Privacy Policy

USTex LLC operates UST Compass. For information you enter about your own customers and facilities, you are the controller of that data and we process it on your behalf under the Terms of Service. For your account information, we are the controller.

Account and identity

• Email address, and a one-way hash of your password. We never store your password itself.
• Email verification codes (stored hashed), verification timestamps, and failed-attempt counts.
• Account role and portfolio membership — whether you are a company owner, a company user, or a client portal user.
• Optional profile settings: display name, time zone, date format, reminder lead times, and notification preferences.

Compliance data you enter

• Customer records: customer name, contact name, and contact email.
• Facility records: facility name, street address, state, tank count, and tank configuration details.
• Vendor records: vendor name, contact name, contact email, and phone number.
• Compliance items and history: test types, intervals, last-completed and next-due dates, waiver status, completion records, and your notes.
• Binder documents: files you upload, their file names, status, received and renewal dates, and your notes.
• Invitations you send: the invited email address and the invitation's status.

Technical

• A session record, so you stay signed in between requests.
• Standard server and hosting logs, which include IP address, request time, and user agent, generated when your browser contacts the service.

• To provide the service: authenticate you, keep you signed in, store your compliance records, and calculate and display the deadlines you configure.
• To send transactional messages: email verification, deadline reminders and summaries you have enabled, invitations, and account notices.
• To keep the service secure and working: rate limiting, abuse prevention, debugging, and backups.
• To meet legal obligations, including retaining historical accounting records where required.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use your compliance data to build advertising profiles.

We share data with the service providers below, each only to the extent needed to run the platform. They are contractually limited to processing it for that purpose.

• Supabase — hosts our PostgreSQL database and the file storage that holds your binder documents. Data is stored in the United States.
• Vercel — hosts and serves the application, and generates request logs. If you turn on product analytics, Vercel Web Analytics additionally receives a page view for each screen you open, and Vercel Speed Insights receives page performance measurements, both with tokens and record identifiers stripped from the address.
• Resend — delivers our transactional email. It receives the recipient address and the content of those messages.

We may also disclose information if required by law, to respond to valid legal process, to enforce our terms, or to protect the rights and safety of our users or the public. If our business is acquired or merged, account data may transfer as part of that transaction; we will give notice before your data becomes subject to a different privacy policy.

We use one strictly necessary cookie, cal.sid, which identifies your signed-in session. It is HTTP-only, restricted to same-site requests, sent only over HTTPS in production, and expires after seven days. Without it you cannot stay signed in, so it is not subject to consent.

We also store a small amount of data in your browser's local storage to remember interface preferences such as your light or dark theme and whether the navigation sidebar is collapsed. This never leaves your device.

We do not load advertising cookies or third-party tracking pixels, and we do not track you across other sites. If you turn on product analytics, we load Vercel Web Analytics, which counts page views, and Vercel Speed Insights, which measures page performance. Neither sets cookies of its own, and we strip invitation and password-reset tokens and client and facility record identifiers from the addresses both receive. They are off until you turn them on. Turning them back off stops all reporting immediately, though the scripts already loaded in the current page stay in memory until you reload. You can review and change your choices at any time through Cookie Settings.

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to opt out of sale or sharing (we do neither), and to be free from discrimination for exercising these rights. We honor these requests for all users regardless of residency.

You can act on most of these directly in the app:

• Access and correct: view and edit your profile, customers, facilities, vendors, and compliance records from the relevant page.
• Notification choices: change reminder lead times and turn email reminders or weekly summaries off in Profile settings.
• Delete individual records: remove customers, facilities, vendors, compliance items, or binder documents you no longer want stored.

For a full export of your data, or to delete your account and all associated compliance data, email privacy@ustex.org from the address on your account. We will verify your identity and respond within 45 days. You may use an authorized agent, and you may appeal a refusal by replying to our decision.

If you are a client portal user, your access was created by the service company that manages your facilities. We will route your request to them where they control the underlying records, and tell you when we have done so.

We keep your account and compliance data while your account is active. After you ask us to delete your account, we remove it from production systems within 30 days; encrypted backups age out on a rolling basis within 90 days. We keep historical accounting records for as long as the law requires, and session records expire on their own after seven days.

Deleting a record in the app removes it from your workspace. Because you may be under a regulatory retention obligation, export anything you are required to keep before you delete it.

Passwords are hashed with bcrypt. Traffic is served over HTTPS with HSTS. Database connections use TLS with a pinned certificate authority. Session cookies are HTTP-only and same-site. Access to your workspace is enforced on the server, and client portal users are scoped to only the customer assigned to them.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

The platform is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

If we make a material change to this policy, we will update the date at the top and notify account owners by email before it takes effect. Continuing to use the platform after that means you accept the updated policy.

Questions or requests: privacy@ustex.org.