Privacy Policy

If you use PortalBase because of your job, a company gave you access. We call that company the Customer. The Customer decides what the Service collects about its people, why, and how long it's kept. We handle that information for the Customer, on its instructions, as its service provider (also called a processor).

So for questions about your records at work, ask your employer first. Their privacy notice applies alongside this one. For information we collect on this website, or for our own business, we decide what's collected and why.

On this website:

• What you type into the contact form: your name, work email, company, and a description of the task you want to verify.
• Your email address, if you sign up for new free tools and guides. We use it to send those updates and for nothing else, and every message lets you leave. The free calculators and builders run in your browser. What you type into them stays there, and some save it in your browser's local storage so it's there when you come back.
• If you use "Email me this demo" on our demo page: your email address and, if you give it, your name. We use them to send you the link and to know who asked for it.
• Anonymous usage counts from the demo, such as which industry was picked and which steps were tried. They are collected without cookies and aren't tied to your name or email.
• Basic technical data our hosting provider records for security and reliability: IP address, browser type, and the pages requested.
• How people use this website, through Google Analytics: pages viewed, how you got here, rough location, and device and browser type. Google sets cookies to count return visits. This runs on our public website only, never inside the Service.

Through the Service, depending on how the Customer sets it up:

• Account details: your name, work email or phone number, employee ID, role, language, the sites and crews you belong to, and how you sign in (your company's single sign-on, a text-message code, an employee ID and PIN, or a QR badge).
• Work records: training progress and quiz results, inspection results, form answers, signatures, notes, photos, video and other attachments, tasks and assignments, certifications, and incident reports. Each record carries the person who did the work and when.
• Location: captured when you capture or submit a record, if the Customer's template asks for it. We don't track your location in the background.
• Device and app data: device type, operating system and app version, a push notification token, crash and performance reports, and sync status.
• AI feature activity: if the Customer turns on AI features, the questions asked and the passages returned.
• Messages we send you: sign-in codes, assignment reminders and service notices by text, email or push.

• To run the Service: sign you in, sync your work between your phone and the web, store records, and send the messages above.
• To keep it secure: prevent abuse, investigate problems, and keep an audit log of changes.
• To support Customers and fix bugs.
• To improve the Service, using de-identified or aggregated information where we can.
• To answer people who contact us through this website.
• To meet legal obligations and protect our rights.

We don't sell personal information. We don't share it for advertising across other companies' sites or apps. We don't use Service data to build advertising profiles.

If a Customer turns on AI features, such as answering questions from the company's own documents or translating course text, the content involved can be processed by AI model providers working for us under contract. Their outputs can be wrong. The Customer's people should check them before relying on them.

To make a Customer's documents searchable by meaning, not just exact words, the text of those documents is sent to an AI model provider that turns it into search data. We only use providers whose terms say they don't use that content to train their models.

If the Customer allows it, a person can connect an AI tool of their own choosing, such as Claude, ChatGPT or Microsoft 365 Copilot, to PortalBase. They sign in to PortalBase and approve the connection first, and can choose whether the tool may only look things up or may also make changes.

The tool sees only what that person can see in PortalBase and can do only what they can. What it looks up, such as names, work records and document passages, goes to that AI tool's provider under the person's or their company's own account with it, and that provider's terms and privacy policy apply to it there. Every change it makes goes in the Customer's audit log under the person's name.

The person can disconnect the tool from their profile at any time, and the Customer's administrators can disconnect it or turn AI connections off for everyone. Disconnecting stops it right away.

• The Customer. Its administrators can see its people's records and the audit log, and can export them.
• Service providers that help us run PortalBase, under contracts that limit how they use the information. They fall in these groups: cloud hosting and database, file and video storage and processing, email and text-message delivery, sign-in and directory sync, error monitoring, website analytics, background jobs and sync, and AI model providers. We'll give a current list to any Customer on request.
• Other systems the Customer connects, such as an HR or maintenance system, when the Customer sets that up.
• An AI tool a person connects, as described under "AI tools you connect".
• Professional advisers such as lawyers, auditors and insurers, when they need it.
• Authorities, when the law requires it or to protect people's safety or our rights. When the request is about a Customer's data, we'll point the requester to the Customer unless the law says otherwise.
• A buyer or successor, if we're part of a merger, sale or similar deal. The same promises would carry over.

Customers set retention for each type of record, and can place legal holds that override it. We keep Service data as long as the Customer's account is active and as the Customer instructs. After an account ends we return or delete the Customer's data within a reasonable time, and copies in backups age out on their normal schedule.

When a Customer deactivates a person, access ends right away and the app's data clears from their phone the next time it connects. Nothing else on the phone is touched.

We keep contact-form messages as long as we need them to respond and to keep ordinary business records.

The app only sees its own data. It asks for permission to use the camera and microphone when you record a photo or video, location when a capture needs it, and notifications. You can change these in your device settings. Some features won't work without them.

The app stores data on your phone so it works with no signal. It's encrypted by the phone's own protection and syncs when you're back online.

We separate each company's data from every other company's, encrypt it in transit and at rest, limit who on our team can reach it, and log changes. No system is perfectly secure. If we learn of a breach affecting Customer data, we'll tell the Customer without undue delay.

Depending on where you live, you may have the right to know what we hold about you, get a copy, correct it, delete it, or object to certain uses. California and several other states give these rights by law. We don't sell or share personal information for cross-context advertising, so there's nothing to opt out of there.

For Service data, contact your employer, the Customer. We'll help them respond. For website data, or if you're not sure who to ask, email hello@portalbaseai.com. We may need to confirm who you are first. We won't treat you worse for using these rights. If we deny a request, you can ask us to explain, and you may be able to appeal or complain to your state's attorney general.

This website uses the technical storage it needs to work, and Google Analytics cookies to understand how people use it. It doesn't run advertising trackers, and the Service doesn't use Google Analytics. You can block these cookies in your browser settings or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

PortalBase is for workers and their employers. It isn't meant for anyone under 16, and we don't knowingly collect their information.

We host in the United States to start. If you use the Service from another country, your information is processed in the United States.

We'll post changes here and update the date above. For changes that matter, we'll tell Customers directly.

Questions about privacy: hello@portalbaseai.com.