Privacy Policy

1. What we collect

• Account details: your name, email address and account identifier.
• Business details: name, location and settings you enter.
• Sales and payment activity from the point of sale you connect, including order amounts, taxes, tips, refunds and processing fees.
• Bank activity from the bank you connect through Plaid: transaction amounts, dates, descriptions, merchant or counterparty details, account names, types, balances and masked account identifiers when provided.
• Operational data you enter yourself: expenses, product costs, staff names and email addresses, shifts, hours and inventory counts.
• Technical and security data: authentication sessions, service errors, synchronization and audit records. When you accept our legal documents, we record your account identifier, document versions, time, acceptance method and, when available, IP address and browser information. Our authentication and hosting providers also process authentication events and technical connection logs.

We do not request access to Square's customer directory. However, stored payment, order and webhook data can include customer identifiers, contact or delivery details, notes and masked card information when supplied by Square. Transaction descriptions and information you enter can also contain personal data. We do not receive or store your bank login credentials or full payment card numbers through these integrations.

Google Sign-In

If you choose Google Sign-In, our authentication service receives basic identity information: your Google account identifier, email address and verification status, and profile information such as your name and profile picture when provided. We use this to identify you and establish your dBuilders OS session. The sign-in flow does not request access to Gmail messages, Google Drive files, contacts or calendars, and we do not receive your Google password.

2. How we use it

To authenticate users, manage business access, produce sales, expense and profit reports, match deposits to payouts, keep reports up to date, diagnose errors and preserve security and consent evidence. We do not sell your data or use it for advertising.

3. Keeping it separate and safe

Business access is restricted by membership and role at the database and application levels. Access keys for connected services are stored encrypted, traffic is encrypted in transit, and incoming notifications from providers are verified before they are trusted.

4. Who else is involved

We use Lovable Cloud for hosting and authentication, Google when you choose Google Sign-In, Square for connected point-of-sale data, Plaid for bank connectivity, and Healthchecks.io for operational monitoring. These providers process information under their own terms and privacy policies; monitoring receives service execution status, not transaction reports.

5. How long we keep it

• Business and financial records are kept while the business is active. They are excluded from routine operational cleanup, but included in authorized business deletion.
• Daily automated cleanup removes raw provider records older than 90 days and finished webhook records older than 90 days; finished synchronization jobs and temporary OAuth states are removed after 30 days. Unfinished jobs and webhooks are not removed by these age-based rules.
• Local integration credentials are deleted on a successful disconnect or business deletion. Business deletion requires owner authorization and confirmation; a failed Plaid revocation stops it, while Square revocation is best effort.
• Business deletion removes the associated records from the active database and anonymizes the business entry. User accounts and profiles are not automatically deleted. Audit, consent and data-lifecycle records are preserved; they have no automated expiry currently, and their retention periods remain subject to review for security needs and applicable obligations, not a universal seven-year or indefinite legal requirement.
• Deletion from the active database does not immediately delete historical backups. Our Data Retention & Disposal Policy describes Lovable Cloud backups as retained for approximately 14 days, subject to the provider's rotation and service terms. Authentication and hosting log retention is provider-controlled.

6. Your choices

You can disconnect any connected service at any time and correct the information you entered. Business owners can download a copy of their data or delete their business from the "Your data" page in the app. Disconnecting a service does not erase previously imported reports. For account deletion or other access, correction or deletion requests, write to us; our internal response target is 30 calendar days, subject to applicable requirements and exceptions.

7. Contact

Privacy questions or requests: Alonso Marketing Group LLC — alonso@alonsoamg.com.