Privacy Policy

1. Information we collect

• Account information: your email address and password (passwords are stored hashed by our authentication provider — we never see them).
• Business profile: business name, trade, hourly rate, overhead, markups, license number, and contact details you enter to configure the Service.
• Work content: jobs, bids, invoices, payments, planner tasks, leads, and the photos, receipts, and voice recordings you upload or record for AI estimates, receipt scanning, and design previews.
• Financial information: the income, expenses, and related figures you record (or import) so the Service can show your profit, cash, tax set-aside estimates, and Money Co-pilot insights.
• Connected-account data (only if you connect one): if you link a third-party accounting service (e.g., QuickBooks Online or Xero), we import financial records you authorize — such as accounts, transactions, invoices, bills, and profit-and-loss data — on a read-only basis.
• Payment information: handled by our payment processor (Stripe). We do not store full card numbers on our servers. If you enable online invoice payments, we store only your Stripe connected-account identifier and status flags (whether charges and payouts are enabled) — never your bank credentials or your clients’ card data, which Stripe holds and processes directly.
• Usage & device data: basic technical information needed to operate the Service securely (e.g., session and log data).

2. How we use your information

• To provide and operate the Service — generate estimates, build bids and invoices, scan receipts, run the AI coach and receptionist, create design previews, and produce your financial reports and Money Co-pilot insights.
• To personalize your results (for example, learning your labor pace from how you adjust estimates).
• To measure and improve the accuracy of our AI — using de-identified information derived from your use, such as the quantities and scope in a takeoff compared against what you corrected them to. Your business name, your clients’ names and details, your addresses, your rates and your bid totals are never used in an identifiable form, never shown to another customer, and never sold. We ask permission before using any identifiable bid or plan set as a named accuracy benchmark.
• To process payments and manage your subscription.
• To provide support, maintain security, prevent abuse, and meet legal obligations.

3. AI processing

To power features like photo/voice estimates, receipt scanning, the coach, the receptionist, design previews, the Money Co-pilot, and the Plan Estimator (construction plan sets and bid documents you upload), the relevant content (including your own business figures, recomputed by us) is sent to our AI provider, Google (Gemini API), solely to generate your result. We do not use your content to train our own AI models, and Google does not use API content to train theirs. Measuring accuracy (above) is not model training: it compares de-identified numbers to tune our instructions and catch regressions. Google processes API data under its own terms; uploaded plan documents are transmitted to Google for processing and held by Google only temporarily (on the order of days) for that purpose. We encourage you not to submit sensitive personal information you don’t want processed.

4. Connecting an external accounting service

Connecting QuickBooks Online, Xero, or a similar service is a planned, optional feature that is not yet available. When offered, it will be entirely under your control:

• You authorize access through the provider’s own secure login. We request read-only access and never write to, modify, or delete anything in your connected account.
• If you connect such a service, the access tokens would be stored encrypted and used only to read the data needed for your insights.
• You can disconnect at any time from your settings, which revokes our access; you may also request deletion of the data we imported.

5. How we share information

We do not sell your personal information. We share it only with service providers (sub-processors) who help us run the Service, under agreements that limit their use of it:

• Supabase — database, authentication, storage, and hosting.
• Google (Gemini API) — AI processing of your submitted content.
• Vercel — application hosting and delivery.
• Stripe — payment processing (when paid plans are active).
• Twilio — text messaging for the AI receptionist (where enabled).
• Resend — transactional and account email.
• Sentry — error monitoring and diagnostics (error reports may include your IP address and request context).
• Plaid — bank-account connections, only if and when you choose to link a bank. Plaid connects to your bank directly; your bank login credentials are never seen or stored by Boaz. We receive read-only transaction data (dates, amounts, merchants, categories) to power your expenses and financial insights, and we store the connection’s access token encrypted. Plaid’s handling of your data is described in its own End User Privacy Policy. You can disconnect at any time, and we’ll delete the connection and stop importing.
• Intuit (QuickBooks Online) and/or Xero — a planned integration; only if and when you connect them, as the source of the financial data you authorize us to read.

We may also disclose information if required by law, or in connection with a merger, acquisition, or sale of assets (you will be notified of any such change).

Information about your clients and leads. Contractors using Boaz may enter or collect information about their own clients and leads (such as names, contact details, project details, e-signatures — including the signer’s IP address and device information captured for signature verification — and lead messages). Boaz processes this information as a service provider on the contractor’s behalf, solely to provide the Service. The contractor is responsible for providing any notices and obtaining any consents required to collect it. If you are a contractor’s client or lead, you may contact us or the contractor to request deletion of your information.

6. Data isolation & security

Your data is isolated to your account using row-level security, so other customers cannot access it. Data is encrypted in transit, and if you ever connect an external accounting service, its access tokens would be encrypted at rest. Some data may be stored on your own device. No method of transmission or storage is 100% secure, but we work to protect your information using reasonable safeguards. If a security breach affecting your personal information occurs, we will notify affected users without unreasonable delay, as required by law.

7. Data retention

We retain your information for as long as your account is active and as needed to provide the Service. If you disconnect an external accounting service, we stop importing new data and will delete previously imported data on request. Uploaded plan documents and their takeoffs are retained in your account until you delete the plan project or your account. You may request deletion of your account and associated data at any time (see Your Rights). We may retain limited records as required by law.

8. Your rights & choices

You may access, correct, export, or delete your information, and disconnect any linked service. To make a request, email us at ethan@boazcore.com. We will respond to verified requests within 45 days.

9. California privacy rights

If you are a California resident, you have the right to know what personal information we collect, to request its correction or deletion, to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law. Our Service does not respond to browser “Do Not Track” signals; we do not track users across third-party websites. To exercise these rights, contact us at the email above.

10. Cookies

We use only essential cookies needed to keep you signed in and operate the Service. We do not use them for advertising.

11. Children

The Service is for business use by adults and is not directed to anyone under 18. We do not knowingly collect information from children.

12. Changes to this Policy

We may update this Policy from time to time. We will revise the effective date above and, for material changes, take reasonable steps to notify you.

13. Contact us

Questions about this Policy? Email ethan@boazcore.com.