Two kinds of data, and they are not the same.
This policy is about you, the contractor who subscribes: your account, your billing, how you use the service.
The records you put into the CRM — your clients, their phone numbers, your estimates and invoices — are yours. You decide what happens to them; we only hold them for you and never use them for anything of our own. Those are covered by section 5 of the Terms of Service.
| What | Why we have it |
|---|---|
| Your name, email and phone | To run your account, sign you in and reach you about the service |
| Your company name, EIN and address | To create the account, issue your invoices and work out sales tax |
| Billing details | To charge the monthly membership. Card numbers never reach our servers — see section 3 |
| Verification documents | Your IRS EIN letter and owner photo ID, used once to confirm the company is real, then deleted (section 5) |
| Sign-in and activity records | Security, and the activity log your own administrators can read |
| Technical records | IP address, browser and times, kept to prevent abuse and to fix faults |
| Support messages | To answer you and keep track of what was asked |
We use it to provide the service, take payment, give support, prevent fraud and abuse, and meet legal obligations. That is the whole list.
We do not sell your data. We do not rent it. We do not share it for advertising, and we do not use it to train models. There is no advertising network on this site and no tracking pixel.
Payments are handled by Stripe. When you enter a card, you do so on Stripe's own pages: the number, expiry and security code never touch our servers and we never see them. We keep only what Stripe tells us afterwards — the brand, the last four digits, the expiry month, and whether a payment worked. Stripe's own privacy notice governs what they do with the rest.
We use cookies that the service cannot work without:
There are no advertising cookies and no third-party trackers, which is why you are not asked to accept a cookie banner.
| What | How long |
|---|---|
| Verification documents (EIN letter, photo ID) | Deleted the moment the decision is made — we keep only that the check happened |
| Your account and the records in it | While your membership lasts, then 30 days to export before deletion |
| Sign-in and activity records | While the account lasts, as the traceability the Terms promise |
| Invoices and payment records | As long as tax and accounting law requires, even after you leave |
| Reset links and sign-in codes | Minutes, and only ever as an irreversible hash |
Running the service needs a few companies, and each one sees only what its job requires:
We tell you before adding a new one. None of them is allowed to use your data for their own purposes.
If a security incident affects your data, we will tell you without undue delay and in any case within 72 hours of becoming aware of it.
Wherever you are in the United States, you can:
Ask through your account contact and we will answer within 45 days. We will never charge you for asking, and we will never treat you worse for having asked.
This is a tool for businesses. It is not directed at anyone under 18 and we do not knowingly collect their information.
If this policy changes in a way that matters, we will tell you by email and in the service at least 30 days beforehand. Every version is dated, and the one you agreed to is recorded with the date and time.