Privacy Policy

What we collect

Account & organization data: your name, email address, and password (stored as a salted hash, never in plain text) or, if you sign in with Google or your organization's SSO provider, an identifier from that provider. If you enable two-factor authentication or a passkey, we store the corresponding secret or credential needed to verify it.

Data you put into the Service: client and contact records, projects, tasks, time entries, milestones and their evidence (notes, links, and any file you attach), invoices, and any documents you upload to a client record (for example a W-9 or 1099 — which can contain a taxpayer ID, so treat that upload accordingly). This is your data; we process it on your behalf to run the Service.

Billing data: if you subscribe to a paid plan, our payment processor, Stripe, collects your payment details directly — we never see or store your full card number. We keep the resulting customer and subscription identifiers and status.

Integration data: if you connect QuickBooks, GitHub, or Linear, we store the OAuth tokens needed to act on your behalf (encrypted at rest) and the data you ask us to sync — for example, pushing an invoice to QuickBooks or pulling issues in from Linear as tasks.

Usage data: we use a privacy-focused analytics service (Rybbit) to understand aggregate page traffic — which pages get visited and roughly how — without building an advertising profile of you.

Cookies

We use one strictly-necessary cookie to keep you signed in, which is required for the Service to work and isn't used for tracking or advertising. Our analytics provider may use a cookie or similar local storage to avoid double-counting a visit; it isn't used to identify you personally or track you across other sites.

How we use it

To provide the Service you've asked for: authenticate you, run the features you use, send transactional email you've triggered (invites, magic links, invoice notifications, email-change confirmations), process billing, keep the Service secure and working, and — only with an administrator's configuration — sync a new signup as a company/contact record into our own CRM (Attio) for our own sales follow-up. We don't sell your data, and we don't use your Customer Data to train AI models.

Who we share it with

Only the service providers that make Consultainer work: our hosting infrastructure (AWS), Stripe for payment processing, Resend for transactional email delivery, Rybbit for aggregate analytics, and — solely when you choose to connect them — QuickBooks, GitHub, and Linear. We don't share Customer Data with anyone else, and we disclose data to law enforcement only when legally required to.

Data retention

We keep Customer Data for as long as your organization's account is active. If you delete a record (a client, a project, a document) inside the app, it's removed from our primary database; if you delete your whole organization, we delete or anonymize the associated data within a reasonable period, except where we're legally required to retain billing records for longer.

Your choices

You can access, correct, export, or delete most of your data directly in the app. For anything you can't do yourself — including a full account deletion request — email support@consultainer.app and we'll handle it.

Security

We encrypt data in transit with HTTPS, hash passwords, encrypt stored integration credentials, and support passkeys, two-factor authentication, and SSO for your account. No method of storage or transmission is perfectly secure, but we take reasonable, industry-standard measures to protect your data.

Changes to this policy

If we make a material change to this policy, we'll notify account owners by email or an in-app notice before it takes effect.

Contact

Questions about this policy or your data? Email support@consultainer.app.