Privacy Policy

1. Information We Collect

Information You Provide

• Account Information: Name, email address, phone number, business name, and billing information when you create an account. We verify your mobile number by sending a one-time code by text message. If you sign in with Google or Apple, we receive your name and email address from that provider
• Business Data: Customer records, quotes, invoices, expenses, work items, and other data you enter into the Service, including photos, receipts and other files you upload
• Communications: Messages you send to us or through the Service
• Payment Information: Payment card details processed by our third-party payment processor. Bank account details used for payments are also entered with and processed by that processor; we do not store full card or bank account numbers. When your customers pay you through the Service, the processor handles their payment details and we receive confirmation of the payment

iOS In-App Purchase Data

When you subscribe to Capoflow through the iOS application, Apple In-App Purchase processes your transaction. As part of that process, Apple provides us with limited transaction metadata required to activate and maintain your subscription, including:

• A signed transaction receipt (a JSON Web Signature issued by Apple) used to verify the legitimacy of the purchase
• Apple-issued transaction identifiers (transaction ID and original transaction ID) used to track renewals and prevent duplicate processing
• The product identifier of the subscription tier you purchased
• The subscription environment (sandbox or production) and the purchase, renewal, expiration, and (if applicable) revocation timestamps
• An app-account token (a UUID we generate that is bound to your Capoflow account) so we can match the Apple transaction to the correct account

We do not receive your Apple ID, name, email address, payment card details, billing address, or any other personal information from Apple as part of this process. Apple retains your payment information; Capoflow does not.

We use this transaction metadata solely to (a) activate and maintain your subscription entitlement, (b) keep your subscription status in sync with Apple's servers via App Store Server Notifications, and (c) preserve an audit trail of subscription events for support and accounting purposes. This data is not used for advertising and is not sold or shared with third parties.

Information from Third-Party Integrations

When you connect third-party services (such as Intuit QuickBooks), we collect data from those services that you authorize us to access, which may include:

• Customer and contact information
• Invoice and payment records
• Estimates and, if you choose, products and services
• Bank account names, account type, the last four digits of the account number, balances and transactions (date, amount, description and status), if you connect a bank account
• Transaction history
• Business financial data

You control which integrations are connected and may disconnect them at any time.

Information Collected Automatically

• Usage Data: Pages viewed, features used, and actions taken within the Service
• Device Information: Browser type, operating system, and device identifiers
• Push Notification Tokens: If you allow notifications, we store a device or browser token so that notifications can be delivered through Apple, Google or your browser's push service
• Log Data: IP address, access times, and referring URLs
• Cookies: We use cookies and similar technologies to operate and improve the Service
• Photo Location: When you take a photo with the camera inside the Capoflow mobile app and your device's location permission allows it, we record the device's precise location with that photo. When you upload a photo file, we may also read location information already embedded in the file. You control location access through your device settings, and your workspace settings control who on your team can see photo locations.

Customer Photo Links

Where available, a business using the Service may share selected job photos with its customer through a link that can be opened without a Capoflow login. When someone opens such a link, we use a short-lived session cookie to keep the viewing session secure, and we record the number of views and when the link was last viewed so the business can see that the link was used. Links expire and can be revoked by the business at any time. Downloads, and the display of a photo's location, are available to viewers only if the business turns them on for that link.

2. How We Use Information

We use collected information to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send administrative messages and updates
• Respond to your requests and provide support
• Analyze usage to improve features and user experience
• Detect, prevent, and address technical issues or fraud
• Comply with legal obligations

We do not sell, rent, or share your personal information or business data with third parties for their own marketing purposes or for monetary or other valuable consideration.

AI-Assisted Features

Capo AI and other AI-assisted features (such as AI-assisted quotes, receipt reading, follow-up drafts, and suggestions) send the relevant business data, such as work item and customer details, pricing, and receipt or photo images, to our AI service provider, OpenAI, to produce results for you. We keep the text of questions asked to Capo AI (not the AI's responses) for approximately ninety (90) days, after which it is deleted automatically.

3. How We Share Information

We may share information in the following circumstances:

Service Providers

We share information with third-party vendors who perform services on our behalf, such as:

• Cloud hosting and infrastructure (e.g., Supabase, Vercel)
• Payment processing (e.g., Stripe)
• iOS In-App Purchase subscriptions (Apple Inc.)
• Email delivery (e.g., Resend)
• Text messaging and phone number services (e.g., Twilio)
• Address lookup (e.g., Google)
• Push notification delivery (e.g., Apple, Google)
• Error monitoring, security and abuse prevention (e.g., Sentry, Cloudflare)
• AI processing (e.g., OpenAI)
• Bank account data, if you choose to connect a bank account (e.g., Plaid)
• Analytics services

These providers are contractually obligated to use your information only to provide services to us.

Access Within Your Workspace and by Capoflow

Owners and administrators of a workspace may see relevant activity of the team members in that workspace, such as who created, sent, or changed records. Authorized Capoflow personnel may access limited operational information, including connection and security records and retained Capo AI question text, only as needed to provide support, maintain security, prevent abuse, and operate the Service.

Third-Party Integrations

When you connect third-party services like QuickBooks, we share data with those services as necessary to maintain the integration. For QuickBooks and bank connections through Plaid, this is limited to the requests and authorization tokens needed to maintain the connection and retrieve the data you authorized; we do not send your business records to them. Your use of third-party services is governed by their respective privacy policies.

Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of the Company, our users, or others.

Business Transfers

In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

With Your Consent

We may share information for other purposes with your explicit consent.

4. Third-Party Integrations

Intuit QuickBooks

If you connect your QuickBooks account, we access your QuickBooks data to provide synchronization features. This may include:

• Reading customer, invoice, and payment data, as well as estimates and, if you choose, products and services
• Capoflow does not write to or change data in your QuickBooks account.

We access only the data necessary to provide the features you use. You can disconnect QuickBooks at any time through your account settings, which will stop future data access. QuickBooks access tokens are stored encrypted.

Our use of information received from QuickBooks APIs adheres to Intuit's developer policies.

Bank Connections

If you connect a bank account, the connection is handled by a bank-data provider (Plaid). You authenticate directly with your bank or with Plaid; Capoflow does not receive or store your bank login credentials.

• The bank connection is read-only.
• Capoflow does not move money and cannot initiate payments or transfers.
• We use the imported transaction and balance information to help you match and confirm records you already keep in Capoflow (for example, expenses, bills, and payments). The information we import includes account names, account type, the last four digits of the account number, balances, and transactions.
• You can disconnect a connected bank account at any time, which stops future access. Transactions already imported stay in your account.
• The access token Plaid issues for your connection is stored encrypted.

Plaid's handling of your information is governed by Plaid's End User Privacy Policy.

Other Integrations

We may offer integrations with other third-party services. Each integration will clearly describe what data is accessed and how it is used before you connect.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When an account is deleted, it first enters a recovery period of thirty (30) days; after that period, the account and its associated data are permanently deleted. After account termination, we may retain certain information as required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements).

You may request deletion of your data as described in Section 7.

6. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Security reviews and automated security checks of the Service

However, no method of transmission or storage is completely secure. We cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify affected users within a reasonable timeframe and, where required by applicable law, notify the relevant authorities.

7. Your Choices and Rights

Access and Update

You can access and update your account information through your account settings.

Data Deletion

The account owner may delete the account at any time from account settings, and you may also request deletion of your account and associated data by contacting us at contact@capoflow.ai. A deleted account enters a thirty (30) day recovery period during which it can be restored. After the recovery period, the account and its associated data are permanently deleted, except where retention is required by law, necessary to resolve disputes, or needed to enforce our agreements. Certain data may also be retained in encrypted backups for a limited period as part of our standard disaster-recovery process; such backup data is automatically purged on a rolling schedule.

Disconnect Integrations

You can disconnect third-party integrations at any time through your account settings. Disconnecting an integration stops future data synchronization but does not automatically delete previously synced data.

Cookies

Most browsers allow you to control cookies through settings. Disabling cookies may affect Service functionality.

Marketing Communications

We only send promotional or product update emails if you have opted in during account registration. You may opt out at any time by following the unsubscribe instructions in those messages or by contacting us at contact@capoflow.ai. Transactional emails related to your account and Service usage (such as invoices, password resets, and security notifications) are not affected by marketing preferences.

8. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it promptly.

9. International Users

The Service is operated in the United States. If you access the Service from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

10. SMS Text Messaging

Capoflow sends transactional SMS text messages on behalf of businesses using our platform. These messages include invoice notifications, payment receipts, quote notifications, statement notifications, and appointment reminders. SMS messaging is provided through Twilio, Inc., our third-party messaging provider.

Data We Collect. We process phone numbers provided by businesses for the sole purpose of delivering transactional SMS notifications. We also store SMS delivery status, opt-in and opt-out status for each phone number, and consent records including when and how consent was obtained. If you reply to a message, we store your reply, may send an automatic response explaining how to reach the business, and may share your reply with that business. Calls to a business's texting number may be forwarded to that business and are not recorded.

SMS/Mobile Privacy. Your phone number is used solely for delivering transactional notifications. Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We do not use phone numbers to send marketing, promotional, or advertising messages.

Opt-Out. You can opt out of SMS notifications at any time by replying STOP to any message. Once you opt out, no further SMS messages will be sent to your number from the business number you replied to, other than a single confirmation of your opt-out. To re-subscribe, reply START to that business number. Login-verification codes that Capoflow sends to its own users are a separate service. For help, reply HELP or contact us at contact@capoflow.ai.

Message Frequency and Rates. Message frequency varies based on your service interactions. Message and data rates may apply depending on your mobile carrier and plan.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and updating the "Last Updated" date. For material changes, we may require you to review and re-accept the updated policy before continuing to use the Service. If you do not accept the updated policy, you may discontinue use of the Service.

12. Contact Us

For questions about this Privacy Policy, to exercise your data rights, or for any other inquiries, contact us at: contact@capoflow.ai