Privacy Policy

OllieLabs LLC (“SafeGora”, “we”, “us”) provides workplace-safety operations software. This Privacy Policy covers personal information we collect when you visit safegora.com, when you interact with our marketing chat, when you submit a lead via our forms, and when you use the SafeGora platform under an SafeGora customer account. Where SafeGora processes personal information on behalf of a customer (for example, employee incident records inside the platform), that processing is governed by the customer's instructions and section 10 of the Terms of Service or an executed Data Processing Addendum; the customer is the controller and SafeGora is the processor.

1. Personal information we collect

SafeGora collects the following categories of personal information on the marketing site and across the platform. Each row below is supported by a corresponding entry on the cookie policy and the sub-processor list.

1.1 Analytics — Google Tag Manager and Google Analytics 4

SafeGora loads Google's tag (gtag.js) on the marketing site and in the SafeGora platform. When the user has opted in to the analytics category via our Consent Management Platform (CMP), Google Analytics 4 (GA4) sets first-party cookies (_ga, _ga_*, _gid) that record:

• A pseudonymous device / browser identifier.
• Page URLs (path and query) and referrer URL within the SafeGora marketing site and platform.
• IP address and user-agent string. Google uses the IP address to derive approximate location and then discards it, as described in Google's documentation for each region.
• Custom events fired by SafeGora (for example, when the user opens the chat widget or submits a form).

When the user has not opted in, Google Consent Mode v2 default is denied across analytics_storage, ad_storage, ad_user_data, and ad_personalization. Google's tag still loads, so Google receives connection metadata such as IP address and user-agent, and it may receive cookieless signals that carry no cookie identifier. No analytics or advertising cookies are set. See cookie policy for the full per-cookie inventory.

1.2 Advertising — Google Ads

When (a) the build is configured with a Google Ads conversion ID and (b) the user has opted in to the advertising category via the CMP, SafeGora loads Google Ads conversion tracking and remarketing. The Google Ads cookies (_gcl_au, _gcl_aw, _gcl_dc) record the click attribution identifiers necessary to measure conversions and, where the user is reached via remarketing audiences, the user context Google uses for those audiences.

SafeGora honors the Global Privacy Control (GPC) signal: when the user's browser exposes navigator.globalPrivacyControl === true, the advertising category is forced off, gtag is updated to denied across all advertising signals, and the user cannot turn the category on from the CMP banner. This follows the California Attorney General's enforcement position, stated in its August 2022 Sephora settlement, that a business must treat GPC as a valid opt-out of sale or sharing.

1.3 Marketing chat widget

The SafeGora marketing site ships an AI-powered chat widget. When you send a message:

• We POST your message text, a conversation identifier, the URL of the page you sent it from (pageUrl), and the browser-reported document.referrer to the SafeGora API.
• We persist the conversation locally in your browser under the ollie-marketing-chat localStorage entry for 24 hours so the conversation survives reloads.
• After a threshold number of questions, the widget prompts you for an email address. If you submit one, we POST it to the lead-capture endpoint described in §1.4 with a channel of chat_qualified so the chat conversation is joinable to the lead record.

The chat is not a human-only conversation: responses are generated by a large language model with the assistance of a retrieval layer over SafeGora documentation. Conversations may be reviewed by SafeGora staff in aggregate for quality and safety. Do not submit confidential third-party data or health information via the chat. See §6 (retention) for how long we keep chat records.

1.4 Lead-capture forms

SafeGora collects lead information when you submit one of the forms on the marketing site (request a demo, contact us, subscribe to the newsletter, chat-qualified email submission). The SafeGora lead-capture endpoint accepts the following fields:

• firstName, lastName, email (required).
• companyName, phone, fein, naicsCode, city, zip (where you choose to provide them).
• notes, sourceUrl, channel, chatConversationId (system fields used to route, attribute, and join lead records).

We use this information to respond to your inquiry, schedule demos, send the SafeGora newsletter (if you subscribed), and to evaluate whether you become a customer. We do not sell this information to third parties.

1.5 Site cookies and similar storage

The SafeGora marketing surface sets a small set of necessary cookies and similar browser storage regardless of consent choices, because the site is unusable without them: the CMP consent record itself (olliesafe_consent), a legacy cross-tab mirror (olliesafe_ads_consent), a theme preference (olliesafe-theme), the chat session continuity record (ollie-marketing-chat), and a chat-FAB teaser marker (ollie-fab-teaser-shown). The complete per-cookie inventory, including category, provider, and retention, lives on the cookie policy page.

1.6 CSRF cookie

When you submit one of the marketing forms, the SafeGora API sets a CSRF double-submit token (csrf_token) on the API origin to protect the POST request against cross-site request forgery. This is a necessary security cookie under GDPR Recital 49 and is not optional.

1.7 Server / infrastructure log data

Like every public web service, the SafeGora edge, CDN, and API record connection-level data (timestamp, source IP, HTTP method, request path, response status, user-agent) in short-lived operational logs. We use this data to operate the service, defend against abuse, and meet our security obligations. See §6 for retention.

1.8 Bot protection — reCAPTCHA Enterprise

Where enabled, SafeGora's public forms and sign-up use Google reCAPTCHA Enterprise to detect automated abuse. Google receives the page's browser, device and interaction signals and the IP address, and returns a risk score to SafeGora. Google provides this service under SafeGora's Google Cloud agreement. It is a necessary security measure for those forms.

1.9 Sub-processor data flows

SafeGora engages a small set of sub-processors to operate the platform: cloud infrastructure and AI, identity, billing, transactional email, and DNS. The complete list with categories of personal information processed, processing location, and our 30-day change-notification commitment is published at /legal/subprocessors.

2. How we use personal information

• Operate and improve the SafeGora marketing site and the SafeGora platform.
• Respond to inquiries, schedule demos, and send transactional communications such as account confirmations and billing notices.
• Send marketing emails to subscribers (newsletter) or to opted-in leads, with an unsubscribe link in every send.
• Measure aggregate site performance (where you opt in to analytics).
• Measure marketing performance and reach in-market audiences (where you opt in to advertising).
• Maintain the SafeGora AI chat surface, including review of de-identified conversation samples for quality and safety.
• Provide the AI features a customer enables in the platform, as described in §10.
• Investigate abuse, defend against attacks, and comply with our legal obligations.

3. Lawful basis for processing (GDPR)

For users in scope of the EU GDPR or UK GDPR, SafeGora relies on the following Article 6 lawful bases:

• Article 6(1)(b) — performance of a contract: when we process information to deliver the SafeGora service to you or your employer under an order or terms of service.
• Article 6(1)(c) — legal obligation: when we retain records to meet tax, accounting, or other statutory requirements.
• Article 6(1)(f) — legitimate interests: when we operate the marketing site, respond to inbound inquiries, defend against abuse, and conduct first-party measurement that does not require consent (such as necessary cookies). We have balanced these interests against user rights and offer a route to object via Ollie@safegora.com.
• Article 6(1)(a) — consent: for analytics cookies, advertising cookies, and any direct marketing email where opt-in consent is the applicable basis under local law (e.g. ePrivacy in the EU/EEA). Consent is recorded via the SafeGora CMP described in §5 and is freely revocable.

4. Sharing

We disclose personal information only to:

• Sub-processors we engage to operate the service, under written data-protection terms as described in section 10 of the Terms of Service. The complete list, including any vendor for which a signed agreement is not yet confirmed, is at /legal/subprocessors.
• Google, for advertising, only when you opt in to the advertising category, as described in §1.2 and below.
• Authorities, when required by valid legal process. We will challenge requests that are overbroad or inconsistent with applicable law and notify the affected customer unless legally prohibited.
• Successor entities, in the event of a merger, acquisition, or sale of substantially all of the SafeGora business, under continuity-of-protection terms.
• Sponsors, when an organization offers to pay for your workspace and an administrator of your workspace accepts that sponsorship. We then share with the sponsor that you accepted, whether your workspace has started (your first completed inspection, program or corrective action, not its contents), and the line for your workspace on the sponsor's invoice. A sponsor gets no access to your workspace, and we share nothing from your records with it unless you choose to.
• With your consent, in any other case where you have asked us to share information (for example, referral programs).

Sale and sharing. SafeGora does not sell personal information for money. When you opt in to the advertising category, Google Ads cookies let Google measure conversions and build remarketing audiences. Under the CCPA this may be “sharing” for cross-context behavioral advertising. In the preceding 12 months, the categories involved were identifiers (cookie and ad-click identifiers) and internet activity on our site. You can opt out at any time as §7.2 describes, and we honor the Global Privacy Control signal. We do not knowingly sell or share the personal information of consumers under 16.

For CCPA / CPRA purposes, SafeGora acts as a Service Provider with respect to personal information processed on behalf of a customer, under the service-provider terms in section 10 of the Terms of Service or an executed DPA.

5. Cookies and consent

SafeGora operates an in-house Consent Management Platform (CMP). On your first visit you see a bottom-sheet banner with three choices: Accept all, Reject non-essential, or Customize. Customize opens a dialog with per-category toggles for analytics and advertising. Necessary cookies are always on and cannot be refused; the site does not function without them.

The SafeGora CMP honors the Global Privacy Control (GPC) signal: when your browser exposes navigator.globalPrivacyControl, the banner stays suppressed, the advertising category is forced off, and the CMP records your preference as { source: "gpc" }. The complete cookie inventory lives at /cookies.

You can change your category choices at any time via the Cookie preferences link in the site footer.

6. Retention

Retention windows below apply unless a customer instruction, legal hold, or local-law requirement extends them.

• Google Analytics 4: user- and event-level data for the retention period configured in our Google Analytics property; Google offers 2 or 14 months for standard properties. Aggregated reports are not subject to that setting.
• Google Ads cookies: 90 days per Google's policy.
• Marketing chat conversations: server-side storage for 90 days from the last message; the browser-side ollie-marketing-chat record expires 24 hours after the last activity.
• Lead-capture submissions: 24 months from the last interaction, after which records are de-identified for analytics or deleted, unless you become a customer (in which case the customer-relationship retention applies).
• Newsletter subscriptions: until you unsubscribe; we keep an unsubscribe record indefinitely so we do not re-add you.
• CSRF cookie: session.
• Operational / security logs: 30-90 days at the edge, longer for security-incident artifacts under a documented retention policy.
• CMP consent record (olliesafe_consent): 395 days (about 13 months) from your recorded choice. This is SafeGora's setting; see the cookie policy.

7. Your rights

Subject to applicable law, you have the following rights with respect to your personal information. Where SafeGora processes information on behalf of a customer, requests should generally be directed to the customer; SafeGora assists under section 10 of the Terms of Service or an executed DPA.

7.1 EU / UK GDPR (Articles 15-22)

• Access (Art. 15) — confirm whether we process your personal information and receive a copy.
• Rectification (Art. 16) — correct inaccurate or incomplete information.
• Erasure (Art. 17) — delete information subject to the limits in the GDPR.
• Restriction (Art. 18) — restrict processing in certain cases.
• Portability (Art. 20) — receive machine-readable copies of information you provided.
• Objection (Art. 21) — object to processing based on legitimate interests.
• Withdraw consent (Art. 7(3)) — withdraw any consent you previously gave, without affecting the lawfulness of processing before withdrawal.
• Complain to a supervisory authority, including the data protection authority in your EU member state.

To exercise these rights, contact Ollie@safegora.com. For requests governed by the EU GDPR, we respond without undue delay and generally within one calendar month after receipt. Where the law permits an extension because of the complexity or number of requests, we may take up to two additional months and will explain the extension within the initial calendar month. For requests governed by the UK GDPR, we follow the ICO's current timing and clarification rules separately; a UK clarification pause is not copied automatically into the EU workflow, and asking a question alone does not pause every clock. Fixed 30-day or 60-day approximations are not the rule. Identity verification and lawful refusal rules apply separately. Where SafeGora processes personal information for an employer customer, we assist that controller under Terms of Service section 10 or an executed DPA rather than acting as if we were the controller for every request. Where those laws do not apply, we follow the timing required by the applicable US law or contract.

7.2 CCPA / CPRA (California)

California residents have additional rights under the CCPA /CPRA, including the right to know, the right to delete, the right to correct, the right to data portability, the right to opt out of sale or sharing of personal information, and the right to limit use of sensitive personal information. We do not sell personal information; we honor the Do Not Sell or Share My Personal Information opt-out via the CMP banner (see §5 above), including by honoring the Global Privacy Control signal. To submit a CCPA request, contact Ollie@safegora.com; you may also use the Do Not Sell or Share My Personal Information link in the site footer, which re-opens the CMP with the advertising category staged to deny.

SafeGora does not use or disclose sensitive personal information to infer characteristics about you, so the right to limit its use does not change how we process it. You may use an authorized agent; we will verify your identity and the agent's authority before acting. We will not discriminate against you for exercising a privacy right.

7.3 Categories collected under the CCPA

In the preceding 12 months, SafeGora collected the following categories of personal information as a business, from you, your browser and our service providers, for the purposes in §2:

• Identifiers — name, email address, phone number, IP address, account and cookie identifiers. Disclosed to sub-processors, and to Google for advertising only with your opt-in.
• Commercial information — subscriptions, orders and billing records. Disclosed to sub-processors (Stripe for payments).
• Internet or other electronic network activity — pages viewed, events, chat messages and device information. Disclosed to sub-processors, and to Google for analytics and advertising only with your opt-in.
• Professional or employment-related information — company name, role, FEIN and NAICS code. Disclosed to sub-processors.
• Sensitive personal information — account sign-in credentials, handled by WorkOS. Disclosed to that sub-processor only.

Retention for each category follows §6. Workplace records that customers keep in the platform, including injury information, are processed for the customer as its service provider, not collected by SafeGora as a business.

7.4 Other US state privacy laws

SafeGora extends substantially equivalent rights (access, correct, delete, portability, opt out of targeted advertising and profiling) to residents of states with comprehensive privacy laws on the same intake path (Ollie@safegora.com). This Privacy Policy is our notice for residents of Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, Iowa, Indiana, Delaware, New Jersey, New Hampshire and other states with comprehensive privacy laws.

Appeals. If we decline your request, you may appeal by emailing Ollie@safegora.com with the subject Privacy appeal. We will respond within the period your state's law requires (45 or 60 days in most states) and explain the outcome. If we deny the appeal, you may contact your state attorney general.

8. International transfers

SafeGora hosts the platform in Google Cloud us-west1 in the United States. AI text generation uses Google's Vertex AI global endpoint, so Google may process an AI request outside the United States; AI embeddings stay in us-west1. The Services are offered to United States customers. Where a customer needs the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or the Swiss equivalent for customer data, those instruments apply only when set out in an executed SafeGora DPA.

9. Territorial scope and representatives

SafeGora is offered as a United States-only service for US employers and US consulting firms supporting US workplace operations. OllieLabs LLC is established in the United States and does not currently maintain a representative in the European Union or the United Kingdom under GDPR Article 27 / UK GDPR Article 27. A public website that can be reached from outside the United States does not by itself establish that those territorial rules apply or that a representative must be appointed. Occasional processing is not the entire exemption analysis: large-scale special-category or criminal-offence data and systematic monitoring of EU or UK residents also matter under the applicable guidance. We assess appointment against actual customer markets, offered services, monitoring, processing frequency, data categories and risk. The current assessment does not establish that a representative is currently owed. If an appointment becomes required, the appointed representative and contact will be published here in advance. EU or UK residents who contact us about this site may write to Ollie@safegora.com.

10. Automated decision-making and AI

The SafeGora marketing chat surfaces responses generated by a large language model. The chat does not make decisions that produce legal effects on you or similarly significantly affect you within the meaning of GDPR Article 22; it answers questions about SafeGora and the regulatory areas we cover. SafeGora staff may review de-identified conversation samples for quality and safety. You can avoid the chat surface by simply not opening it.

When a customer enables AI features in the platform, SafeGora sends the relevant prompt, selected record context and permitted images through its AI service layer to Google Cloud Vertex AI to generate results and embeddings, applying PII redaction where configured. Google processes these requests under SafeGora's Google Cloud agreement and does not use them to train its models. AI results are suggestions for a person to review; they do not make decisions with legal or similarly significant effects. Optional connections to third-party AI hosts are described in the separate ChatGPT and AI connection notices.

11. Children

SafeGora is not directed to children under 16 and we do not knowingly collect personal information from children. If you believe a child has provided personal information to SafeGora, contact us and we will delete it.

12. Data security

We protect personal information using encryption in transit and at rest, role-based access controls, tenant isolation via PostgreSQL row-level security, audit logging, and operational security reviews. The full security posture is at /security. The commitments that apply to customer data are in section 10 of the Terms of Service or an executed DPA.

13. Internal validation accounts and impersonation

SafeGora operates a small set of internal validation accounts using @ollielabs.io email addresses. These accounts exist so SafeGora engineering can test launches and pre-release features on production infrastructure. Internal accounts can bypass the self-service signup limits that apply to customers. Internal accounts are never used to access customer-tenant data; tenant isolation via PostgreSQL row-level security applies to internal accounts on the same terms as customer accounts.

Separately, SafeGora maintains a platform-admin impersonation surface that allows authorized SafeGora personnel to assume a customer-tenant context for support and incident-response purposes. Impersonation is restricted to staff with documented training and a recorded business justification, and every impersonation start, end, and denial event is written to the platform audit trail with the actor's identity, target tenant, and timestamp. The hash-chained regulatory audit trail captures every mutation performed inside an impersonation session under the same evidentiary posture as a customer-initiated action. Customers can request a copy of the audit log entries for their tenant by writing to Ollie@safegora.com.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date below. Material changes are also flagged at the top of this page for at least 30 days and, where required by law, communicated by email to customers.

15. Contact

• Privacy inquiries and rights requests: Ollie@safegora.com.
• Security reports: Ollie@safegora.com (see also /.well-known/security.txt).
• Legal / contracts: Ollie@safegora.com.
• Postal address — OllieLabs LLC, 3400 NE John Olsen Ave, Ste 200, Hillsboro, OR 97124.

Last updated

2026-10-28