Privacy Policy

1. Information we collect

• Account & contact information — name, business, email, and role of people who sign up, book a call, or are provisioned as users.
• Customer Data — price books, rates, fees, rules, job/customer details, uploads, and quote history a customer enters, processed on the customer’s behalf.
• Usage & device information — log data such as IP address, browser type, and actions, used to operate and secure the Service.
• Communications — messages you send us.

We do not intentionally collect special-category personal data, and we ask customers not to put sensitive personal data into free-text or quoting fields.

2. How we use information

We use information to provide, operate, secure, and improve the Service; set up and support accounts; communicate with you; process payments; comply with law; and prevent fraud or misuse. We process Customer Data only to provide the Service and per the customer’s instructions and the DPA.

We do not sell personal information, and we do not use a customer’s Customer Data to train third-party AI models for our general benefit.

3. How AI processes your data & our sub-processors

AI processing. When an employee describes a job in the chat, the Service sends the text of that request (the job description, site/vehicle details, and the price-book items matched to it) to our AI model provider, Anthropic (Claude), which extracts the job details and formats the quote. The AI never computes prices — all pricing math is done by deterministic code against the price book you configure; the model only reads job text and drafts wording. We do not use your Customer Data — and Anthropic does not use data sent through its API — to train AI models.

No solely-automated decisions. The Service does not make decisions producing legal or similarly significant effects on an individual through solely automated means. All AI Output is a draft that a human must review, correct, and approve before it is used or sent (see Terms §4). We do not use the Service for profiling or automated decision-making within the meaning of Article 22 GDPR or the CPRA’s automated decision-making rules.

Sub-processors. We use the vendors below to run the Service. Each processes data on our behalf under its own security and confidentiality commitments, and none uses your data to train its own models for its general benefit:

• Anthropic (Claude) — extracts job details + drafts quote wording; does not train on API data (US).
• Supabase — primary database + file storage, tenant-isolated by row-level security (US).
• Clerk — authentication + organization/user management (US).
• Vercel — hosting for the web app; request/usage logs, IP addresses (US, global edge).
• Railway — hosting for the quote-engine API (US).
• Stripe — subscription billing; card data is handled by Stripe and never stored by us (US).
• Resend — transactional email delivery, e.g. emailing a quote to your customer (US).
• Sentry — error monitoring, configured to scrub tokens/secrets and personal data before capture (US).

We use no advertising or analytics trackers. If that ever changes, we will list them here and re-evaluate the “do not sell/share” posture in Sections 4 and 8.

4. How we share information

We share information only with sub-processors and service providers under contract; a customer’s own organization (their data stays within their tenant); authorities when required by law or to protect rights and safety; and a successor in a merger or asset sale, subject to this Policy.

5. Security

We use industry-standard measures including encryption in transit and at rest, access controls, and tenant isolation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data retention

We retain account and Customer Data while the account is active and as needed to provide the Service, then delete or de-identify it within a commercially reasonable period after termination, except where law requires retention.

7. Your rights

Depending on where you live (including under the CCPA/CPRA in California), you may have rights to access, correct, delete, or port your personal information and to opt out of certain processing. For data held inside the Service on a business customer’s behalf, direct requests to that business; we assist them as the processor. To exercise rights in data we control, contact build@emeraldsolutionslabs.com. We do not discriminate against you for exercising your rights.

Deleting your data. To request deletion of your account and the personal information we control, email build@emeraldsolutionslabs.com with the subject line “Delete my data.” We will verify the request and delete or de-identify that information within a commercially reasonable period, except where the law requires us to retain it. For Customer Data held inside the Service on a business’s behalf, deletion is directed by that business and follows our offboarding process (a 30-day deletion window after termination).

8. California notice

We do not sell or “share” (as defined under the CPRA) personal information. California residents may exercise the rights in Section 7.

9. Children

The Service is for businesses and is not directed to children under 16. We do not knowingly collect personal information from children.

10. International users

We operate in the United States. If you access the Service from outside the U.S., your information will be processed in the U.S.

11. Changes

We may update this Policy and will post the updated version with a new “Last updated” date. Material changes will be communicated as required by law.

12. Contact

Privacy questions: build@emeraldsolutionslabs.com — Emerald Solutions Labs, LLC, operating Clinch.