Who we are
Comply Nexus (also operating as Veristo) provides construction compliance software: the web application at comply-nexus.com and the Veristo Field mobile application. This policy covers both. Veristo is business-to-business software — you use it through an account created by your employer or your company's administrator.
Information we collect
- Account information: your name, work email address, phone number (optional), password (stored only as a cryptographic hash), preferred language, and your role within your company.
- Compliance records: professional licenses, certifications, training records, insurance certificates, and documents your company or you upload — including photographs of certificates.
- Jobsite activity: badge scans (who scanned, who was scanned, the result, and when), site check-in events, incident and near-miss reports including photos you attach, and safety-scan photos.
- Location (only if you allow it): the mobile app can use your device's location to detect arrival at jobsites your company assigned you to. This is optional, controlled by your device permissions, used only against your assigned jobsites' boundaries, and never used for continuous tracking or advertising.
- Device information: a push-notification token if you enable notifications, and standard technical logs (IP address, request timestamps) kept for security and reliability.
How we use it
Solely to provide the service: verifying worker compliance at jobsite gates, tracking credential and insurance validity, generating regulatory records (such as OSHA logs) for your company, alerting the right people when something needs attention, and improving safety through features like AI review of uploaded documents and photos. We do not sell personal information. We do not use your data for advertising. We do not profile you for any purpose outside the compliance service itself.
Who can see your information
- Your employer administers your records and sees your compliance status and jobsite activity.
- Companies your employer works with (for example, a general contractor whose site you work on) see what they need to verify site access: your name, employer, and whether you are cleared to work — through a scan of the badge you present.
- Insurance partners your company chooses to connect see company-level compliance and risk information as configured by your company.
- Service providers: we host on Amazon Web Services (data stored in the United States), send email through Amazon SES, deliver push notifications through Expo, and use Anthropic's AI services to read uploaded documents and analyze safety photos. Each processes data only to provide their function.
Text messages (SMS)
If your company invites you or sends you notifications by text message, those messages are informational only — account invitations, credential expiration reminders, and onboarding requests. Message frequency varies with your company's activity, and message and data rates may apply. You can opt out at any time by replying STOP, and get help by replying HELP. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties.
Retention
Compliance records are retained as long as your company's account requires, including legally mandated retention (for example, OSHA recordkeeping requires incident records be kept for five years). Records are deactivated rather than erased where law requires their preservation. When retention obligations end, records are deleted.
Security
Data is encrypted in transit (TLS) and at rest, access is role-restricted within your company and between companies, passwords are hashed, and administrative access to infrastructure is logged. No system is perfectly secure, but security is a design requirement of this product, not an afterthought.
Your choices and rights
- Location and camera access are controlled entirely by your device permissions and are optional.
- Push notifications can be disabled in your device settings at any time.
- You may request access to, correction of, or deletion of your personal information by contacting us or your company's administrator. Deletion is honored except where legal retention applies.
- Depending on where you live (for example, California or the EU), you may have additional statutory rights; we honor verified requests consistent with applicable law.
Children
This is a workplace product for adults. We do not knowingly collect information from anyone under 16.
Changes and contact
We will post any material changes to this policy here with a new effective date. Questions or requests: privacy@comply-nexus.com.