AHJ Radar · Mason Mathews Facility Assurance, LLC

Privacy Policy

Effective October 14, 2026. This policy applies to AHJ Radar, a product of Mason Mathews Facility Assurance, LLC ("Mason Mathews," "we").

What we collect

Looking up a ZIP code runs in your browser and stores nothing on our servers; the page loads a small public list of post office names for the first three digits of the ZIP. If you type a street address, our server passes it once to the U.S. Census Bureau’s public geocoder to find the county and city, and we do not keep it.

The free reference needs no account. What you choose or type in the tools (a state, a topic, a citation, the four building-type facts) stays in your browser and is not sent to us; the building-type facts are cleared when the page reloads.

Citation Decoder. Text you type or paste into the decoder is read in your browser and is not sent to us. If you add a PDF that contains real text, it is read in your browser and never uploaded. If you add a photo or a scanned page, it is sent once to our server, which passes it to Microsoft Azure Document Intelligence for text recognition and then deletes the image or file; Microsoft does not keep it for training. We hold the recognized text, with no name or account attached, for up to 60 minutes while you work, or until you press Delete now or leave the page, and every remaining job is purged within 24 hours in any case. The extracted text is not read by us and is not used for anything else. If a decoder answer is shared by link, only the citation text you typed is in the link.

Membership notice. If you leave an email address for the membership notice, we keep that address and the date you left it. It is used for one message when membership opens and for the confirmation, and for nothing else. It does not create an account. The confirmation carries a link that removes the address at once.

Free weekly digest. If you ask for the weekly digest, we keep your email address, your first name if you choose to give it (used only to greet you in these emails), the state you choose if you choose one (used only to send you the heads-ups and reminders that apply there; leaving it blank means nationwide), the date you asked and the date you confirmed. We send a confirmation first and nothing else until you confirm. After that you get the Monday issue with new Regulatory FYI entries, changes on the radar and upcoming dates; a heads-up issue on a day an agency publishes a report or enforcement result that changes what a building team should check; a reminder 30 days and 7 days before a deadline on the radar; two short getting-started notes in your first two weeks; and, once a month, the refreshed OSHA citation tables. Never more than one email in a day or three in a week. Every email has a one-click unsubscribe, which removes the address, and the first name if you gave one, from the list. Delivery records, which show only the address, the subject and whether it was sent, are deleted at the same time and in any case within 90 days. If our email provider reports that an address bounced or marked a message as spam, the address is removed from the list at once. Links in our emails carry the issue and link number so we can count which issues are read; the count is not tied to any address. We do not sell or share the list, and it does not create an account.

Members. Your work email; your name and role if you give them; your password, stored only as a salted one-way hash; the authenticator secret for the two-step sign-in every account uses; the plan; and the properties you add: name, street address, ZIP code, city and county, year built, stories, sector and coastal setting. The building profile answers (Yes, No or Not sure about the systems in the building, gross floor area and number of employees), and the last inspection dates your team chooses to enter. AHJ Radar keeps a dated history of what it reported for each property. It does not collect vendors, budgets, work records or documents. Accounts created before September 30, 2026 may also hold notes, register entries, vendor contacts and attached files entered under the earlier product; they are kept until you delete them, are included in your data export, and can be deleted in the app. We do not ask for drawings.

Payments are taken by Stripe on Stripe's hosted checkout. We receive the billing email, a customer reference and the plan. Card and bank numbers never reach our systems.

Security logs. Sign-in requests and sign-ins with time and IP address, kept 90 days; request-rate records, kept 24 hours. No analytics scripts and no tracking: the only cookie we set is the sign-in session. The public pages keep one set of aggregate daily counts (how many times the decoder was run and whether it produced a reading, how many digest requests and confirmations) that hold no identifier, no page content and no citation text; a browser also keeps a local flag of its own so a return visit counts as a return, and that flag never leaves the browser.

How we use it

To resolve the authorities that govern your properties, determine which requirements apply, show the changes and dates that reach them, keep the history of what Radar reported, send the alerts you choose, bill the subscription, secure the service and meet legal obligations. We do not sell personal information and we do not use it for advertising.

Sharing

With the people who hold a building's team link on your account. With service providers under contract who act only on our instructions: Cloudflare (hosting, database, file storage and network security), Stripe (payments), Resend (email delivery) and Microsoft Azure (text recognition for photos and scans you choose to add to the Citation Decoder). Street addresses typed into the public lookup go to the U.S. Census Bureau’s geocoder as described above. When required by law, and as part of a business transfer. Data is processed in the United States.

Retention

Account data stays while the account is active and for the period the law requires for accounting. Sign-in links expire in 15 minutes and are deleted daily; a session ends after 30 minutes without activity and never lasts more than 30 days. The public archive of past sweeps contains no personal data.

Your rights

You can export your data from the app at any time and delete your account and buildings yourself; the deletion is immediate and complete for the buildings, records and preferences, and your email is kept only on an inactive membership line for billing reconciliation. Residents of the EU, the UK, California and other places with privacy laws have rights of access, correction, deletion, portability and objection; write to radar@ahjradar.com and we answer within 30 days. Our legal basis for processing is the contract with you and our legitimate interest in running a secure service.

Cookies

One first-party cookie, for sign-in, marked HttpOnly and Secure; the session behind it ends after 30 minutes without activity. No third-party cookies.

Children

The service is for businesses and is not directed to children. We do not knowingly collect information from anyone under 18.

Contact

Questions or requests about your information: radar@ahjradar.com.

AHJ Radar™ is a trademark of Mason Mathews Facility Assurance, LLC. Official sources read daily since September 2026; every entry names its source. Content and compilations © 2026 Mason Mathews Facility Assurance, LLC, for personal and internal use under the Terms of Use; no redistribution or resale.

Mason Mathews Facility Assurance, LLC · Privacy Policy · Terms of Use · AHJ Radar