.
• To review uploaded safety programs and training records using AI models (Anthropic Claude). Documents sent for AI review are not used to train those models.
• To publish RFPs you post: if you choose the “pool and public” visibility for an RFP, a redacted copy (no contact details) is sent to Bidwell, our sister marketplace, so more contractors see it. RFPs kept to your pool never leave Idoneity.

Hiring clients on the platform see the compliance profile you choose to share with them — scores, training coverage, safety metrics, and document review status. Platform administrators can access data to provide support. We use a small set of subprocessors to run the service. Always: Cloudflare (hosting, storage, and backups), Turso (database), Stripe (payments), Anthropic (AI document review), and Soro (public blog publishing). Only when a feature that uses them is purchased and turned on: ElevenLabs (voice narration for site-orientation videos — receives the orientation script text, never worker data), Replicate (image generation for orientation visuals — receives image prompts, never worker data), Bidwell (redacted RFP cross-posting, described above), and Dun & Bradstreet (workforce-size lookup — receives your company name and identifiers). We do not sell personal information to anyone.

We keep your data for as long as your account exists. Compliance records have regulatory retention windows (for example, OSHA training documentation), and we retain those accordingly. When a subscription ends, the account is locked rather than deleted, so hiring clients keep the compliance history they relied on and you can reactivate without starting over. You can ask us in writing to delete personal information that is not subject to a legal retention requirement; we will confirm what was deleted and what had to be kept, and why.

You can request a copy of your data, correct it, or ask us in writing to delete it by emailing hello@idoneity-cms.com. We respond within 30 days.

If this policy changes materially, we’ll post a notice in the product for signed-in account holders before the change takes effect and update the effective date above.