Privacy

What we hold, and why.

Fabricata Inspect stores inspection records on behalf of the company that created the workspace. This page describes what that means in practice.

Last updated 6 September 2026

Who is responsible for what

The company whose workspace holds a record is the responsible party for it, in the sense POPIA uses. We are the operator: we store and process that information on their instruction and do not use it for our own purposes. If you are an inspector, a client representative or a third party whose name appears in somebody's inspection report, the company that issued the report is who you ask about it first, and we will help them answer you.

What is collected

People

• Name, email address, job designation and role, for anyone with an account.
• A password, stored only as a PBKDF2-HMAC-SHA256 hash. We cannot read it and cannot recover it — a forgotten password is reset, never retrieved.
• Sign-in times, failed sign-in counts, and the IP address recorded against a password reset request.
• The names, companies and designations of people entered as parties to a project — who represented whom on a job. These are usually colleagues and client staff rather than account holders.

Inspection records

• Project header data: client and end client, order, job and contract numbers, drawings, specifications, equipment descriptions.
• Inspections, checklists, findings, non-conformances and released items.
• Photographs taken as inspection evidence, with their descriptions.
• An audit log of who did what and when, which is a document-control requirement rather than a tracking feature.

What we deliberately do not collect

• No analytics, no advertising, no third-party tracking. There is no third-party script of any kind on this site. Typefaces are served from our own servers rather than a font CDN, so no visit is reported to anyone else.
• No location data. Photographs are stripped of their metadata — camera, timestamp and GPS coordinates — when they are uploaded. A site's coordinates do not travel with a report.
• No payment card details. We never take them through this application.

Where it is stored

In a PostgreSQL database and an object store, both operated by Vercel and its storage partners, on infrastructure in the region configured for the deployment. Data is encrypted in transit (HTTPS is enforced) and at rest by the storage provider.

Photographs are never served by handing your browser a direct storage link. Every image is streamed through the application so that the check on whether you are allowed to see it happens every time — a link that works forever, for anyone, is not an acceptable way to serve somebody's client evidence.

Who can see it

Records belong to one workspace and are readable only by accounts in that workspace. This is enforced on every database read, not by hiding things in the interface.

Fabricata's own support staff can see a list of workspaces with counts, dates and who can sign in — how many projects and inspections a workspace holds, when it was last used, how much storage it is using. They cannot see your projects, inspections, findings or photographs. If you raise a support ticket they read what you wrote in it, because you wrote it to them. If they issue a password reset link for one of your users, that is recorded in your own audit log naming the person who did it.

A third-party inspector invited onto a project is the one deliberate exception to the workspace boundary, and it is narrow. They work in their own workspace, against their own copy of the project's header information — numbers, client, drawings, references and the parties on the job — which is copied to them at the moment they accept, because that is what the invitation is for. They see the requests addressed to them and nothing else of yours. They do not see your inspections, your findings or your photographs.

Revoking a third party stops their access to your requests immediately. It does not delete the copy of the project header they already hold, or the inspections and photographs they created themselves — those are their own records, and deleting another company's quality records is not something we will do on request.

How long it is kept

For as long as the workspace exists. Inspection records are quality records: a fabricator may be required to produce one years after the job closed, so we do not expire them on a schedule. [Decision needed: retention period after a workspace is closed, and whether an export is offered on the way out.]

Your rights

Under POPIA you may ask what personal information we hold about you, ask for it to be corrected, and object to how it is used. Where GDPR applies, the equivalent rights include access, rectification, erasure, restriction and portability.

An account holder can see and correct their own name and designation in Settings, and an administrator can correct anybody's in their workspace. For anything else — including a request to delete information about you that appears inside somebody else's inspection record — write to inspect@fabricata.co.za and we will route it to the company responsible for that record and follow up.

Breaches

If information is accessed by somebody who should not have had it, we will tell the affected workspaces and the Information Regulator, as POPIA requires. [Decision needed: notification window to commit to.]

Contact

inspect@fabricata.co.za
[Decision needed: registered company name, physical address, and the named information officer POPIA requires.]