What we collect, and why

Newsletter sign-ups

Email sign-up is available only while the newsletter is live. Until then, the sign-up buttons and email forms described in this section and the next are switched off. When it is live, subscribe buttons across the site, such as on the newsletter page, at the end of articles and in the tools, open a sign-up window. It asks for:

• Your email address (required).
• A checkbox agreeing to receive the EHS Community newsletter, next to a link to this policy (required). The form doesn’t submit without it.
• Your country: United States, Canada or elsewhere.
• Your role and industry (optional).

You are subscribed as soon as you submit the form. Your email address goes to Mailchimp, our email service, with your country and tags that record that you signed up on this site and from which page or tool. Country is recorded as United States, Canada or Other.

We don’t store your role or industry with your subscription. They are sent to Google Analytics as part of a sign-up event, along with your country (United States, Canada or Other) and the form you used. Only the options you picked from the lists are sent. The event does not include your email address or any text you type. This sign-up doesn’t create a record in our own database, and our server doesn’t write your email address to its log (see “Hosting and server logs”).

Template library and Learn downloads

These forms appear only while email sign-up is live. Until then, the download buttons on the template library (/resources) and the template panels on Learn pages are available without asking for any details. While it is live, those pages ask for the following before their download buttons unlock:

• Your email address and country (required).
• A checkbox agreeing to be added to the EHS Community email list. The form doesn’t submit without it.
• On the library page only: your first name, role and industry (all optional).

We save these details in our database, which is hosted by Neon. The record also holds the time you ticked the box, the form you used, your browser’s user-agent text (which shows browser and device type) and the address of the page you were on. If you submit again with the same email address, we update that record.

We also add you to our Mailchimp list with your email address, country, first name if you gave one, and tags for this site, your country and the form you used. Your role and industry stay in our database only.

The templates are not emailed to you. Your browser remembers that they are unlocked (see “Cookies and similar technologies”).

Tools

The Safety Assessment, the Compliance Program Builder, the injury cost calculator and the recordability tool run in your browser. What you type or select is not sent to us. The Compliance Program Builder saves your answers in your browser so you can come back to them, including any company name, site name, site address and “prepared by” details you enter. The schedule and documents it produces are created in your browser. Safety Assessment results are not saved anywhere. The tools do send usage events to analytics (see below).

Analytics

We use Google Analytics 4, loaded directly or through Google Tag Manager, to see which pages, articles and tools get used. Google receives standard visit details such as the pages you view, your browser and device, your approximate location and the page that sent you here, plus your IP address, as any service your browser contacts does. We also send these events from your browser:

• Article reads: which article you read, how far down the page you scrolled (at 25, 50, 75 and 90 percent), how long you stayed and whether you reached the end.
• Source links: when you click a citation in an article, the link address and the article.
• Downloads: the file name and type, and where on the site you downloaded it.
• Sign-ups: the country (United States, Canada or Other), industry and role you chose from the lists, and which form you used. Never your email address or anything you type.
• Tools: that you started or finished a tool, with a summary such as the Safety Assessment score percentage, the recordability result or the export format.

Analytics is off in the admin area and for automated browsers. You can switch it off for your own browser (see Opting out of analytics). Separately, when a request comes from a known AI crawler such as GPTBot, our server reports the crawler’s name and the page it requested to Google Analytics. That report contains no reader information.

Hosting and server logs

The site runs on Vercel. When you load a page, Vercel’s servers receive your IP address, browser details and the address you requested, and keep request logs for a limited time. We don’t copy IP addresses into our own database. The code that handles sign-ups doesn’t write email addresses to the server log.

Team sign-in

Visitors don’t have accounts. Our editorial team signs in to a private admin area with an email address and password, plus a one-time code emailed through Resend. That sign-in sets a session cookie in the team member’s browser. Visitors don’t receive it.

What we don’t collect

• Accounts, passwords or payment details from visitors. Everything on the site is free to access today.
• The answers you enter in the tools.
• Forum posts or comments. The forum isn’t open yet.
• Your precise location.
• IP addresses in our own database.

The site doesn’t show advertising.

Opting out of analytics

To stop Google Analytics and Tag Manager on this site in your current browser, use this opt-out link. The page reloads with no confirmation message. It sets the ehs_no_analytics cookie and local-storage flag, and the site then doesn’t load Tag Manager or send analytics events from that browser.

Repeat it in each browser and on each device, and again if you clear cookies and site data. You can also install Google’s opt-out browser add-on or block analytics in your browser settings. Opting out does not change Vercel’s server logs or the sign-up forms.

If you live in a US state with a privacy law

Residents of states such as California, Colorado, Connecticut, Texas and Virginia may have the right to know what personal information a business holds about them, get a copy, correct it, delete it, and opt out of its sale or use for targeted advertising. We don’t sell personal information. We won’t treat you differently for making a request. Depending on your state, you may be able to appeal if we decline a request, and to contact your state attorney general.

If you live in Canada

Under the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and similar provincial laws, you can ask to see the personal information we hold about you, challenge its accuracy and have it corrected, and withdraw your consent to our using it, subject to legal or contractual limits. If we haven’t resolved a concern, you can contact the Office of the Privacy Commissioner of Canada or your province’s privacy regulator.

Under Canada’s anti-spam law (CASL), we send marketing email only to people who asked for it, by ticking the consent box in the sign-up window or on a download form. You can withdraw consent at any time by using the unsubscribe link or by contacting us. If you ask us directly, we will remove you from the list promptly.

If you use the site from another country

EHS Community is written for readers in the United States and Canada. If you use it from elsewhere, your information is handled as described here and may be processed in the United States.