InspectCam™InspectCam data processing terms
Effective:
For a company that UK or Canadian data protection law applies to, these terms are part of the InspectCam Terms of Service (inspectcam.app/terms/, section 8.4), and the company accepts them when it accepts the Terms. They are not part of the Terms for any other company. They say how we handle the personal data a company puts in Pro.
1. Who is who
1.1 "The company" (also "you") is the company whose account holds the jobs. "We" is Zeek LLC, a Washington limited liability company trading as InspectCam.
1.2 "Company data" is the personal data that the company, its people, and the people who send it photos put into Pro. Section 2 lists it.
1.3 The company decides what company data is collected, and why. In the words of data protection law, the company is the controller and we are its processor: we hold and handle the data for the company.
1.4 If the company holds some of this data for another business, the company confirms that the other business lets it use us.
1.5 These terms do not cover the data we decide about ourselves, such as accounts, email addresses, invitations, roles, plans and security records, and the emails people send us. Our privacy policy (inspectcam.app/privacy/) covers that.
2. What we handle, for whom, and for how long
| What | Details |
|---|---|
| Why | To provide Pro to the company: to store, copy and show its jobs, keep them the same on its phones and computers, make its reports, share what it chooses to share, and delete what it deletes. |
| What we do | We store the data, copy it, make smaller copies, send it between the company's phones and computers, show it, share it by link when the company makes a link, and delete it. |
| How long | While the company has an account. After Pro ends, as section 10 of the Terms says: at least 30 days to download, deletion about 60 days after Pro ends, and up to 30 more days in backups. |
| Kinds of data | Photos, videos with their sound, voice notes and their written words. Notes, findings, files, reports and signatures. Names, contact details and addresses of the company's clients and of other people named in a job. The time, street address and GPS position on photos and videos. Who added each item, and when (the name shown on it). What trades and others send with a link. |
| Sensitive data | Pro is not made for sensitive data, such as health data or criminal records, and we do not ask for any. It is in company data only if the company's people put it there, for example in a photo or a note. |
| People it is about | The company's clients, and people who live or work at a job's address. The company's owner, admins and members. Trades and their workers. Anyone who appears in a photo, a video or a recording. |
3. What we must do
3.1 Only on your instructions. We handle company data only on your written instructions. The Terms, these terms, and what your people do in the app and on our web pages are your instructions. They include sending the data to the United States and to our providers (section 5). If a law makes us handle the data in another way, we tell you first, unless that law forbids it. We tell you if we think an instruction breaks data protection law.
3.2 Confidentiality. Everyone we let handle company data must keep it confidential.
3.3 Security. We keep the security measures in section 4, and we keep them fit for the risk.
3.4 Providers. You agree that we use the providers in section 5. Each one is bound by a written contract to protect the data at least as well as these terms do. We answer to you for what they do with company data. Before we add or replace a provider, we update section 5 and email the owner at least 30 days ahead, unless we must act sooner to keep Pro safe or working. Then we tell you as soon as we can, and you may still object. If you object for a good data protection reason, tell us within the 30 days, or within 30 days of our email after an urgent change. If we cannot settle it, you may cancel your plan.
3.5 People's rights. The app lets you see, correct, download and delete company data yourself. If a person asks us about company data, we pass the request to you and do not answer it ourselves, unless the law says we must. We help you answer, as far as we can.
3.6 Help with your duties. We give you the information we have that you need to keep company data safe, to assess a risk before you start (an impact assessment), and to answer a regulator about it.
3.7 Breaches. If we learn of a breach of security that affects company data (it is lost, changed, or shown to or reached by someone with no right to it), we tell the owner by email without undue delay. We say what happened, which data and about how many people, what it may lead to, and what we have done and will do. We send more as we learn more.
3.8 At the end. When Pro ends, you can download company data for the time section 10 of the Terms gives. Then we delete it, and it leaves our backups, as that section says. We keep a copy longer only if a law makes us. Then we keep it safe and use it for nothing else.
3.9 Checks and audits. We give you the information you need to show that these terms are kept. You, or an auditor you choose who must keep what they see confidential, may check that we keep them: once a year, with 30 days' written notice, in working hours, and without seeing other companies' data. We may answer in writing first.
4. Security measures
- On the way: all traffic between the app, our web pages and our servers uses HTTPS (TLS). The app refuses plain HTTP.
- In storage: the database (Google) and the file store (Cloudflare) keep stored data encrypted.
- Each company apart: on every request, the server checks that the person is signed in, belongs to the company and has the right role.
- Files are private: a file opens only for a signed-in person of the company, or through a link or code the company makes and can stop.
- Our own access: only the people at Zeek LLC who need it to run and support Pro can reach the systems that hold company data. They sign in with two-step verification.
- Logs and backups: server logs are kept for up to 30 days. Database backups are kept for up to 30 days.
- A written breach plan, used when something goes wrong.
- Review: we look at these measures at least once a year, and when Pro or the risks change.
5. Our providers
| Provider | What it does with company data | Where |
|---|---|---|
| Google LLC (Firebase, Google Cloud) | Sign-in. The database that holds jobs and their details. Our server code. | United States. Sign-in records may also be kept in Google's other data centers. |
| Cloudflare, Inc. | Stores photos, videos, files and reports. Runs the file server and its web pages. Keeps records of files and share links. | United States for stored files. The records: North America asked for, not guaranteed by Cloudflare. Each request passes through its data center nearest to the user. |
| Resend | Sends our emails to the company's owner. | United States. It may also handle data in other countries where it has servers. |
6. Quebec and the rest of Canada
6.1 For a company that Quebec's Act respecting the protection of personal information in the private sector applies to, these terms are the written agreement that sections 17 and 18.3 of that Act ask for. In its words: we take the measures in section 4 to protect the confidentiality of company data; we use it only to provide Pro; we do not keep it after the agreement ends, apart from the times in 3.8; we tell the company's person in charge of the protection of personal information without delay of any violation or attempted violation of its confidentiality (3.7); and we let that person check that these terms are kept (3.9).
6.2 Before a company in Quebec sends personal information outside Quebec, that Act asks it to assess the privacy risk. On request, we give you the information we have for that: where the data is kept (section 5), how it is protected (section 4), and the law that applies there.
6.3 For a company in Canada: we keep company data in the United States, and our providers handle it in the places section 5 names, under these terms.
7. General
7.1 The Terms apply to these terms too, with the limits in section 15 of the Terms, except where the law does not allow a limit.
7.2 Section 16 of the Terms says which law and courts apply. For a company that UK data protection law applies to, the laws of England and Wales apply to these data processing terms, and the courts of England and Wales may hear claims about them.
7.3 We may change these terms as section 17.1 of the Terms says. A change of provider follows 3.4.
7.4 Where these terms and the Terms differ about company data, these terms win. Sections 20 and 21 of the Terms (the UK, Canada) still apply to a company there.