Privacy Policy

1. Information we collect

• Account information: your email address and password (passwords are stored hashed by our authentication provider — we never see them).
• Business profile: business name, trade, hourly rate, overhead, markups, license number, and contact details you enter to configure the Service.
• Work content: jobs, bids, invoices, payments, planner tasks, schedules, leads, project messages (including client email replies captured into a job’s message thread), files and photos you upload or share on client project pages and crew links, and the photos, receipts, and voice recordings you upload or record for AI estimates, receipt scanning, and design previews.
• Marketing-site inquiries: if you fill out a contact or lead form on boazcore.com (for example, to get our intro video), we collect the name, email, phone number, and message you submit, to respond to you (see Marketing communications below).
• Financial information: the income, expenses, and related figures you record (or import) so the Service can show your profit, cash, tax set-aside estimates, and Money Co-pilot insights.
• Connected-account data (only if you connect one): if you link a third-party accounting service (e.g., QuickBooks Online or Xero), we import financial records you authorize — such as accounts, transactions, invoices, bills, and profit-and-loss data — on a read-only basis.
• Payment information: handled by our payment processor (Stripe). We do not store full card numbers on our servers. If you enable online invoice payments, we store only your Stripe connected-account identifier and status flags (whether charges and payouts are enabled) — never your bank credentials or your clients’ card data, which Stripe holds and processes directly.
• Usage & device data: basic technical information needed to operate the Service securely (e.g., session and log data).

2. How we use your information

• To provide and operate the Service — generate estimates, build bids and invoices, scan receipts, run the AI coach and receptionist, create design previews, and produce your financial reports and Money Co-pilot insights.
• To personalize your results (for example, learning your labor pace from how you adjust estimates).
• To measure and improve the accuracy of our AI — using de-identified information derived from your use, such as the quantities and scope in a takeoff compared against what you corrected them to. Your business name, your clients’ names and details, your addresses, your rates and your bid totals are never used in an identifiable form, never shown to another customer, and never sold. We ask permission before using any identifiable bid or plan set as a named accuracy benchmark.
• To process payments and manage your subscription.
• To provide support, maintain security, prevent abuse, and meet legal obligations.

3. AI processing

To power features like photo/voice estimates, receipt scanning, the coach, the receptionist, design previews, the Money Co-pilot, and the Plan Estimator (construction plan sets and bid documents you upload), the relevant content (including your own business figures, recomputed by us) is sent to our AI provider, Google (Gemini API), solely to generate your result. We do not use your content to train our own AI models, and Google does not use API content to train theirs. Measuring accuracy (above) is not model training: it compares de-identified numbers to tune our instructions and catch regressions. Google processes API data under its own terms; uploaded plan documents are transmitted to Google for processing and held by Google only temporarily (on the order of days) for that purpose. We encourage you not to submit sensitive personal information you don’t want processed.

4. Connecting an external accounting service

Connecting QuickBooks Online, Xero, or a similar service is a planned, optional feature that is not yet available. When offered, it will be entirely under your control:

• You authorize access through the provider’s own secure login. We request read-only access and never write to, modify, or delete anything in your connected account.
• If you connect such a service, the access tokens would be stored encrypted and used only to read the data needed for your insights.
• You can disconnect at any time from your settings, which revokes our access; you may also request deletion of the data we imported.

5. How we share information

We do not sell your personal information. We share it only with service providers (sub-processors) who help us run the Service, under agreements that limit their use of it:

• Supabase — database, authentication, storage, and hosting.
• Google (Gemini API) — AI processing of your submitted content.
• Vercel — application hosting and delivery.
• Stripe — payment processing (when paid plans are active).
• Twilio — text messaging for the AI receptionist (where enabled).
• Resend — transactional and account email.
• Sentry — error monitoring and diagnostics (error reports may include your IP address and request context).
• Plaid — bank-account connections, only if and when you choose to link a bank. Plaid connects to your bank directly; your bank login credentials are never seen or stored by Boaz. We receive read-only transaction data (dates, amounts, merchants, categories) to power your expenses and financial insights, and we store the connection’s access token encrypted. Plaid’s handling of your data is described in its own End User Privacy Policy. You can disconnect at any time, and we’ll delete the connection and stop importing.
• Intuit (QuickBooks Online) and/or Xero — a planned integration; only if and when you connect them, as the source of the financial data you authorize us to read.

We may also disclose information if required by law, or in connection with a merger, acquisition, or sale of assets (you will be notified of any such change).

Information about your clients and leads. Contractors using Boaz may enter or collect information about their own clients, crews, and leads (such as names, contact details, project details, e-signatures — including the signer’s IP address and device information captured for signature verification — lead messages, and messages or files exchanged through a client project page or its email thread). Boaz processes this information as a service provider on the contractor’s behalf, solely to provide the Service — for example, delivering a message a client posts on their project page to the contractor and notifying each side by email. The contractor is responsible for providing any notices and obtaining any consents required to collect it, and for what they share through project pages and crew links. If you are a contractor’s client, crew member, or lead, you may contact us or the contractor to request deletion of your information.

6. Data isolation & security

Your data is isolated to your account using row-level security, so other customers cannot access it. Data is encrypted in transit, and if you ever connect an external accounting service, its access tokens would be encrypted at rest. Some data may be stored on your own device. No method of transmission or storage is 100% secure, but we work to protect your information using reasonable safeguards. If a security breach affecting your personal information occurs, we will notify affected users without unreasonable delay, as required by law.

7. Data retention

We retain your information for as long as your account is active and as needed to provide the Service. If you disconnect an external accounting service, we stop importing new data and will delete previously imported data on request. Uploaded plan documents and their takeoffs are retained in your account until you delete the plan project or your account. You may request deletion of your account and associated data at any time (see Your Rights). We may retain limited records as required by law.

8. Your rights & choices

You may access, correct, export, or delete your information, and disconnect any linked service. To make a request, email us at ethan@boazcore.com. We will respond to verified requests within 45 days.

9. Marketing communications & advertising

• Emails from us. If you submit a lead form on boazcore.com, we send you the information you asked for and may send a brief follow-up. Every such email includes a working unsubscribe link (and supports one-click unsubscribe); opting out stops marketing email immediately. Account and transactional emails (receipts, sign-in links, document notifications) are separate and continue while you have an account.
• Advertising measurement on the marketing site. Pages on boazcore.com used for advertising campaigns may include the Meta (Facebook) Pixel, which uses cookies and device identifiers to tell us whether our ads led to a page visit, a form submission, or a booked call. This shares limited device and usage information with Meta, which Meta processes under its own policies. The Boaz application itself (app.boazcore.com) contains no advertising trackers. You can limit ad tracking through your browser’s cookie controls and your Meta ad preferences, or email us to ask about the data we hold.

10. California privacy rights

If you are a California resident, you have the right to know what personal information we collect, to request its correction or deletion, to limit the use of sensitive personal information, to opt out of “sharing” for cross-context behavioral advertising, and to not be discriminated against for exercising these rights. We do not sell personal information. The advertising pixel described above, where used on our marketing site, may constitute “sharing” under California law — you can opt out by using your browser’s cookie controls on that site or by emailing us at the address above, and the Boaz application itself shares nothing for advertising. Our Service does not respond to browser “Do Not Track” signals. To exercise any of these rights, contact us at the email above.

11. Cookies

Inside the Boaz application we use only essential cookies needed to keep you signed in and operate the Service — none for advertising. Our marketing site (boazcore.com) may set advertising-measurement cookies via the Meta Pixel on campaign pages, as described in Section 9.

12. Children

The Service is for business use by adults and is not directed to anyone under 18. We do not knowingly collect information from children.

13. Changes to this Policy

We may update this Policy from time to time. We will revise the effective date above and, for material changes, take reasonable steps to notify you.

14. Contact us

Questions about this Policy? Email ethan@boazcore.com.