This policy explains what information Bedrock Safety collects, why we collect it, how we use it, who we share it with, and how long we keep it. It applies to two groups: employees of Bob Miller Masonry Inc. who use the app as part of their job, and prospective customers who request a demo or trial account through this marketing site.

1. Who we are

Bedrock Safety is an internal safety management application built and operated by Bob Miller Masonry Inc. ("BMMI"), a Florida specialty concrete and masonry subcontractor headquartered in Sarasota. BMMI is the controller of the personal information described in this policy.

Bob Miller Masonry Inc.
Sarasota, Florida, USA
Privacy contact: [email protected]

2. What we collect

Employee data (BMMI workforce)

Name and employer.
Mobile phone number, used for passwordless login codes.
Job role and crew assignment.
Profile photo, when an employee chooses to upload one.
Certifications, including a photo of the credential and the expiration date.
Toolbox talk attendance, signatures captured on the device screen, and the corresponding job hazard analysis.
Inspection content, including findings that may identify a worker by name, photos taken on the device, and signatures.
Voice recordings made during inspections so they can be transcribed and structured into reviewable findings.
Push notification tokens issued by Apple or Google for the specific device running the app.
Device information such as model, operating system version, and app version, used for support and crash diagnostics.
Approximate location of a job site when an employee tags a record to a site while the app is in use. We do not track location in the background.

Prospective customer data (demo and trial accounts)

Information you submit on the demo request form: name, company, email address, phone number, role, and any free-text you choose to share about your current safety program.
If we grant you a demo account, the same categories listed under employee data apply to any records you create inside that account.

3. Why we collect it

To create and maintain the records OSHA requires construction employers to keep, including toolbox talk attendance, job hazard analyses, inspections, and corrective actions.
To run BMMI's safety compliance program, including stop-work authority, hazard tracking, and incident follow-up.
To manage the workforce day to day: knowing who is on which crew, which certifications are current, and who completed which training.
To respond to demo requests and operate trial accounts for prospective customers.

4. How we use it

Authenticate employees through a one-time code sent by SMS so they can submit records from the field.
Display the right toolbox talk, job hazard analysis, and inspection forms to the right person at the right time.
Transcribe inspection voice notes and convert them into structured findings that a safety manager reviews before submission.
Notify supervisors and office staff about new findings, overdue corrective actions, and stop-work events.
Produce reports and exports for safety meetings, captive insurance reviews, OSHA inquiries, and internal audits.
Diagnose errors and improve reliability through crash and performance monitoring.

We do not sell personal information. We do not serve advertising inside the product or this website. We do not track users across other apps or sites.

5. Who we share it with

We use the following service providers to operate Bedrock Safety. Each one processes data only for the purpose listed and only on our instructions.

Supabase: database, authentication, and file storage for the operational system of record.
Render: application hosting for the API and web dashboard.
Cloudflare R2: encrypted backups of the database and uploaded files.
Sent.dm: delivery of our text messages, including login codes, account and task notifications, and safety alerts (with Twilio as a backup delivery provider).
OpenAI: Whisper transcription of inspection voice recordings. Audio is sent for transcription only and is not used to train OpenAI models.
Anthropic: Claude language model used to structure transcribed inspection text into findings. Content sent through the Anthropic API is not used to train Anthropic models.
Expo Push Notification Service: routing of push notifications to iOS and Android devices.
Sentry: error and crash monitoring for the mobile app, web dashboard, and API.
Formspree: delivery of demo request form submissions from this marketing site to our inbox. Used only for the marketing site, not inside the product.

We may also disclose information when required by law, when responding to a valid legal process, or to protect the rights and safety of our employees, customers, or the public.

6. Text messaging (SMS)

Bedrock Safety sends text messages only to our own employees, and only transactional messages tied to their work, not marketing or promotional content. The categories are:

One-time verification codes used to sign in to the app.
Account and task notifications, such as confirmation that an employee has been granted access, or that a toolbox-talk submission was flagged for review.
Safety alerts, such as a stop-work notice on a jobsite.

Consent. An employee provides their mobile number to Bob Miller Masonry and enters it on the app sign-in screen to request a login code; that is how they agree to receive these messages. An employee can opt out at any time as described below.

Frequency, rates, and help. Message frequency varies with how often an employee signs in and how much safety activity occurs. Message and data rates may apply. Reply STOP to any message to unsubscribe, or HELP for help; you can also reach us at [email protected]. After you reply STOP we send one confirmation message and then stop texting that number.

We do not share your text-messaging information. We do not sell, rent, or share mobile phone numbers or SMS opt-in consent with any third party or affiliate for their own marketing or promotional purposes. The only parties that handle this information are the messaging providers we use to deliver the texts (see "Who we share it with" above), and they act only on our instructions.

7. Data retention

Records that document OSHA-required activity, including toolbox talks, job hazard analyses, inspections, findings, corrective actions, and stop-work events, are retained for seven years from the date of the record. This reflects the longest commonly applicable OSHA recordkeeping window and gives us a single rule for the operational system of record.

Other personal information tied to an employee, including profile photo, phone number, and device tokens, is retained for two years after the end of the employment relationship and then deleted or anonymized.

Demo request form submissions are retained in our sales records until you ask us to delete them. Trial account content is deleted within ninety days after the trial ends unless you have signed an agreement with us that says otherwise.

8. Data security

Data in transit is encrypted with TLS. Data at rest is encrypted by the underlying providers, including Supabase Postgres and Cloudflare R2 storage.

Access to the operational system is limited to authorized personnel through role-based controls. Every create, update, and delete writes an entry to an internal audit log that records the actor, the action, the affected record, and the timestamp. Records are soft-deleted rather than removed, so a deletion can be reconstructed and reviewed if a question comes up later.

No system is perfectly secure. If we learn of a breach that affects personal information, we will notify affected individuals and any regulators as required by Florida law.

9. Your rights

You can ask us to confirm what personal information we hold about you, request a copy, ask us to correct inaccuracies, or ask us to delete information that is not subject to a legal retention requirement. Send requests to [email protected]. We will respond within thirty days.

For BMMI employees, the relationship between you and your employer governs most of what is collected and how long it is kept. Records that exist to satisfy OSHA, workers' compensation, or other legal obligations cannot be deleted on request while those obligations are in force, but you can still ask for access or correction.

10. Children

Bedrock Safety is built for the adult construction workforce. We do not knowingly collect personal information from anyone under 18. If you believe a minor's information has been submitted to us, contact us and we will remove it.

11. International transfers

Bedrock Safety is operated in the United States for users located in the United States. Our service providers store and process data on infrastructure located in the United States. We do not market or offer the product outside the United States.

12. Changes to this policy

We may update this policy when the product changes or when the law requires it. The effective date at the top of the page will change when we do. If the update materially affects how we handle personal information, we will give reasonable notice to affected users before the change takes effect.

13. Contact

Questions about this policy or about personal information we hold:

Bob Miller Masonry, Inc.
Attn: Safety Manager
Sarasota, Florida, USA
[email protected]

How we handle personal information.