InoREGS Privacy Policy

1. Scope and our role

This Privacy Policy explains how McAllister Compliance Group, LLC (operating InoREGS) handles information when you use inoregs.com, the InoREGS software platform, or the InoREGS Android and iOS companion application (package/bundle identifier com.inoregs.app).

InoREGS supplies business-to-business compliance software. For account administration, service operation, customer support, and direct business interactions, McAllister Compliance Group, LLC makes decisions about processing. For records that an organizational customer uploads or manages in its tenant, that customer generally determines the purposes, authorized users, and applicable retention rules; InoREGS operates the software on its behalf, subject to contractual and legal obligations.

The current native mobile companion focuses on account sign-in, organization selection, assigned permissions, subscription access status, and aggregated workforce-compliance readiness. Capabilities in the broader web platform do not necessarily exist in the mobile app.

2. Information handled

Account and identity data may include email address, account or user identifier, authentication session details, organization name, organization membership, assigned role, and permissions. Password credentials are submitted to the configured authentication service; the mobile application uses authentication tokens to access authorized services.

The mobile companion retrieves organization identifiers and names, membership roles, enabled modules, subscription access restrictions, and aggregate workforce-requirement counts (such as current, under review, gaps, waived, or inactive). It does not currently provide native document uploading, worker-record editing, or evidence-file capture.

Organizational customers may use the broader web platform to manage workforce details, credentials, compliance evidence, requirements, training, licensing, findings, and other records. Such content can contain personal information or sensitive information depending on what the customer provides. Not all such records are displayed or downloaded by the mobile companion.

Our web services and infrastructure may process technical request information necessary to deliver or secure the service, such as timestamps, network addresses, browser or device characteristics, authentication errors, and security or operational logs. The exact logging and retention settings can vary by service and deployment configuration.

Public marketing pages use a first-party random visitor identifier cookie (configured for up to one year) and a first-touch marketing attribution cookie (configured for up to 90 days) that can store landing-page URL, referrer, campaign parameters, and capture time. These identifiers support marketing attribution; they are not required to read this policy or submit a deletion request. The legal pages are excluded from creating new marketing attribution cookies.

3. How information is used

We use information to authenticate users; establish the organization and permissions a user may access; deliver workforce-compliance summaries; apply subscription restrictions; protect sessions; troubleshoot errors; maintain security and auditability; respond to support and privacy requests; and operate contractual customer services.

We do not present workforce compliance counts as final employment, healthcare, clinical, legal, or regulatory determinations. Organizational customers and their authorized users are responsible for reviewing underlying records and taking appropriate action.

4. Authentication, sign-in, and local storage

The mobile application supports InoREGS account-password sign-in and configured enterprise single sign-on. An organization may use a third-party identity provider, such as Microsoft Entra, to authenticate its users. Authentication and organizational permissions are governed by the configured provider and the InoREGS backend.

The native app uses locally persisted Supabase session material so authorized sessions can continue between launches. It also stores a session-scoped activity timestamp to help enforce an inactivity timeout. These local values are used for authentication and unattended-screen protection, not for advertising.

Server-side authentication, active session and tenant authorization controls are distinct from an identity provider's account disable action. Account deactivation propagation and existing-session revocation depend on configured enterprise provisioning and backend enforcement.

5. Mobile permissions and device features

The current mobile implementation opens a browser or identity-provider webpage for enterprise sign-in and uses an app link to complete the callback. It uses foreground/background application state for session protection.

The audited native code does not include features that intentionally access the camera, microphone, precise location, contacts, photo library, or advertising ID; it also does not implement native push notifications or background location tracking. Operating-system or third-party-library permissions, if introduced in later builds, must be reviewed against the signed release manifest and this policy before publication.

6. Service providers and integrations

InoREGS uses Supabase services for authentication and database-backed application functions, and Vercel-hosted web infrastructure for the website and API. A customer's configured identity provider, including Microsoft Entra where enabled, may participate in single sign-on and account provisioning.

For purchases made through the web platform, Stripe may process customer billing and payment-related information; the current native companion does not implement a native Stripe payment SDK or checkout screen. Marketplace or additional business integrations, including AWS, apply only when an organization uses those separately configured services.

Service providers may process information to supply contracted services, maintain their systems, or satisfy legal obligations. Their own privacy notices and contracts may also apply.

7. Information access and disclosure

Tenant records are intended to be accessible only to authorized members of the relevant organization and authorized service personnel with a legitimate operational need. Organizational administrators control user access within their tenant, subject to platform safeguards.

Information may be disclosed to service providers necessary for the services described above, to the organizational customer that controls the relevant record, or when required by law or reasonably necessary to protect rights, users, or system security. We do not describe routine cross-customer disclosure as an intended service function.

8. Data retention, deletion, and account requests

Retention depends on the type of record, contractual commitments, customer instructions, operational and security needs, backup handling, and applicable regulatory or legal duties. Not all categories have a single fixed retention period; we do not promise immediate deletion from all backups or systems.

An organization may need to preserve compliance evidence or other records even after a particular user's access ends. Disabling an account or revoking access is not the same as deleting all personal information. We review requests in light of the organizational customer's instructions, identity verification, and any legally required retention.

You can request access, correction, account deletion, or deletion of information by using the public request instructions at /account-deletion or contacting support.team@inoregs.com. Please do not include government ID documents, medical information, passwords, or other sensitive records in the initial email. We may need to coordinate with your organization's administrator before completing a request.

Open the InoREGS account and data deletion request page.

9. Security

Our software uses authenticated requests, scoped organization permissions, and server-side access controls for protected resources, and uses HTTPS transport for the public website and configured API endpoint. Tokens and other authentication information require careful protection on the device.

No software or transmission mechanism can guarantee absolute security. We review security and session controls as part of release acceptance, including the integration between enterprise identity provisioning and active sessions.

10. Privacy choices and individual rights

Depending on where you live, applicable law, and whether your organization controls the information, you may have rights to request access, correction, deletion, restriction, or a copy of your information. We will review and route requests appropriately; some records may be controlled by an organizational customer or subject to retention obligations.

To request assistance, contact support.team@inoregs.com and identify the organization associated with your account. We may ask for additional verification through an appropriate channel before disclosing or deleting data.

11. Processing locations

InoREGS and its configured providers may process or store data in the United States and, depending on the customer's service arrangements and providers, other locations. Specific residency, transfer, or contractual terms must be established separately for each organization; this policy does not promise a particular data-residency certification.

12. Children's privacy

InoREGS is a business and organizational tool intended for authorized professional or organizational users, not a consumer service directed to children. Organizational customers should not provide children's personal information through the service without a lawful basis and appropriate agreements and safeguards.

13. Changes to this policy

We may update this policy when the application, service providers, legal obligations, or data practices change. We will publish an updated effective date on this page and provide other notices where required.