Privacy Policy

Effective date: May 17, 2026 · Last updated: May 17, 2026

This Privacy Policy describes how Scope IT Consulting LLC ("Scope IT," "we," "us," or "our") collects, uses, and shares information through the GovSpect service available at govspect.ai (the marketing and public-information website) and app.govspect.ai (the authenticated permit and inspection management application), together with any related applications, APIs, mobile / progressive web apps, public verify pages (/verify/<number>), and respondent / applicant portal (collectively, the "Service"). GovSpect is a multi-tenant Software-as-a-Service platform purpose-built for state and local regulatory agencies to manage the full lifecycle of permits, licenses, inspections, enforcement, quarantines, and records.

Sections

1. Who we are
2. Information we collect
3. How we use information
4. Email & notifications
5. SMS & messaging
6. Payments
7. Location, photos & field capture
8. How we share information
9. Third-party service providers
10. Public verify pages & open records
11. Children's privacy
12. Data retention
13. Security
14. Your rights & choices
15. International transfers
16. Cookies & analytics
17. Changes to this policy
18. Contact us

1. Who we are

GovSpect (govspect.ai and app.govspect.ai) is owned and operated by Scope IT Consulting LLC, a Georgia limited liability company headquartered at 2330 Satellite Blvd, Duluth, GA, USA. Scope IT is a minority-owned small business with offices in Georgia, North Carolina, and India. References to "we," "us," and "our" mean Scope IT Consulting LLC.

2. Information we collect

2.1 Information Agencies provide to us

When an Agency uses GovSpect, the Agency provides us with information about its operations, its staff, and the regulated public it interacts with, which may include:

• Agency information: agency name, division, mailing address, contact details, brand color, logo, and configuration choices (permit types, fee schedules, inspection checklists, deadline rules, workflow stages).
• Staff information: name, email address, per-tenant role (Admin, Manager, Supervisor, Inspector, Read-Only Auditor), division pinning, avatar color, hours worked, audit-log entries, and security-event records (logins, lockouts, MFA / SSO events, RBAC changes).
• Applicant, respondent, licensee & permit-holder information: name, mailing address, email address, phone number, business name, parcel / address being permitted or inspected, application content, uploaded supporting documents, payment status, e-signature on application forms, and any other information the Agency collects on its configured intake or permit forms.
• Case & inspection information: case narrative, violations, citations, photos, GPS coordinates of inspections and sample-collection events, lab sample chain-of-custody records, certificates issued, enforcement actions (warning letters, civil penalties, appeals), and quarantine actions.
• Form submissions and signatures: the version of the form the applicant or respondent saw, the responses, and any typed e-signature.

2.2 Information we collect automatically

When users (Agency staff, applicants, respondents, members of the public on a verify page) access the Service, we automatically collect limited technical information including IP address, device and browser type, operating system, pages visited, and timestamps, for security, fraud prevention, rate-limiting, and service performance. We log meaningful state changes in an immutable audit trail and write security-relevant events (sign-in attempts, account lockouts, RBAC changes, MFA and SSO events, sync conflicts, portal events) to a separate security-event stream.

2.3 Information from authentication providers

Agency staff authenticate by email and password, by Google Sign-In (if the Agency admin has enabled it and added the user's email to the allow-list), or by the Agency's enterprise identity provider via Single Sign-On — GovSpect supports both SAML 2.0 and OpenID Connect (OIDC) for providers such as Azure AD, Okta, and Google Workspace. When SSO is used, the identity provider supplies us with the user's verified email and the name attributes the Agency configured the IdP to release; we do not see the user's password. Multi-factor authentication is available using a TOTP authenticator app, with one-time recovery codes and optional trusted-device cookies. Members of the public who use an applicant or respondent portal create a portal account (email + password, with self-service password reset) or, where the Agency has enabled it, sign in via Google.

2.4 Information we receive from third-party systems

Where an Agency has configured an integration, the Service may exchange information with external systems such as state license registries (e.g. Kelly Registration Systems), federal regulatory systems (e.g. USDA PCIT), diagnostic laboratories (sample submissions and results), and geographic information system (GIS) feature services (e.g. county parcel layers via ArcGIS) to verify a parcel or property associated with an application. Each integration runs under credentials the Agency provides and is scoped to the Agency's own tenant.

3. How we use information

We use information to:

• Provide, operate, secure, and improve the Service;
• Authenticate users and prevent unauthorized access (including rate-limiting, account lockout, MFA, and trusted-device verification);
• Deliver communications between an Agency and its applicants, respondents, licensees, and staff (email and, where enabled, SMS);
• Process permit fees, application fees, and civil-penalty payments through our payment processor (see Section 6);
• Generate certificates, permits, and enforcement orders as PDFs, with embedded QR codes that link to a public verify page;
• Maintain the immutable audit log of meaningful actions taken in the Service and the security-event stream;
• Perform records retention, legal holds, and audited purge operations on behalf of each Agency;
• Monitor service health, diagnose errors, and capture exceptions (in aggregate or with the minimum context required to debug);
• Comply with legal obligations and respond to lawful requests;
• Communicate with Agency administrators about service updates, security advisories, and support.

We do not sell personal information. We do not use information that Agencies, their staff, or members of the public provide through the Service for advertising, marketing to unrelated third parties, or training third-party generative-AI systems. AI features that operate on Agency content (for example, AI-assisted narrative summarization gated by a per-tenant feature flag) operate only on that Agency's own data and only when the Agency has enabled the feature.

4. Email & notifications

GovSpect delivers transactional email from an Agency to its staff, applicants, respondents, and licensees through our email integration. Email types include account invitations, password resets, application status updates, permit issued / suspended / expired notifications, inspection scheduling, document approval requests, enforcement-order delivery, scheduled report deliveries, and operations-monitoring alerts to Agency admins. Each Agency configures the sender display name; Scope IT's physical mailing address appears as required by the U.S. CAN-SPAM Act where applicable. Transactional emails directly related to a permit, license, inspection, or enforcement matter generally do not include an unsubscribe link because the message is part of a regulatory interaction with the Agency.

5. SMS & messaging

5.1 Opt-in

Where an Agency has enabled SMS, applicants, respondents, licensees, and staff opt in to receive SMS by providing their mobile number to the Agency on an enrollment, application, or contact form (paper or electronic) or through the GovSpect portal. Opt-in confirms agreement to receive transactional and account-related SMS messages from that Agency through GovSpect.

5.2 Message types

Customer-care SMS sent through the Service may include: inspection scheduling and confirmation, application status updates, permit and certificate notices, payment reminders, code-violation notifications, deadline alerts, and replies to applicant or respondent inquiries.

5.3 Opt-out and HELP

You may opt out of SMS at any time by replying STOP to any message. You may request help by replying HELP. Opting out stops future SMS from the Agency through the Service. The Agency may still attempt to reach you by other means (e.g., email, mail, or phone) as required by the regulatory process.

5.4 No third-party SMS data sharing for marketing

Information collected to deliver SMS — including phone numbers, opt-in status, opt-out status, and message content — is not shared with third parties for marketing purposes. We share SMS-related data only with our messaging provider for the purpose of delivering messages and as otherwise described in this Policy.

6. Payments

Where an Agency has enabled online payments, GovSpect processes permit fees, application fees, civil penalties, and convenience fees through Stripe. Payment-card information (card number, expiration, CVC) is entered into Stripe's hosted Checkout page; Scope IT does not see, store, or transmit raw payment-card numbers. We receive and store the payment confirmation, the last four digits of the card, the amount charged, the Stripe charge reference, and the application or case the payment is associated with, for receipt generation, ledger reconciliation, and refund handling. Agencies that record offline payments (check, cash, money order) enter only the reference number, method, and amount. Convenience fees, refund policy, and payment mode (Offline / Stripe / External processor) are configured by Scope IT per-tenant at the Agency's direction.

7. Location, photos & field capture

GovSpect is mobile-first and supports field inspection capture on a phone or tablet, including when the device is offline. When an inspector starts or completes an inspection, the device's GPS coordinates may be captured and stored with the inspection record (the Agency configures whether geolocation is required for a given inspection type). Inspectors may take photos during an inspection; photos are queued in the device's local IndexedDB and uploaded to GovSpect's object storage when the device next has network connectivity. Inspectors and respondents may capture a typed or drawn e-signature on an inspection report or application form. Inspectors may also use voice dictation for free-text narrative fields when the Agency has enabled the voice-input feature; audio may be processed by the browser's built-in Web Speech API or, as a server-side fallback, by a transcription provider configured by the Agency. The Navigate button on a route stop opens Google Maps in a new tab using the stop's saved GPS coordinates; GovSpect does not embed third-party advertising or location-tracking beacons.

8. How we share information

We share information only as described below:

• With the Agency. Each Agency can access information about its own staff, applicants, respondents, licensees, permits, inspections, and casework. Agencies do not have access to other Agencies' information; tenant isolation is enforced at the application layer.
• With service providers. See Section 9.
• With the public, where required by law or by the Agency's own regulatory program. See Section 10 on public verify pages.
• With authorities. When required by law, court order, subpoena, or other legal process, or to protect the rights, safety, or property of Scope IT, an Agency, or any person.
• In connection with a business transfer. If Scope IT is involved in a merger, acquisition, financing, or sale of assets, information may be transferred subject to the same protections.

We do not sell personal information to third parties.

9. Third-party service providers

We rely on a small number of vetted service providers to operate the Service. Each provider is bound by a contract that limits their use of information to the services they provide to us:

10. Public verify pages & open records

GovSpect issues certificates and permits as PDFs with an embedded QR code that links to a public verify page at /verify/<number>. The public verify page shows a limited set of information — typically the permit or certificate number, status (valid, expired, suspended, revoked), issue date, expiration date, and the issuing Agency — to allow the public, partner agencies, and inspectors in the field to confirm authenticity. The specific fields shown on a verify page are configured by the Agency. Agencies are also subject to open-records, freedom-of-information, and public-disclosure laws that may require them to release additional information held in GovSpect on request; the Agency is responsible for responding to those requests.

11. Children's privacy

GovSpect is designed for use by government agency staff and adult applicants, respondents, licensees, and members of the public who interact with a regulatory program. The Service is not directed to children under 13, and Scope IT does not knowingly collect personal information directly from children. If an Agency's regulatory program involves the collection of information about minors and the Agency uses GovSpect to process that information, the Agency is the controller of that information and is responsible for compliance with the U.S. Children's Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA, if applicable), state laws, and any analogous laws.

If you are a parent or guardian and believe an Agency has collected information about your child through the Service in a way you did not consent to, please contact the Agency directly, or contact us at privacy@govspect.ai and we will assist.

12. Data retention

We retain personal information for as long as an Agency is using the Service and as necessary to comply with our legal obligations, resolve disputes, and enforce agreements. Each Agency configures retention policies per entity type (cases, inspections, samples, certificates, audit events, etc.) in GovSpect's Records Governance surface; the Service runs audited purge jobs against those policies with a dry-run preview before deletion. Agencies may also place polymorphic legal holds on individual records to prevent their deletion while a matter is open. Audit-log entries and security-event records are retained according to the Agency's audit retention policy so that the Agency can produce defensible records.

When an Agency stops using the Service, we will return or delete personal information at the Agency's written request, subject to legal retention requirements and any then-active legal hold.

13. Security

We use administrative, technical, and physical safeguards designed to protect personal information. Controls include:

• Encryption in transit (TLS / HTTPS only; HSTS enabled in production; mTLS between the edge proxy and the API origin).
• Encryption at rest as provided by the hosting platform's managed Postgres and object storage.
• Tenant isolation at the application layer — every domain row carries an organizationId, and every authenticated request is scoped to the caller's active Agency.
• Role-based access control with a per-tenant Permissions Matrix and seeded roles (Admin, Manager, Supervisor, Inspector, Read-Only Auditor, Respondent / Applicant).
• Authentication hardening: configurable password policy, account lockout after configurable failed-attempt threshold, session timeout, optional multi-factor authentication via TOTP authenticator app with recovery codes and trusted devices, optional Single Sign-On via SAML 2.0 or OpenID Connect.
• Per-route rate limiting on authentication, password reset, and portal-login endpoints, plus per-IP burst limits to defend against credential stuffing.
• Session cookies marked HttpOnly, SameSite=lax, and Secure in production.
• Helmet security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and a Content Security Policy.
• Immutable audit log and security-event stream for every meaningful state change and security-relevant event.
• Object-storage access via short-lived presigned URLs; the server proxies upstream integration calls and injects credentials server-side so the browser never sees them.
• Crash and exception capture configured to scrub passwords, tokens, session cookies, and known secret-shaped fields before transmission.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

14. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or restrict the processing of personal information about you, or to receive a copy in a portable format. Because each Agency controls its own data and is the controller of the information about its staff, applicants, and members of the public, please direct most requests to the Agency that holds your records. We will support the Agency in responding to your request.

For requests directed to Scope IT — for example, regarding information we hold as a controller (such as information about Agency administrators we use to operate the Service, or marketing-list information on govspect.ai), contact us at privacy@govspect.ai.

You may opt out of marketing emails by following the unsubscribe link in any marketing message. You may opt out of SMS by replying STOP. You may manage your authenticator apps, regenerate recovery codes, and revoke trusted devices at any time from My security in your avatar menu in app.govspect.ai.

15. International transfers

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. For customers with strict data-residency requirements (e.g. data must remain within a named US state or within FedRAMP-aligned infrastructure), GovSpect supports a single-tenant deployment in a customer-designated region as a procurement option.

16. Cookies and analytics

We use a small number of cookies and similar technologies that are necessary to operate the Service. These include a session cookie (ims.sid) used to keep Agency staff and portal users signed in, an optional trusted-device cookie used to remember a verified MFA device, and short-lived cookies set during SSO and Google Sign-In handshakes. We use limited analytics to understand usage and improve performance. We do not use cookies to track users across unrelated websites for advertising and we do not embed third-party advertising beacons in the Service.

17. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, provide additional notice to Agency administrators by email or in-product notice.

18. Contact us

If you have questions about this Privacy Policy or our practices, please contact us:

Scope IT Consulting LLC
Attn: Privacy — govspect.ai
2330 Satellite Blvd, Duluth, GA, USA
Email: privacy@govspect.ai
Phone: 888.726.7327

This page is provided for informational purposes and does not constitute legal advice. Agencies using the Service are responsible for their own privacy disclosures to their staff and to the members of the public they regulate.