Privacy policy

Account information, such as your name, email address, role, customer membership, and authentication records.

Inspection and maintenance records, including assignments, answers, notes, photos, follow-up work, checkpoint confirmations, and the times those records were captured and received.

App and device information needed to run the service, such as an installation identifier, device platform, app version, push-notification token, synchronization status, and diagnostic details you choose to share with support.

Messages you send to Goodstead, including support requests and pilot enquiries.

We use this information to authenticate users, deliver assigned work, preserve inspection evidence, synchronize offline records, create follow-up tasks, send configured notifications, generate reports, provide support, and protect the service.

Goodstead does not sell personal information or use inspection data for advertising. The app does not track you across other companies' apps or websites.

Goodstead supports inspections with or without NFC checkpoint tags. A tag contains an opaque Goodstead web address. When you tap or scan it, the app records the checkpoint, your authenticated account, device context, and capture time.

The current release does not collect precise GPS location. Bluetooth beacon support is disabled unless a customer deployment expressly enables it in a later app release.

Goodstead uses an AI model to suggest follow-up work, to name hazards, and to suggest an order for walking a building's areas. All three run for every customer once Goodstead configures a model provider on its server. There is no separate setting for each customer. To suggest follow-up work, Goodstead reads completed inspection text and sends the building name, inspection content, area details, and recent follow-up history through OpenRouter to the configured model provider. The current default provider is Anthropic.

When a check asks inspectors to record the exact location of a problem, Goodstead may also ask the model to name the problem. This request is text only: the area name, the question, the answer, and the location note.

For a building with no completed inspections to learn a walking order from, Goodstead may ask the model to suggest a first order. This request is text only: the building name, and each area's name, type, floor, and checkpoint name. It goes through OpenRouter to the same model provider.

AI photo review is one setting for the whole service, not for each customer. When Goodstead turns it on, it also sends inspection photos through OpenRouter to the same model provider, so the model can judge whether each photo shows the problem it documents. After an inspection is completed, Goodstead sends each photo attached to a check whose answer flags a problem, with that check's question, answer, and note. It reviews at most 30 photos per inspection, and only for inspections completed in the last 7 days. While AI photo review is off, no photos are sent.

Before a photo is sent, Goodstead reduces it to at most 1024 pixels on its longest side and re-encodes it as a JPEG without its embedded metadata, including any location data. The photo travels inside the request, never as a link, and no file name or account identifier goes with it. A photo still shows whatever the camera captured, including any people, signs, or documents in the frame.

Goodstead does not send separate user-profile, email, account, or street-address fields with these requests. Inspection text, building and area names, and photos may contain personal information captured by your team. For every request, Goodstead asks OpenRouter to use only model providers that do not retain the content or train on it. What OpenRouter itself keeps depends on the settings of the account that sends the request. Goodstead configures that account with input and output logging off, OpenRouter's use of inputs and outputs off, and zero data retention required. OpenRouter may still sample request metadata or prompts to categorize usage.

The results may be stored with the inspection record: a suggested follow-up and its explanation, a hazard name, and, for each reviewed photo, whether it shows the problem, a confidence score, a short reason, and the model used. Reviewers can see these results, and they may appear in inspection reports and report downloads. The model may change whether a photo is filed as a hazard or reference photo, but never a choice an inspector made.

Authorized users at your organization can see information according to their role and building access. We also use service providers for cloud hosting, private file storage, email, push notifications, and support. If AI features are turned on, the providers described above process the limited inspection text needed for them and, while AI photo review is on, the inspection photos described above.

We may disclose information when required by law, to protect people or the service, or as part of a business transaction subject to appropriate safeguards. We require providers to protect information and use it only for the work they perform for Goodstead.

Inspection evidence is a business record. We retain it for the period agreed with the customer, as needed to provide the service, and as required by law. Retention may differ for account records, inspection evidence, backups, and security logs.

Your organization controls your work account. Ask an administrator to correct or deactivate it. You may also contact Goodstead to request access, correction, or deletion. We may need to preserve inspection or audit records when the customer or law requires it, and we will explain any limit that applies.

Goodstead uses access controls, encryption in transit, private object storage, and operational safeguards designed to protect account and inspection data. No system can guarantee absolute security.

Goodstead and its providers may process information in countries other than the one where you live. We use contractual and technical safeguards appropriate to the information and the service.

Goodstead is a business operations service and is not directed to children. We do not knowingly collect personal information from children under 13.

We may update this policy when the service or legal requirements change. We will post the revised date on this page and provide additional notice when a material change requires it.

Questions or privacy requests can be sent to hello@goodstead.app.