Privacy Policy

intelliSPEC (“intelliSPEC,” “we,” “us”) provides an industrial asset integrity platform for inspection, NDT, mechanical integrity, and turnaround work, headquartered at 1800 Hughes Landing, Ste 275, The Woodlands, TX 77380.

This policy covers intellispec.com, the intelliSPEC platform and mobile applications, and the sales and support channels we operate. It does not cover third-party sites we link to, or the internal practices of our customers.

For the platform, our customers decide what goes on the record and why; we process that data on their instructions. In data protection terms, the customer is the controller and intelliSPEC is the processor, and the customer agreement and Data Processing Agreement govern that processing.

For this website, our sales and marketing activity, and the account data needed to run subscriptions, intelliSPEC decides the purposes and means of processing and acts as the controller. This policy describes both roles and marks the difference where it matters.

If you are an employee or contractor of one of our customers and have a question about data your employer put on the platform, the fastest path is your employer's administrator; we support every such request through them.

We collect the categories below. We collect them directly from you, from your organization when it provisions your account, and from the operation of the platform itself.

• Customer records (processor role): inspection findings, NDT readings, integrity calculations, turnaround plans, photos, documents, locations of equipment, and electronic signatures that customers capture on the platform.
• Account data: name, work email address, job role, organization, and authentication identifiers, including single sign-on identifiers issued by your organization.
• Business contact data: information you give us when you request a demo, contact sales, or correspond with support, including the content of that correspondence.
• Usage and device data: log records of how the platform is used, such as pages and modules accessed, timestamps, IP address, browser and device type, and sync events, used for security, troubleshooting, and product improvement.
• Website visitor data: optional HubSpot page-view and selected website-interaction events, cookie identifiers described in the Cookie Policy, details you submit through forms, and messages you choose to send to our AI website assistant. HubSpot processes those chat messages to generate answers and retain conversation history; unresolved conversations may be kept in our help desk for review.
• Billing data: plan, seat counts, and invoicing details. Payment card handling, where applicable, is performed by a payment provider; we do not store full card numbers.

We use information to deliver and secure the service, and for the ordinary operation of a software business. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

• Deliver the platform: run workflows, sync offline captures, generate reports, and keep every entry on the record with user, timestamp, and signature.
• Secure the service: authenticate users, enforce role-based access and tenant isolation, detect abuse, and maintain the append-only audit trail.
• Support: respond to requests, diagnose issues, and keep customers informed about service status.
• Improve the product: understand how features are used so the platform gets better; improvement work uses the least identifying data that serves the purpose.
• Administer the business: invoicing, accounting, and enforcing agreements.
• Meet legal obligations: comply with law, respond to lawful requests, and establish or defend legal claims.

Where the GDPR or a similar law applies, we rely on: performance of a contract, for delivering the service you or your organization signed up for; legitimate interests, for securing the service, preventing abuse, improving the product, and business-to-business communication, balanced against your rights; consent, where we ask for it, which you may withdraw at any time; and legal obligation, where processing is required by law.

We share information only with service providers that help us run the platform, under contracts that restrict their use of it to providing services to us.

Our core infrastructure runs on Microsoft Azure, with data services on MongoDB Atlas. Additional sub-processors cover categories such as notification delivery, monitoring, and support tooling. The current sub-processor list is maintained with the Data Processing Agreement and is available to customers on request.

For this website and our sales process, we use HubSpot for inquiry forms, the optional Breeze AI website assistant, consent-gated page-view and selected website-interaction measurement, and customer relationship records. Chat is for product information, not confidential asset records or safety-critical decisions. Do not send passwords, payment details or confidential customer data. The Cookie Policy lists the browser technologies involved.

We may also disclose information to comply with law or valid legal process, to protect the rights, safety, and security of intelliSPEC, our customers, or the public, or in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply until it is updated.

Our services are operated from the United States. Where personal data subject to the GDPR or UK GDPR is transferred to a country without an adequacy decision, we rely on appropriate safeguards, including the applicable Standard Contractual Clauses incorporated through the Data Processing Agreement.

Security is part of the product, and personal data gets the same controls as customer records: encryption in transit and at rest with AES-256, single sign-on support, role-based access control on a 524-permission model, tenant isolation enforced at the query layer, and an append-only audit trail.

Static and dynamic security testing run in every CI build, secrets are held in a managed key vault, and access to production is scoped to the job. SOC 2 Type II readiness is in progress; we publish status, not claims, and the current posture is documented on our Trust Center at intellispec.com/security.

No method of transmission or storage is completely secure. If we learn of a breach affecting your personal data, we will notify affected customers and authorities as required by law.

Customer records are retained for the life of the customer agreement and exported or deleted at exit per that agreement and the Data Processing Agreement. Account data is retained while the account is active and for the period needed to meet legal, accounting, and reporting obligations. Business contact data is retained while the relationship is active or until you ask us to delete it. Log and usage data is retained on a rolling basis appropriate to security and troubleshooting needs.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. You will not be discriminated against for exercising them.

US state privacy laws, including the CCPA as amended by the CPRA, grant residents rights to know, correct, and delete personal information, and to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising. Where required, we honor opt-out preference signals such as Global Privacy Control.

To exercise any right, email alex@intellispec.com. We verify requests before acting on them and respond within the time set by applicable law. Where intelliSPEC processes data on a customer's behalf, we will refer the request to that customer and support their response. If you are in the EEA or UK, you may also lodge a complaint with your supervisory authority.

Our services are business tools and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

Spectra, the platform's AI assistant, answers questions from your organization's own record and cited source documents, and it asks before it acts. Spectra operates inside the same tenant isolation as the rest of the platform: one customer's records are not used to answer another customer's questions. The customer agreement and Data Processing Agreement govern AI processing of customer records.

We will post material changes on this page with a revised effective date, and where a change materially affects how we handle personal data already collected, we will provide additional notice as required by law. The date at the top of this page always reflects the current version.

Questions, requests, and complaints about privacy: intelliSPEC, 1800 Hughes Landing, Ste 275, The Woodlands, TX 77380, United States. Email: alex@intellispec.com.