1. Who we are and what this covers
Cairn is inspection software made by House IQ Group, a Texas company. It has two parts: FORGE, the report-writing app inspectors use in the field, and CORE, the archive. This policy covers the Cairn app at app.cairninspections.com, the marketing site at cairninspections.com, and the waitlist.
Two kinds of people read this. Inspectors and inspection companies are our customers; they hold accounts. Homebuyers, sellers and agents never hold accounts, but their names, addresses and photos of their homes live inside the reports our customers write. We treat that content as the customer's, held on their behalf, and this policy says exactly what we do with it.
2. What we collect
Account data. A username, a password we store only as a salted hash, a role (owner, inspector or office), and the sessions that role is signed in on. We do not require an email address to hold an account. When a company joins by invite code we record the code, the company name, who created the code and who used it.
Inspection records. Everything a customer writes into a report: the property address, the client's name, the agent's name, phone and email, the seller's name and phone, the inspection date, facts about the house, findings, and photos. Each photo is stored as uploaded. For the evidence log we read the camera's capture time from the photo's own metadata and compute a fingerprint of the file so a photo can never be silently swapped later.
Evidence log. An append-only record of what happened during an inspection: when a finding was written, when a photo was added, when a report was finalised, and when a client acknowledged a report through a share link. Entries carry the time from the inspector's device and the time our server received them. We do not record a client's IP address or browser when they open a share link or acknowledge a report.
Hours on site. Derived from the evidence log so a company can see its own inspectors' time on a job. It is never shared outside that company.
Feedback. If you send feedback from inside the app we keep the text, your username, and which screen you were on.
Waitlist. The marketing site's waitlist form collects your name and email address. That is all it collects.
3. Photos, EXIF and GPS
A phone photo routinely carries the exact coordinates of the house, the capture time and the device model. We keep the original file untouched because the original is the defensible record. Every copy that leaves the gates to someone without an account, meaning a homebuyer opening a share link or the delivered PDF, has that metadata removed first: EXIF and XMP on JPEGs, and the equivalent text chunks on PNGs. We do not extract GPS coordinates from photos into any separate list. Video is served as uploaded and may still carry location metadata; we tell customers this so they can choose what to record.
4. Aerial imagery
When an inspector taps to place an aerial underlay on a termite diagram, the property address is sent to Google Maps Platform to geocode it and return a satellite image. That happens only on that tap. The image is shown on screen, is never stored, and never prints. Google's own privacy policy governs what Google does with the request.
5. How we use it
To run the service for the customer who wrote it: rendering reports, producing PDFs, keeping the evidence log, syncing between devices, and holding the archive. To keep accounts secure. To answer support and feedback. Nothing else.
We do not sell personal information. We do not use inspection content, client names or photos for advertising, marketing, lead lists or resale, and we never share a customer's clients with anyone. Each company's data is isolated from every other company's on the platform.
AI. Cairn's assistant retrieves wording from your own archive and Cairn's macro library when you ask it to. It never writes a report on its own and we do not send inspection content to any outside AI service. No third-party AI provider receives your data.
6. Who else touches the data (subprocessors)
- Render (render.com) hosts the app and its database in the United States (Ohio region). Storage is encrypted at rest by the provider.
- Backblaze (backblaze.com) holds offloaded inspection photos and nightly database backups, in the United States.
- Google Maps Platform receives a property address only when an inspector requests an aerial image, as described above.
- Netlify hosts the marketing site and stores waitlist submissions.
- Email: mail to hello@cairninspections.com is handled by our mail provider.
- Payments: none today. When billing begins we will add the payment processor here; we will never see or store card numbers ourselves.
We do not use analytics, advertising pixels or tracking scripts, on the app or on the site.
7. Cookies and what stays on your device
The app sets one cookie, a signed session identifier that is not readable by scripts and expires at 3:00 am Central each day. The field app also keeps a queue of unsynced work and a copy of the app shell on the inspector's own device so an inspection can continue without signal; that data stays on the device until it syncs. The marketing site sets no cookies.
8. Share links for clients
A homebuyer sees a report through a link the inspector sends. The link carries a random token that cannot be guessed, exists only while the inspector has marked the report paid, and can be revoked by the inspector at any time. Photos behind the link are served with metadata stripped, as above.
9. How long we keep it
Inspection records are kept for as long as the account exists and, under Cairn's free custody commitment, are not deleted for non-payment. Photos are never deleted by the system; a photo removed from a report leaves the report, not the archive. The evidence log is append-only by design. Nightly database backups are kept for 90 days. Waitlist entries are kept until launch communications are done or you ask us to remove you.
10. Your rights
Customers can export their own inspection records at any time from within the app, correct anything they wrote, and ask us to delete their account and its data by writing to hello@cairninspections.com. Deletion is honoured per the Terms of Service and applicable law, and we confirm in writing when it is done.
Homebuyers, sellers and agents whose information appears in a report should contact the inspection company that performed the inspection, since the report belongs to them. If you write to us instead we will pass the request to that company and help them act on it.
Cairn is a business tool. It is not directed to anyone under 18 and we do not knowingly collect information from minors.
11. Security
All traffic is encrypted in transit. Passwords are hashed with scrypt and per-user salts. Every request is checked against the signed-in account's role and company before any data is read or written. Storage is encrypted at rest by our hosting provider. If we learn of a breach affecting your personal information we will notify affected customers without unreasonable delay and within the time Texas law requires.
12. Changes
We will give 30 days' notice before a material change to this policy, the same as for the Terms of Service. The date at the top is the version in effect.
13. Contact
hello@cairninspections.com. Please put Privacy in the subject line so it reaches the right person quickly.