Privacy Notice

Last updated: June 29, 2026

1. Who we are

TEVALOTS LLC ("we", "us", "our") operates the SiteScan EHS service ("Service"). For personal data processed in connection with your account and your use of the Service, we act as the data controller.

2. Personal data we collect

• Account data — your email address, hashed password, sign-in provider identifier (if you use Google).
• Submitted content — photographs and optional context notes you upload for assessment.
• Usage data — number and timestamps of scans, subscription status.
• Technical data — IP address, browser type, device identifiers, error logs.
• Support data — messages you send us.

Payment-related data (card details, billing address, tax information) is collected and processed directly by our Merchant of Record, Paddle. We do not receive or store your full card details.

3. Why we use it and the legal basis

• Provide the Service (contract performance) — create your account, run AI assessments, deliver subscription benefits.
• Security and fraud prevention (legitimate interests) — detect abuse, protect accounts.
• Improve the Service (legitimate interests) — diagnose errors, measure feature usage. We do not train third-party AI models on your photos.
• Customer support (legitimate interests / contract) — respond to your questions.
• Legal compliance (legal obligation) — meet tax, accounting and regulatory requirements.

4. Who we share data with

• Paddle — Merchant of Record, for payment processing, subscription management, tax compliance and invoicing.
• Hosting and infrastructure providers — Supabase / Lovable Cloud and Cloudflare for application hosting, database and authentication.
• AI inference providers — Google (Gemini) via Lovable AI Gateway for image analysis. Submitted images are sent to these providers only to generate the assessment.
• Professional advisers — legal, accounting and similar advisers, where necessary.
• Authorities — where required by law or to protect our rights.

5. International transfers

Our subprocessors may process data outside your country of residence, including in the United States. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and equivalent UK mechanisms.

6. Retention

We retain account data for as long as your account is active. Uploaded photographs and assessment results are retained while your account is active so you can review them; you may request deletion at any time. When you delete your account we delete or anonymise your personal data within 30 days, except where we are legally required to keep it (for example, tax records).

7. Your rights

Depending on where you live you may have the right to access, rectify, erase, restrict or port your personal data, to object to certain processing, and to withdraw consent. EU/UK users have the right to complain to a supervisory authority. To exercise these rights, email privacy@tevalots.com; we respond within one month.

8. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and least-privilege service credentials — to protect personal data.

9. Cookies

We use only essential cookies and local storage required to keep you signed in and remember your session. We do not currently use third-party analytics or advertising cookies.

10. Changes to this Notice

We will post material changes here and, where appropriate, notify you by email.

11. Contact

Privacy questions: privacy@tevalots.com.