Privacy policy

Who we are

SSHO Now is operated by GCExperts LLC, a Texas limited liability company. You can reach us on (813) 678-5701 or through our contact page.

What we collect

What you send us. If you fill in the project request form we receive your name, company, email, phone if you give it, the project location, when you need somebody, the contracting agency if you tell us, and anything you write in the notes.

Analytics, only if you accept. If you accept analytics cookies we use Google Analytics to count visits and see which pages are read. Analytics does not load at all unless you accept, advertising and personalisation signals are switched off, and you can withdraw consent at any time from the link in the footer.

Server logs. Our web server records requests, including IP address and browser, as part of running and securing the site.

Why we use it

To answer your request, and to understand which pages are useful. We do not sell your information, we do not share it with advertisers, and we do not add you to a marketing list because you asked a question.

If you create an account

An account is optional. Everything we publish is free to read without one, and the project request form works without one. If you do create one, this is the whole of it.

What an account holds. Your email address, which is also your sign-in name, and a one-way scrypt hash of your password. We never store the password itself and we cannot tell you what it is. We record which of the three things you said you use the site for — being found for SSHO work, tracking a request, or training — because that decides what your account shows you.

We do not confirm your email address and we do not send you email. Nothing is sent to it, so there is no mailing list to be on and nothing to unsubscribe from. It follows that there is no automatic “forgot my password” link either: if you lose your password, you call us, we establish who you are, and we give you a one-time link that works once and expires in thirty minutes.

If you build a professional profile, it holds what you type into it — the name you want shown, your OSHA 30-hour course and when you took it, your years of experience, certifications you hold, continuing education, where you will work, when you are available, and anything you add about yourself. Every field is optional.

Who sees a profile. Nobody, unless two separate things are both true: you have ticked the box asking to be listed, and we have read the profile and marked it checked. One without the other shows it to no one. Untick the box and it is private again immediately. We do not verify your OSHA card with the provider and we say so on the listing — what we check is that the profile is coherent and not obviously wrong. We do not sell profiles and we do not pass one to a contractor who has not asked for an SSHO.

Consent records. When you create an account we record the date, which version of this policy and the terms was on the screen, whether you opted in to being listed, and a shortened network prefix such as 203.0.113.0/24 — the first three parts of the address you were on, not the address. That record is our proof you agreed to something, and it holds nothing else about you.

One necessary cookie, and no analytics at all. Signing in sets a single cookie that keeps you signed in. It is HttpOnly, it is marked Secure and SameSite, and it holds a signed token rather than anything about you. No analytics, advertising or third-party script of any kind runs anywhere in the signed-in area — nothing you do inside your account is measured, and these pages are excluded from search engines.

How long we keep it

Enquiries are kept while we are dealing with them and for as long as we need them for our records. Analytics data is retained by Google under that property's retention setting.

For accounts, the periods are specific:

• Your account and your profile — while the account is open.
• If you delete your account — removed when you press the button, not queued. Our commitment is 30 days; in practice it is immediate.
• If you stop using it — we delete accounts that have been dormant for 24 months.
• Consent records — kept for 24 months after the account ends, because they are the proof you consented, and they contain only a date, a version and a network prefix.
• Training and continuing-education records — kept while the account is open, because the point of them is that you can produce them when an auditor asks. Deleting your account destroys them too and we cannot reissue a certificate afterwards, so download your data first if you need the record.
• Server logs — 30 days.

Your choices

Ask us and we will tell you what we hold about you, correct it, or delete it. Use the contact page. You can refuse or withdraw analytics consent from the footer link on any page without affecting anything else on the site.

If you have an account you do not have to ask us at all:

• See it — My data lists everything the account holds, in plain words.
• Download it — one button gives you a machine-readable copy of all of it, including your full profile and every consent record.
• Delete it — one page, one button. No support conversation, no cooling-off period, and we do not email you to ask whether you were sure. It tells you exactly what will be destroyed before you confirm.

When you delete an account, the records are physically removed from our files rather than flagged as deleted. What remains is a single line saying that an account with a random internal reference was deleted, and the date — nothing about you.

Cookies

Covered separately in the cookie policy.