Privacy Policy

Who this covers

LastInspected is a business-to-business product. If your organisation (“the customer”) uses LastInspected to track inspections, the customer is the data controller for the inspection records it creates, and LastInspected acts as the data processor: we hold and process that data on the customer’s behalf and under its instructions. If you have a question about a specific inspection record — whose it is, what it says, or how to correct it — the customer that operates the account is who to ask first; we support them in answering it.

What we collect, and why

We collect only what the product needs to run:

• Account credentials. Email address and a bcrypt-hashed password for anyone who signs in to manage an organisation’s inspections. We never store a password in a form that could be read back.
• Inspection records. The checklist answers submitted for an asset, the name the inspector typed in, and a timestamp. This is the product’s core output: a record that a check happened.
• Location and device signal on scan submissions. When someone scans a QR tag to file an inspection, we may record the GPS coordinates their device reports and the browser’s user-agent string alongside the submission. This matters more than it looks: the person scanning a public tag is very often not a LastInspected customer or account holder at all — frequently a contractor, a driver, or a member of the public asked to check something — and they deserve to know plainly that a scan can attach where they were standing and what device they used. Both fields are optional: a browser that declines to share location, or a scan that omits a user-agent, still produces a valid inspection.
• Photo and signature evidence. Images an inspector attaches to back up what they reported.
• Organisation details. The customer’s company name and billing identifiers, needed to run the account and process payment.

We do not run analytics or advertising trackers of any kind on this site, and we do not sell or share personal data with data brokers. There is no cookie banner on this site because there is nothing here for one to disclose — see “Cookies” below.

Lawful basis

For account holders, processing is necessary to perform the contract between LastInspected and the customer organisation that account belongs to. For a person scanning a public QR tag with no account, processing rests on the legitimate interest of the customer organisation in maintaining an accurate, timestamped inspection record for the asset the tag is attached to — the same interest a paper inspection tag serves, made durable.

Retention

How long inspection history is retained is a per-plan entitlement the customer organisation chooses (or is assigned) when it subscribes, not a single fixed period across every account. Account credentials and organisation details are retained for as long as the account is active, plus a reasonable period after closure to satisfy legal and accounting obligations. A customer that needs a specific record removed sooner should raise it through their account contact.

International transfer

LastInspected is operated from, and stores data in, the United States. If you or your organisation are located elsewhere, your data will be transferred to and processed in the United States, which may have different data protection laws than your own jurisdiction.

Security measures

We designed the storage layer, not just the login form, to hold up:

• Tenant isolation at the database layer. Every tenant’s data is separated by PostgreSQL row-level security, enforced by the database itself rather than by application code remembering to filter correctly — so a bug in one query cannot expose another customer’s inspections.
• Content-addressed evidence storage. Uploaded photos and signatures are stored keyed by the hash of their own content, with the file type verified from the bytes rather than trusted from what a browser claims — which is also what keeps one inspector’s upload from being able to overwrite or collide with another’s.
• Password hashing. Account passwords are hashed with bcrypt before storage; we cannot look up or recover a customer’s password.

No system is unbreachable, and we do not claim otherwise. But these are structural choices, not settings that could be toggled off by accident.

Cookies

We set only session and authentication cookies (via Auth.js), strictly to keep a signed-in user signed in. There are no advertising or analytics cookies on this site, so there is no cookie consent banner — there is nothing optional here to ask consent for.

Your rights

Depending on where you are located, you may have the right to access, correct, export, or request deletion of personal data we hold about you. Because inspection records belong to the customer organisation that operates the account, requests about a specific record are usually fastest to resolve through that organisation directly. If that is not possible, contact us and we will route the request appropriately.

Contact

Questions about this policy, or a data subject request we should handle directly, can be sent to [email protected].