Privacy Policy

Last updated: 6 November 2026

ChecklistWorks operates checklistworks.com (formerly isochecklist.com). Contact hello@isochecklist.com about this policy or your data.

Data we collect and why

• Orders: your checkout email address, selected products and licence quantities, payment amount and currency, payment status, order reference and checkout confirmations. We need this information to fulfil our contract, deliver files and provide support.
• Billing: Stripe collects payment details and any billing name, address or tax details you enter for payment and invoicing. Stripe handles full card numbers; they are not stored in our order database. Tax and accounting records may also be needed to meet legal obligations.
• Enquiries: your name, email, subject and message when you use the contact form. We use these to answer your request and maintain support correspondence, based on our legitimate interest in providing customer support or taking steps towards a purchase you request.
• Security and operation: hosting and service providers process technical information such as request times, IP addresses, device/browser details and error logs to deliver the service, prevent abuse and investigate faults, based on our legitimate interest in operating a reliable store.
• Optional analytics: if you accept analytics, Google Analytics receives usage and purchase events, pages visited, approximate location, device information and online identifiers. This data can be personal data; it is not guaranteed to be anonymous. The basis is your consent, which you can withdraw on our Cookie Policy page.

Buying downloadable files does not require an account. The online audit application requires a user account. Placing an order or sending an enquiry does not subscribe you to promotional emails.

Online audit workspaces and evidence

When you use the online audit application, we process account and profile details, workspace membership and invitations, audit plans and notes, findings, corrective actions, and files you upload as evidence. These records can include names and other information you or your team enter about people, suppliers or activities.

Supabase provides account authentication, the database for workspace and audit records, and private storage for evidence files. Vercel serves application pages and server requests. A member’s access depends on workspace role and audit permissions; owners and admins manage invitations. File access links are time-limited, but anyone who receives a valid link may be able to use it until it expires.

Only add information you are authorised to share in that workspace. Review the team and the report distribution before uploading or exporting sensitive records. Exported reports and separately shared copies remain with their recipients.

Workspace deletion is an owner-controlled action in the application. Contact us to confirm the retention, backup, deletion and processing-location arrangements that apply to your records, especially if your organisation requires a specific arrangement.

Service providers

We use Vercel for hosting, Stripe for checkout and payments, Supabase for order records and private download storage, Resend for outgoing order and support emails, Cloudflare Email Routing to forward incoming support messages to our support inbox, and Google Analytics for optional analytics. These providers process information needed for their services; payment providers also process data for their own fraud prevention and legal obligations.

Provider information is available from Vercel, Stripe, Supabase, Resend, Cloudflare and Google. Providers may process data in countries outside your own. Contact us for information about the processing locations and transfer safeguards applicable to your data.

We do not sell personal information. We may disclose relevant records where required by law or necessary to investigate fraud or enforce a legal right.

Retention

We retain order and billing records for the period required by applicable tax and accounting rules and for dealing with refunds, disputes and access requests. We retain support correspondence while needed to resolve the enquiry and any related dispute. Technical logs are kept for operational and security purposes. The retention period depends on the type of record and applicable obligations; you can ask us for the period applying to your records.

Your shopping cart and cookie choice are stored in your browser. You can remove them using browser settings. See the Cookie Policy for the storage used by this website.

Your choices and rights

Depending on the law that applies to you, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent for future analytics. Some records must be retained to meet legal obligations or resolve disputes. You may complain to the relevant data protection authority in your country.

To make a request, email hello@isochecklist.com. We may need enough information to verify that the records belong to you. Please do not email card numbers, passwords or unnecessary identity documents.

Keeping your data secure

The site uses HTTPS. Download links contain access credentials, so keep them private and do not post them publicly. We restrict access to order and support information to what is needed to operate the service. No online service can guarantee complete security.

Policy changes

We update this page when our processing changes and show the revision date above. For information about purchases, see our Terms & Conditions and Refund Policy.