FORC Inspection Privacy Policy
Version 1.0 · Effective November 3, 2026
Oregon Radio Company LLC ("we") runs FORC Inspection (F.O.R.C. — Facilities Operational Reports & Compliance). This explains what we collect, why, where it's kept, who helps us, and your choices. We don't sell or share personal information for advertising, and we don't show ads.
Our two roles
For account and billing information about our customers' managers, we decide how it is used. For inspection records, photos and workers' names that customers put into FORC Inspection ("customer inspection data"), the customer (the employer) decides, and we act as the customer's service provider (processor), handling that data only to provide the service under our Terms of Service.
What we collect
- Managers and owners: email address, role, sign-in times, optional two-step sign-in settings (stored encrypted), alert preferences, and an activity log of account actions such as adding equipment or inviting people, including the IP address.
- Workers: the name they type on the inspection screen (remembered on their own phone), their inspection answers, notes, photos, the time, and the equipment. Workers don't create accounts. We store the time and the browser/device description sent with each submission. We don't store workers' IP addresses with inspection records, but IP addresses appear in our security and request logs (see Retention). The name a worker types is remembered in a cookie on their own phone for up to a year so they don't retype it. We don't use photos for facial recognition or any biometric purpose.
- Billing: Stripe collects card details directly. We receive the customer's name, email, plan and payment status, not full card numbers.
- Sticker orders (when offered): shipping name and address.
- Free checklist tool: if you enter your email, we store it with the checklist type you chose. We don't send marketing or newsletter email today. If we start, we'll ask you to confirm first, and every message will include an unsubscribe link and our mailing address. Email forc@theorc.dev to have your address removed.
- Website logs: standard request logs (IP, browser, pages) used for security and fixing problems. We use only cookies needed to keep you signed in, protect forms, and remember a worker's name on their own phone; no advertising or tracking cookies.
Why we use it
To run the service, keep records, send alerts and sign-in codes, bill you, ship stickers, prevent abuse, provide support, and meet legal obligations. We send service email (codes, alerts, invites, receipts); these aren't marketing.
Where it's stored
FORC Inspection runs on Amazon Web Services (AWS) in the US West (Oregon) region, and customer inspection data is stored in the United States. Inspection data is stored in Amazon DynamoDB (encrypted at rest with AWS KMS) and photos in a private Amazon S3 bucket (encrypted at rest, all public access blocked); everything is sent over HTTPS. Photos are never public; they're shown only to signed-in members of the customer's account through short-lived links. Sign-in cookies are marked Secure and HttpOnly and expire after 12 hours.
Service providers (subprocessors)
We use service providers in these categories: cloud hosting and storage, email delivery and sign-in, payment processing, DNS and email routing, support email, and (when sticker orders are offered) postal delivery. The providers we currently use are:
| Provider | What they do | Location |
|---|---|---|
| Amazon Web Services | Hosting (Lambda, CloudFront, WAF), database (DynamoDB), photo storage (S3), sign-in codes (Cognito), sending email (SES), logs and monitoring (CloudWatch) | United States |
| Stripe | Payments, billing and receipts | United States |
| Cloudflare | DNS, and forwarding of email sent to our support address | Global network |
| Google (Gmail) | Receives and stores support email | United States |
| U.S. Postal Service | Delivers sticker orders (when offered) | United States |
We'll update this list, and email account owners, at least 30 days before adding a provider that handles customer inspection data. We may also disclose information if the law requires it, to protect people or the service, or as part of a sale or merger of the business, in which case this policy continues to apply.
Customer data and workers' requests
Inspection records belong to the customer (the employer). Customers should tell their workers that names, answers, notes and photos are recorded. If you're a worker and want your information changed or removed, contact your employer first; we'll help them handle the request.
Retention and deletion
Different kinds of information are kept for different reasons. We don't keep personal information longer than one year after it is no longer needed unless the law requires it.
- Customer inspection data (equipment, checklists, inspections, photos, notes):
- Free accounts are deleted after 90 days with no activity (a manager sign-in or an inspection submitted by QR scan), after warning emails to the owner at day 60 and day 83 with a one-click "keep my account" link.
- After a paid plan ends, the account is read-only (view and export) for 90 days, then deleted, with warning emails 30 days and about 7 days before.
- The account owner can ask for earlier deletion at any time at forc@theorc.dev; we delete it from the live system within 30 days of the request.
- Until this schedule is switched on in the product, we don't delete data automatically.
- Backups: database backups (point-in-time recovery) are kept for 35 days, so deleted data ages out of them within 35 days. Deleted or replaced photos are kept as prior versions in photo storage for up to 90 days, then removed.
- Account activity log (including IP addresses of manager actions): kept as long as the account exists and deleted with it.
- Billing and tax records (invoices and payment records, not inspection data): kept as long as tax law requires, generally up to 7 years, mostly held by Stripe.
- Security and request logs (application logs and website access logs, which include IP addresses): kept for up to 90 days.
- Support email: kept for up to one year after the conversation ends, unless needed longer for a legal or billing matter.
You are responsible for your own record-keeping needs. Export anything you must keep before it is deleted.
Your choices and rights
You can ask to see, correct, export or delete your personal information by emailing forc@theorc.dev. We'll answer within 45 days. If you are a worker, your request about inspection data may be passed to your employer, who controls it.
Oregon privacy law. We believe the Oregon Consumer Privacy Act likely does not currently apply to us: it covers businesses above size thresholds (generally 100,000 Oregon consumers, or 25,000 plus more than 25% of revenue from selling personal data), and it treats people acting in an employment or business role differently from consumers. We don't claim compliance with every privacy law, and we will reassess as we grow. Oregon's data security and breach-notification law (ORS 646A.600 to 646A.628) applies regardless, and we follow it.
Security and breaches
We use encryption in transit and at rest, one-time email codes for sign-in, optional two-step sign-in, per-company data separation, a web application firewall, access logging and monitoring alarms. No system is perfectly secure. If a security incident affects customer data, we notify the customer's account owner within 72 hours of confirming it. We notify affected people, and regulators where required (including the Oregon Attorney General when more than 250 Oregon residents are affected), as the law requires and no later than 45 days after discovery.
Children
FORC Inspection is a workplace tool and is not meant for anyone under 16.
Changes and contact
We'll post changes here, with the date at the top, and email account owners about material ones at least 30 days ahead. Questions: forc@theorc.dev, Oregon Radio Company LLC.