Privacy Policy

DRAFT — this document must be reviewed by a lawyer before launch. It describes how the service is intended to work and is not yet legal advice or a binding contract.

Last updated: [date to be set at launch]

What we collect

Account details you give us at sign-up (company name, your name, work email, optional phone, country), the business data you and your team enter (customers, jobs, inventory, invoices and so on) and files you upload. We keep ordinary server logs for security and troubleshooting.

How we use it

To run the service for you, to send account and billing emails (verification, trial and payment notices), to keep the service secure and to answer support requests. We do not sell your data and do not use advertising or tracking cookies. This website sets no cookies. The application uses one essential session cookie after you sign in.

Separation between companies

Each company's data is stored under its own company identifier, enforced by row-level security in the database, and files are held in private storage under a per-company prefix.

Sub-processors

Amazon Web Services: hosting, database (RDS), file storage (S3) and email delivery (SES).
Stripe: subscription billing and payment card processing. We never see or store full card numbers.

Retention and deletion

We keep your data while your account is active. If your account is paused (trial ended, cancelled or payment lapsed) we keep it for 30 days, after which the account, data and files are permanently deleted. Backups are overwritten on their normal 7-day cycle. You can download all your data at any time.

Your rights

You can access, correct and export your data in the application, and ask us to delete it. Contact: [privacy contact to be set at launch].

Security

Passwords are stored as salted hashes, connections use HTTPS, owner access to the platform requires two-factor authentication, and any support access to your account requires a reason, shows a banner and is recorded where you can see it.