Privacy Policy

We collect:

• Account information. Names, email addresses, and organization details for the people who sign in, so we can create accounts, authenticate users, and provide support.
• Business data you enter. The records a shop keeps in SquareCoil — customers, projects, estimates, proposals, purchase orders, invoices, payments, and employee and payroll details. This belongs to the shop; we process it to run the Service.
• Data from services you connect. When you authorize a connection to a third-party service (for example QuickBooks Online, Xero, Gusto, Stripe, or your email provider), we access data from that service to provide the features you turn on. See Connected services.
• Technical and usage data. Standard server logs (such as IP address, browser type, and timestamps) and limited diagnostic information, used to operate the Service, keep it secure, and fix problems.

You can connect SquareCoil to accounting and business services you already use. These connections are optional, are started by you, and can be disconnected at any time from Settings.

QuickBooks Online. If you connect QuickBooks Online, you authorize SquareCoil, through Intuit’s official OAuth flow, to access the accounting data needed to keep your books in sync — for example your chart of accounts, tax codes, customers and vendors, and the invoices, payments, bills, and credits that SquareCoil creates or reads on your behalf. We use QuickBooks data only to provide the sync features you enable. We do not use it for advertising, and we do not sell it. You can disconnect at any time, which stops the sync and removes SquareCoil’s access.

Google (Gmail). If you connect a Gmail mailbox, you authorize SquareCoil, through Google’s official OAuth flow, to access that mailbox on your behalf. We request the Gmail scope gmail.modify because the mailbox feature needs to read your messages to show them inside SquareCoil, send mail from your own address, and change a message’s state when you act on it — marking it read, starring it, applying a label, archiving, or moving it to trash. We do not delete your mail, and we do not change your Google account settings. A mailbox is connected by one person, is visible only to that person, and can be disconnected at any time from Account → Email, which removes SquareCoil’s access and deletes the stored tokens.

SquareCoil’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the mailbox features you turn on; we do not transfer it except as described in this Policy; we do not use it for advertising; we do not sell it; we do not use it to develop, improve, or train generalized AI or machine-learning models; and we allow humans to read it only where you have given us explicit permission for a specific message, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and de-identified.

Microsoft (Outlook). If you connect an Outlook mailbox instead, the same applies through Microsoft’s OAuth flow, using permissions to read and send mail and to read your basic profile. Your use of Gmail or Outlook remains governed by your agreement with Google or Microsoft.

The access tokens for a connected service are stored encrypted (see How we protect information) and are never shared. Your use of QuickBooks Online remains governed by your agreement with Intuit.

• To provide, maintain, and improve the Service.
• To sync your records with the accounting and business services you connect.
• To authenticate users and secure accounts.
• To provide customer support and respond to your requests.
• To monitor, troubleshoot, and protect the Service against fraud and abuse.
• To meet legal, tax, and regulatory obligations.

We do not sell personal information, and we do not use your business data or connected-service data for advertising.

Some optional features use AI to help you work faster — for example, drafting estimate or proposal text. When you use one of these features, the content you submit for that task is sent to our AI providers, OpenAI and Anthropic, to generate a result, which is returned to you in the Service. When you ask the in-app assistant about the screen you are on, a capture of that screen may be sent with your question. We do not use your data to train AI models, and under our AI providers’ API terms, content submitted through the API is not used to train their models. These features run only when you use them.

One of these features is the email composer’s writing assistant. If you ask it to draft a reply, the text of the message you are replying to — which may come from your connected Gmail or Outlook mailbox — is included in that request so the draft can answer it. This happens only on the specific message you are replying to, only when you press the assistant yourself, and the draft is returned to you and never sent on its own. OpenAI acts as our service provider under contract and does not use API content to train its models. Consistent with the Limited Use commitments above, mailbox content is never used to develop, improve, or train generalized AI or machine-learning models — SquareCoil’s or anyone else’s. If you would rather no mail content reach an AI provider, do not use the assistant on a reply.

We share information only as needed to run the Service:

• Service providers (sub-processors). We use trusted vendors to host and operate the Service, who process data on our behalf under contract. Our current providers include cloud hosting (Vercel), our database and authentication provider (Supabase), payment processing (Stripe), transactional email (Resend), transactional SMS (Twilio), automatic sales-tax calculation (TaxJar), AI-assisted features (OpenAI and Anthropic — see Automated features), and project site weather (Visual Crossing). Several of these run only when you turn on the related feature. This is in addition to the third-party accounts you choose to connect (such as Intuit / QuickBooks Online, Xero, Gusto, and your Google / Gmail or Microsoft / Outlook mailbox), which are described above.
• Legal and safety. When required by law, or to protect the rights, safety, and security of our users, the public, or SquareCoil.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this Policy.

All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

When a shop’s owner or admin invites a team member who has a mobile number but no email address, SquareCoil may send that person a text message with a link to set up their account. We send it only after the owner or admin confirms the person agreed to receive it. Each invite sends one text, and another is sent only if the shop sends the invite again. Message and data rates may apply. Reply STOP to opt out, or HELP for help.

We use mobile numbers only to send these account messages. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text messaging originator opt-in data and consent won’t be shared with any third parties. Our SMS provider, Twilio, delivers the messages on our behalf.

We keep information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When you disconnect a service, we stop syncing with it, delete the access credentials we stored for it, and, where the service supports it, ask it to revoke our access. If that request doesn’t go through, SquareCoil may still appear as connected in the service itself, and you can remove it there. On account termination, we delete or de-identify your data within a commercially reasonable period, unless retention is required by law.

• Encryption in transit. Traffic to and from the Service is encrypted over HTTPS/TLS.
• Encryption at rest. Data is stored in an encrypted database. Access tokens for connected services (such as QuickBooks Online) are additionally encrypted at the application layer with AES-256, using keys separated per integration; they are never stored in plain text.
• Tenant isolation. Each shop’s data is confined to its own tenant and enforced at the database layer, so one organization cannot read another’s records.
• Access controls. Connecting and disconnecting accounting services is limited to a shop’s owner or admin users, and application secrets are held in a managed secret store, not in source code.

No method of transmission or storage is perfectly secure, but we work to protect your information and to hold ourselves to the practices above.

• Access and update your account information from within the Service.
• Disconnect any connected service at any time from Settings.
• Request access to, correction of, or deletion of your personal information, subject to applicable law.

Depending on where you live, you may have additional rights over your personal information. If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect and how we use and disclose it, to request access to or deletion of that information, to request correction of inaccurate information, and not to be discriminated against for exercising these rights. SquareCoil does not sell or share your personal information as those terms are defined under California law. To make a request, contact us at the address below; we will verify it as required by law before responding.

We use only the cookies needed to run the Service — for example to keep you signed in and to remember your display preferences. We do not use third-party advertising cookies.

The Service is a business tool and is not directed to children under 13, and we do not knowingly collect their personal information.

SquareCoil is operated from the United States, and the information we collect is processed and stored there on our U.S.-based hosting and database providers. If you access the Service from outside the United States, you understand your information will be processed in the United States.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above, and, for material changes, we will provide additional notice as appropriate.

Questions about this Policy or your information? Contact us at privacy@squarecoil.com, or by mail at SquareCoil, 3663 Via Mercado, La Mesa, CA 91941.