Privacy Policy

Who we are

Compliancefold is maintenance and compliance management software (CMMS) - equipment records, preventive maintenance schedules, and work orders - for facilities and the agencies that inspect and regulate them. Compliancefold is a trade name of Sushifun LLC, a Kansas limited liability company in Topeka, Kansas.

The records an organization, agency or service provider keeps in Compliancefold are that customer's. It decides what goes in, who among its people can see it, and how long it is kept, and we handle those records on its behalf. We decide how we handle the rest: accounts, applications to join, billing, and the records that keep the service secure.

What we collect

• Account information - your name, email address, role, and the organization, agency, service provider or facilities you are associated with.
• Applications to join - the name and email address you confirm, the organization, agency or company you apply for and the facilities or territory it names, a billing contact where one is needed, and a document showing your standing where the plan asks for one.
• Contact details you choose to add - including a mobile phone number, if you add one for text notifications.
• Facility and compliance records - facility addresses and attributes, inspections and their results, violations and corrective actions, equipment, maintenance work orders, parts, vendors, reports a service provider files and the credentials it files them under, and documents and photos that users upload.
• Facility information from public sources - names and addresses of facilities from public registers, so a customer can find its own instead of typing it. The sources are listed on our data licenses page.
• Problem reports from the public - when someone uses a facility's problem-report link, the name they give, what they describe, where it is, and a photo if they add one. We do not ask for their email address or phone number.
• Payment information - for a paid plan, the billing contact and the plan and payments. Card details are entered straight into the fields of Stripe, our payment service; we never receive or store a card number.
• Activity and security records - when you sign in (the time, how you signed in, and the IP address and browser you used), which documents you open, changes to passwords and two-factor settings, changes to accounts and to who can access what, and any occasion on which Compliancefold staff view the service as you.
• What you agreed to - when you accept our terms or a founding agreement: which version, when, your name and email address, and the IP address and browser you used. We keep it as the record of the agreement.
• Basic technical data - error reports and the usual server and security logs generated when you use the service.

We do not sell personal information, and we do not collect it from children.

How we use it

We use this information to operate the service: to review an application to join, to sign you in, to show you the facilities and records you are entitled to see, to notify you about inspections, maintenance, and warranty deadlines, to take payment where a subscription applies, to keep a record of account activity that your organization or agency can review, and to keep the service secure and working.

The email and text messages we send are about the service. We do not send advertising, and we do not use the records customers keep here to train artificial intelligence models.

Phone numbers and text messages

Adding a mobile number is optional. If you add one and opt in, we use it only to send you the service notifications described in our SMS notification terms.

We do not sell or share phone numbers or SMS opt-in and consent data with third parties or affiliates for their own marketing purposes. Text-message consent is never shared with anyone for marketing, and it is not used for marketing by us either.

You can withdraw consent at any time by unticking the consent box or removing your number in Account settings, or by replying STOP to any message.

Health information

Compliancefold keeps records about buildings and equipment. It is not built to hold patient or other protected health information, and we do not sign business associate agreements. Please do not upload patient information, including photos that show patients or their records; the app reminds people of this when they add a photo or file.

If some is uploaded by mistake, tell us at the address below and we will remove it. The file and its name are deleted, and the record it was on says that a file was removed and when. Copies in our backups are deleted automatically within 90 days.

Who else sees it

Other users of the service see what their role allows: an agency's staff can see the facilities they oversee, and a facility's managers can see their own facility's records.

A service provider's reports, with its name and the credentials each was filed under, are seen by the agency it filed with and by the team of the facility the report is about. An agency sees a service provider only once the provider has asked to file with it. A problem report from the public goes to the team of the facility it was sent to.

Your organization's owner, or your agency's administrators, can see its activity log, including when its people signed in, from where, and which documents they opened. A facility's managers can see changes to who can access that facility, and who opened its documents.

Compliancefold staff may view the service as a particular user to help with a problem. While doing so they cannot change anything, and each such view is recorded in the activity log your organization or agency can see.

We also rely on service providers who process data on our behalf, and only to provide the service: Supabase (database, authentication, and file storage), Cloudflare (hosting, keeping nightly backup copies, and counting page views and load times without cookies and without tracking individual visitors), GitHub (continuous integration and a weekly restore rehearsal on short-lived machines), Twilio (text messages), Resend (email), Stripe (payment processing), OpenStreetMap's Nominatim service (looking up an address as you type it), and an AI service (reading what someone asks to have drafted - a checklist document, a filed report, an equipment manual, or a spreadsheet's column names with a few of their values - to draft a record for that person to review before anything is saved; the AI service does not use it to train its models). We do not otherwise sell, rent, or trade your information.

We may disclose information if required by law, or to protect the rights and safety of users and the public.

Where it is kept

In the United States. The database and uploaded files are hosted in Oregon, and the nightly backup copies are kept by a different provider in eastern North America.

On your device

The service keeps you signed in with a cookie, and remembers a few display preferences in your browser. So that inspections and maintenance work can be done without a connection, it also keeps copies of the records you use for that work - such as checklists, documents and photos - in your browser's storage on that device.

Those copies are kept only as long as they are needed. Work you record is removed from the device once it has reached our servers, and everything already sent is removed when you sign out. Copies kept for reading are removed when they have not been refreshed for 30 days. Work that still has not been sent is flagged on the device after 7 days, and removed from it after 30 days - it will not reach our servers after that. Removal happens when the app is next opened, so a device's own lock screen and encryption are what protect these copies in between.

The browser may remove them sooner. Safari on an iPhone or iPad deletes everything a site keeps on the device after 7 days of using Safari without visiting it, work not yet sent included; the app added to the home screen is exempt, and keeps its copies apart from Safari's. Where a browser will not let the service keep anything on the device at all, the service says so, and stops using that storage until it tries again, within a day.

How long we keep it

• A customer's records - for as long as its account exists, since the inspection and compliance history is what the service is for.
• Records someone deletes - held for 30 days, in case it was a mistake, and then permanently removed with their files.
• A closed account - before we delete its records, we give its owner or administrator 30 days' written notice and a last chance to export them. We do not delete records an agency is required to keep while that requirement lasts.
• Activity records - at least a year, or longer where an organization or agency has set a longer period to meet its own compliance obligations, and then deleted automatically.
• Applications to join - kept with the decision made on them, approved or not, so the decision can be explained later. Ask us and we will delete an application that was not approved, with its documents.
• Backups - nightly copies are kept for up to 90 days and then deleted, so anything deleted from the service is gone from every copy within 90 days.

Data is encrypted in transit, access is restricted by role, activity records cannot be altered, and two-factor authentication is available on every account.

If something goes wrong

If a security incident affects a customer's information, we tell that customer's owner or administrator without undue delay, and within 72 hours of confirming it, with what happened, what was affected, and what we are doing about it. Where the law requires us to notify anyone else, we do.

Your choices

You can view and update your account details and contact information at any time from Account settings. Your organization's, agency's or service provider's owner or administrator can export all of its records and files at any time from the app, on every plan.

To ask for a copy of your own information, or for its correction or deletion, write to us at the address below. We answer within 30 days. For information that is part of a customer's records - an inspection of your facility, or a work order you were assigned - the customer that keeps them decides, and we will pass your request to it. Some inspection records must be kept by the agency that made them.

Changes

If this policy changes, we will update this page and the date at the top.

Contact

Questions about privacy can be sent to support@compliancefold.com.

More

SMS notification terms · Terms of service · Data licenses