Privacy Policy — LiftAuth

Bellman Foundry ("we", "us", or "our") operates the LiftAuth mobile application (the "App") and the liftauth.com website (the "Website"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

1. Information We Collect

Account information — When you sign up or are invited to a firm, we collect your name, email address, and phone number for authentication and account management.

Inspection data — When you perform lift inspections, we collect checklist responses, notes, photos of defects, and digital signatures. This data is associated with the lift, job, and your user account.

Location data — With your permission, we collect precise location data to pin lift locations on a map. Location is only accessed when you use the map picker feature and is not tracked in the background.

Camera and photo library — With your permission, we access your camera to scan QR codes and photograph inspection defects. We access your photo library only when you choose to attach existing photos.

Device information — We may collect basic device information such as device type, operating system version, and app version for troubleshooting and compatibility purposes.

2. How We Use Your Information

To provide and maintain the App's core functionality (job management, inspections, compliance tracking)
To authenticate your identity and manage your account
To associate inspection records with the correct lift and technician
To generate inspection reports and compliance documents
To send you notifications related to your assigned jobs (via SMS or email)
To improve the App and fix technical issues

3. Data Sharing

We do not sell your personal data. We may share your information with:

Your firm — Your employer or the firm that invited you can see your inspection data, job history, and profile information within their organisation.
Service providers — We use third-party services to operate the App and the Website, including Firebase (authentication and data storage), Twilio (SMS notifications), SendGrid (email), PostHog (website analytics, see section 4) and Resend (delivering Website form messages to us). These providers process data on our behalf under their own privacy policies.
Legal requirements — We may disclose information if required by law or to protect our legal rights.

4. Our Website: Analytics, Cookies and Forms

Analytics — When you visit the Website, we use PostHog, an analytics service, to understand how the Website is used. PostHog records the pages you view, how long you spend on each page and how far you scroll, the links and buttons you click, the website or advert that referred you (including any campaign tags in the link), your browser, device type and screen size, and your approximate location (country, region and city), which PostHog works out from your IP address. PostHog processes this data for us on servers in the United States. We do not use this data for advertising, and we do not sell it.

Cookies — PostHog sets a first-party cookie and a browser storage entry on liftauth.com containing a random identifier, so that it can recognise repeat visits from the same browser. These are kept for up to one year. We do not use advertising or cross-site tracking cookies.

Forms — When you send us a demo or trial request, we collect the details you enter, such as your name, work email, company, phone number, the number of lifts or elevators you maintain, and your message. The form is emailed to us so that we can reply to you. When you send a form, we also link your name, email and company to your earlier visits from the same browser, so that we can see which pages you looked at before you contacted us.

Links in our emails — Links in emails we send to businesses may carry a code that identifies the company we wrote to. When you open one, PostHog records that code with your visit and keeps it in the cookie described below, so we can see which companies visited the Website and when they return. We use this only to follow up with that company.

Opting out — The Website does not run analytics if your browser sends a Do Not Track or Global Privacy Control signal. You can also block or delete cookies in your browser settings; the Website works without them. To ask us to delete the analytics data linked to your email, contact us at the address in section 10.

5. Data Storage and Security

Your data is stored on Google Cloud infrastructure. We use industry-standard security measures including encrypted connections (HTTPS), authenticated API access, and multi-tenant data isolation to protect your information.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the App's services. Inspection records may be retained longer to meet regulatory compliance requirements. If you request account deletion, we will remove your personal data within 30 days, except where retention is required by law.

7. Your Rights

You may:

Request access to the personal data we hold about you
Request correction of inaccurate data
Request deletion of your account and associated data
Withdraw permissions (camera, location, photo library) at any time through your device settings
Opt out of Website analytics as described in section 4

To exercise these rights, contact us at guoyang@liftauth.com.

8. Children's Privacy

The App is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last updated" date at the top of this page.

10. Contact Us

If you have questions about this Privacy Policy, contact us at:

Bellman Foundry
Singapore
guoyang@liftauth.com