HazRecord does not sell, rent, or trade your personal information, or your facility or chemical data in any form that identifies you, your organization, or your facility, to third parties. This applies to every plan, including Free.

We do produce and may commercialize aggregated, de-identified data — for example, industry-level chemical inventory benchmarks and trend statistics — as described below and in Section 3 of our Terms of Service. That data never identifies you or your facility.

Account information (name, email, password hash), billing information (handled by Stripe — we do not store raw card numbers), and the facility, chemical, SDS, and contact data you enter to use the Service.

We may combine information across facilities and remove identifying details to produce statistics, benchmarks, and analyses — for example, “the typical quantity range of a given chemical at metal finishing facilities of a certain size.” Data in this form does not identify you, your organization, any facility, or any individual, and cannot reasonably be used to do so, and we apply minimum-group-size and similar safeguards before any such data is used outside the Service.

We use aggregated, de-identified data to improve the Service and to build compliance analytics, benchmarking, and similar data products. Where we offer such analytics back to customers, your identifiable data is never visible to another customer.

We transmit your Tier II filing data to the relevant state agency (SERC), local emergency planning committee, or fire department only when you direct us to do so as part of using the Service to file your own report.

In the future we may offer optional programs that let you share verified, identifiable compliance information with a party you designate (for example, your insurer). Any such program will require a separate, explicit opt-in inside the Service, will never be required to use HazRecord, and can be withdrawn prospectively at any time.

We use the following third-party service providers to operate HazRecord. Each processes data only as needed to provide their specific service to us, not for their own independent use:

• Supabase — database hosting and file storage (SDS documents, facility attachments)
• Stripe — payment processing and subscription billing
• Resend — transactional email delivery (invites, reminders, filing confirmations)
• Vercel — application hosting
• Cloudflare R2 — encrypted database backup storage

We retain your account and facility data for as long as your account remains active, or as needed to provide the Service to you. We do not currently have an automated process that deletes data from accounts that have been inactive for an extended period — your data persists until you delete your account or request removal.

If you’d like your data deleted, contact info@hazrecord.com and we will process the request. Deleting your account removes your identifiable data; previously created aggregated or de-identified data that no longer identifies you may be retained.

Data is encrypted in transit and at rest through our infrastructure providers. Access to your account is protected by password authentication. As with any software, no system is perfectly secure — see our Terms of Service for the limitations on what we can guarantee.

You can access, update, or delete most of your account and facility information directly within the Service. For anything you can’t change yourself, or to request a full account deletion, contact us directly.

We may update this policy as the Service evolves. We’ll update the date at the top of this page when we do, and for material changes to how your data may be used or shared, we’ll provide notice within the Service or by email before the change takes effect.

Questions about this policy: info@hazrecord.com