Privacy Policy

The SafetyBud platform (web dashboard and mobile app) is operated by SnSD Consultants ("SnSD", "we", "us").

Most personal data on the platform is entered by our customers — the organisations that use SafetyBud for their workers, contractors, inspections and trainings. For that customer data, the customer is the data controller and we act as a data processor: we process it only on the customer’s documented instructions and under our data processing agreement. If your employer or an organisation you work with uses SafetyBud, please direct requests about that data to them first; we will support them in answering.

For our own data — customer account administration, billing, sales and support correspondence, and the security of our services — SnSD is the data controller.

We collect the minimum data required to authenticate you, personalize your experience, and deliver the features your organisation has enabled across the dashboard and the SafetyBud mobile application.

Account data includes your name, email, role assignments, tenant membership, invitation history, and, when provided, contractor profile information. Usage data includes device identifiers, IP addresses, approximate location, feature interactions, API calls, and error logs that help us secure the environment.

• Operational data you or your administrators upload into evaluations, forms, inspections, trainings and profile records
• Identity-verification photos (selfies), where your organisation enables this check
• Name and email entered on public training links and forms, together with the time of submission and the IP address
• Billing details for subscription management processed through our payment partners
• Support conversations conducted through email, in-app chat, or phone

Personal data powers core product functionality: user authentication, role-based access control, contractor evaluations, AI-assisted features, notifications, and integrations triggered through our API.

We analyze aggregated telemetry to detect anomalies, improve reliability, and inform our roadmap. Any reports shared outside your tenant are anonymized unless we receive explicit contractual permission. We do not sell personal information and do not use customer content to train AI models.

• Provide and maintain both the SafetyBud dashboard and the SafetyBud mobile application
• Process safety forms, evaluations and AI-assisted content requested by your team
• Record training completion for the organisation that assigned or shared the training
• Deliver alerts, reminders, and summaries via email or push notifications
• Keep the service secure, investigate errors and prevent misuse
• Comply with legal obligations, audits, and incident response commitments

Where we act as controller we rely on: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)); compliance with a legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)); our legitimate interests in operating and securing the service, provided they do not override your rights (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)); and, where required, your consent or explicit consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)).

Where we act as processor, the legal basis is determined by our customer as controller. Processing of special categories of personal data (for example health information in incident records or biometric-based verification) takes place only where the controller has a valid condition under GDPR Art. 9 or KVKK Art. 6.

Text-based AI features (drafting, summarising, evaluation support) run on Amazon Web Services (AWS) infrastructure in the European Union with zero data retention: prompts and outputs are not stored by the model provider and are not used to train models.

Some features — document search embeddings, image generation, text-to-speech and voice, media processing and avatar video — use specialised sub-processors, some of which are located outside the EU (see the list below). Before content is sent for AI processing, personal names and company names are pseudonymized where technically possible, so the provider does not receive them in clear text.

We share personal data with the following service providers strictly to deliver the service. Each is bound by a data processing agreement, confidentiality obligations and security controls.

• Amazon Web Services (AWS) — hosting, infrastructure and text-based AI — European Union (Frankfurt, Germany)
• Supabase — database, authentication and file storage — European Union (Stockholm, Sweden)
• OpenAI — image generation, via fal.ai; no text AI requests are sent to OpenAI — United States
• ElevenLabs — text-to-speech and voice — United States
• fal.ai — media and AI processing — United States
• HeyGen — avatar video generation — United States
• Brevo — transactional email — European Union
• Cloudflare — security, DDoS protection and content delivery — global network
• Sentry — error monitoring; personal data is filtered out of error reports before they are sent

Our primary infrastructure is located in the European Union: AWS in the eu-central-1 region (Frankfurt, Germany) and Supabase in the eu-north-1 region (Stockholm, Sweden).

Some processing is carried out by the sub-processors listed above outside the EU and outside Türkiye, mainly in the United States. For such transfers we rely on the European Commission’s Standard Contractual Clauses or another recognised safeguard under GDPR Chapter V, and, for personal data subject to Turkish law, on the transfer mechanisms of KVKK Article 9 — an adequacy decision, appropriate safeguards such as standard contracts notified to the Personal Data Protection Authority, or, where applicable, the exceptions set out in that Article.

Data is encrypted in transit via TLS 1.2+ and at rest. Production access is logged, audited, and restricted to authorized personnel using MFA.

Customer data is retained for the life of the customer relationship unless the contract, the customer’s instructions or a legal requirement specifies a different period. Examples of fixed retention periods:

• Identity-verification photos (selfies): 90 days
• IP addresses recorded on public forms: 30 days
• Security and audit logs: 12 months
• Invoicing and contractual records held by SnSD: 10 years, as required by tax and commercial law
• Encrypted database backups: rolling, up to 8 days

This section applies to personal data processed under Turkish law. SnSD is the data controller for the data described under "Who We Are and Our Role" and a data processor for customer data; for customer data, the customer is the data controller within the meaning of KVKK Article 3.

Purposes and legal bases are described above. Personal data may be transferred to the sub-processors listed above, including abroad, in accordance with KVKK Articles 8 and 9.

Under KVKK Article 11 you have the right to: learn whether your personal data is processed; request information about the processing; learn the purpose of processing and whether data is used for that purpose; know the third parties to whom data is transferred in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure or destruction under the conditions of Article 7; request that correction or erasure be notified to the third parties to whom data was transferred; object to a result against you arising exclusively from automated analysis; and claim compensation for damage caused by unlawful processing.

To exercise these rights, send your request in writing or by email to support@safetybud.io from the email address registered with us, with the subject "KVKK application", stating your name and the request. We respond free of charge within 30 days at the latest, in line with KVKK Article 13. Requests about data your organisation controls will be forwarded to that organisation. If your application is rejected or the answer is insufficient, you may lodge a complaint with the Personal Data Protection Board (KVKK Kurulu).

SafetyBud uses only cookies and browser storage (localStorage / sessionStorage) that are strictly necessary to provide the service you asked for, or that remember a setting you chose yourself. We do not use analytics, advertising or cross-site tracking cookies, and we do not load third-party analytics scripts. Because these items are necessary for the service, they are set without a separate consent; you can delete them at any time in your browser settings, but you will then be signed out and your settings will reset.

What we store on your device:

• Sign-in session (cookie sb-<project>-auth-token, set by our authentication provider Supabase): keeps you signed in; refreshed while you use the service and removed when you sign out — necessary
• Media access (cookies CloudFront-Policy, CloudFront-Signature, CloudFront-Key-Pair-Id, CloudFront-Hash-Algorithm; HttpOnly, about 6 hours): lets your browser play training videos of your own organisation without putting access tokens in links — necessary
• Security (browser storage: second-factor verification state, session-timeout sync between tabs, reload guards; if your organisation allows “remember this device”, a trusted-device token for up to 30 days that you can revoke): enforces multi-factor authentication and your organisation’s idle-timeout — necessary
• Bot protection (Cloudflare Turnstile, loaded only on sign-in and code-entry forms): checks that a form is submitted by a person; it does not set a cookie on our domain — necessary
• Organisation and workspace (browser storage: active organisation, cached organisation list): sends your requests to the right organisation — necessary
• Remembered accounts on the sign-in screen (browser storage: email address and sign-in method only, up to 5 accounts): lets you pick your account the next time; shown masked, and you can remove one or all accounts from the sign-in screen (“Forget all accounts on this device”)
• Your settings (cookie sidebar_state, 7 days; browser storage: theme, language, font size, notification and caption language choices, table and panel views, dismissed notices such as the cookie note): remember choices you made
• Drafts and work in progress (browser storage: unsent survey answers, inspection review drafts, training and slide editor drafts, form wizard steps): prevent losing work if the page reloads; cleared when you submit or discard
• Personal training links (browser storage: a limited session for the training link you opened with a code, valid until the training’s due date and at most 30 days): lets you continue that training without a password
• Support access (cookies impersonation and impersonated_user_name, 30 minutes; one-time impersonation_token, 60 seconds): set only when an authorised SnSD administrator opens a support session, to show the support banner and end it — necessary
• Error monitoring (Sentry): error reports are sent with personal data filtered out; in the production service Sentry sets no cookie and does not record sessions

Administrators can update or delete most profile data directly from the dashboard. Individuals may request access to, a copy of, correction, deletion or restriction of their data, and may object to processing. We respond within the timelines required by applicable legislation such as the GDPR, UK GDPR and KVKK.

To submit a privacy request, contact us with the email address tied to your account. We will authenticate the request before performing any action.

You can delete your own account at any time from your profile page (Delete my account), or see how to request account deletion if you cannot sign in.