Privacy Policy

Who we are

This Privacy Policy applies to 300log, operated by 300log. Contact us at [email protected].

Where your records live

You sign in with Google, or with an email address and password, to use the workspace. If you sign up with an email address, Firebase (Google) stores the address and a hashed password, and we send you links by email (through Resend) to confirm the address and, if you ask, to reset the password. Your workspace records are stored in your 300log account, in a database on servers operated for 300log: your company and establishment details, your OSHA 300 Log and 301 reports (including the employee injury and illness details you enter, such as names, dates, job titles and what happened), your 300A inputs, the team members you add (names and email addresses), your encrypted ITA token and your filing records. We store them to provide the service: keeping your records, generating your forms and filing with OSHA when you authorize it. Only your signed-in account and the people you invite to your workspace can open its records, and they travel between your browser and our servers over HTTPS. When you invite someone, we store their email address and role with the invitation and email them a link to join. The PDFs and CSVs you generate are made in your browser, and a backup file you download stays with you. Records go anywhere else only when you scan a report or authorize an OSHA ITA filing, as described below.

Information we collect

To run your account and subscription we process:

• Account identifiers: your user ID and sign-in profile (email address; with Google sign-in also your name and photo).
• Subscription status, plan, and customer and subscription identifiers.
• Product analytics events configured to avoid incident content.
• Messages you send to support.

Scan a report

If you use Scan a report, the photo or PDF is read on your own device. Only the text extracted from it is sent to TypeSafe, our AI provider, whose Jev model identifies the incident fields for you to review. 300log does not store the document or its text; TypeSafe processes the request under its API terms. The first scan downloads the open-source Tesseract OCR engine and English language data from the jsDelivr CDN. Scanning is optional; you can always enter details by hand.

OSHA ITA filing

Automatic filing is optional. CSV files you download and upload to OSHA yourself never pass through our servers.

• Your ITA API token: when you connect it, we check it with OSHA and store it encrypted (AES-256-GCM) with your account. The workspace only ever shows its last four characters, and it is used only to file the establishments and years you authorize.
• The authorized snapshot: when you authorize a filing, we store a copy of that establishment's data for the year on our server, so what is filed is exactly what you approved. It holds the company and establishment details, the 300A inputs and totals and, only for establishments that must also send case data (Appendix B industries with 100 or more employees), each case's job title, dates, outcome, days away or restricted, injury type, dates of birth and hire, sex and the 301 answers about what happened.
• What goes to OSHA: that snapshot, sent with your token to OSHA's Injury Tracking Application. Employee names and addresses, physicians and treatment facilities are removed before it is stored and are never sent.
• Retention: we keep the token until you disconnect it. Each filing record (its snapshot, status, OSHA's establishment and submission IDs, and any errors) stays with your account so you can see what was sent, until you ask us to delete it.
• Deleting: disconnect the token in the workspace's Filing center and it is erased from our server at once. You can also cancel an authorization there before it is submitted. To delete filing records, email [email protected]. OSHA keeps what it received under its own rules.

Third-party services

Paddle processes payments as merchant of record, Google and Firebase handle sign-in, Resend delivers account and invitation emails, TypeSafe reads scanned text, PostHog records product analytics, and OSHA's ITA receives the filings you authorize. Each provider's own policy applies to its service.

Your choices

You can request access, correction, or deletion of your account and workspace records by contacting [email protected]; we delete them on request. Download a backup first if you still need the records (OSHA requires employers to keep them for five years). Signing out does not delete them. Subscription and invoice data may be retained as required for tax, fraud prevention, and legal compliance.