Privacy Policy

Account information. Name, email address, business name, and login credentials. Passwords are stored in hashed form; we cannot see your password.

Billing information. Payments are processed by Stripe, Inc. When you add a payment method, your card details are sent directly to Stripe, and we never receive or store your full card number. We store only what Stripe returns to us for display and billing management: card brand, last four digits, expiration date, and Stripe-generated identifiers, along with your subscription plan, status, and invoice history.

Usage and log data. When you use the Portal, we and our infrastructure providers collect standard technical data such as IP address, browser type, pages accessed, and timestamps, used for security and operations.

Cookies. The Portal uses cookies that are necessary to keep you logged in and to secure your session. We do not use advertising cookies or third-party advertising trackers on the Portal.

Website analytics shown in the Portal. The traffic statistics displayed for your website (page views, visitors, top pages) are aggregate data collected via Vercel Web Analytics from visitors to your website. This data is anonymized and aggregated; it does not identify individual visitors to you or to us.

Some Portal features store information that visitors and customers of a client’s website submit on that website. For this information the client (the business that owns the website) is the controller: it decides what to collect and what to do with it. We store and process it only to provide these features to the client. If you submitted information on one of our clients’ websites, please contact that business first; we will help them with any request.

Inquiries. When someone sends a contact form, a questionnaire, or a review through a client’s website, we store their name, email address, phone number, message, any other answers the form asks for, the page it was sent from, their browser’s user agent, and a one-way hash of their IP address (the address itself is not stored). We email the message to the people the client chooses and, if the client turns it on, send the sender a confirmation. A review the client approves is published on the client’s website with its text, rating, and a short display name. Messages are screened automatically for bots and unsolicited marketing; a message the screening holds stays visible to the client in their inbox, marked with the reason, and can be restored with one click.

Bookings. When someone books or requests an appointment through a client’s website, we store their name, email address, phone number, the service and time, any note or intake answers, the page it was sent from, their browser’s user agent, and a one-way hash of their IP address. We send them confirmation, reminder, and change emails with a calendar file. Each email carries a private link to a booking page on app.fullgrainsoftware.com where anyone holding the link can see the booking and cancel, reschedule, or answer a proposed time, within the client’s rules.

Orders. When a client runs a store, checkout happens on Stripe using the client’s own Stripe account (Stripe Connect). Card details go to Stripe and never reach us. We store the order: the buyer’s email address, the shipping name and address, the items and amounts, and any fulfillment or tracking details the client adds.

Customer records. When someone writes in, books, or buys on a client’s site, the panel keeps one customer record for that person on the client’s behalf: their name, the email addresses and phone numbers they used, notes and tags the client adds, whether they have agreed to marketing email, and a history of those messages, bookings and orders. Clients can export or delete these records, and we delete them at the client’s request.

Retention. Inquiries and bookings are kept until the client deletes them. Messages marked as spam are deleted automatically after 30 days. The hashed IP addresses we keep to limit repeated booking attempts are deleted after 24 hours. Orders are kept as the client’s order record. Customer records are kept until the client deletes them. When a client leaves Fullgrain Software, the client may ask us to delete this information.

We use the information above to provide and operate the Portal and hosting services; process payments and manage subscriptions; communicate with you about your account, billing, and support requests; secure the Portal and prevent fraud or abuse; and comply with legal obligations. We do not use your information for third-party advertising.

We do not sell your personal information, and we have not sold personal information in the preceding 12 months. We share information only with service providers that help us operate the Portal, under terms limiting their use of it:

• Stripe, Inc.: payment processing (see Stripe’s privacy policy at stripe.com/privacy)
• Vercel Inc.: hosting infrastructure and web analytics
• Twilio SendGrid: delivery of the emails the Portal sends, including inquiry and booking emails
• SignWell, Inc.: electronic signatures on documents a client agrees to sign; receives the document, each signer’s name and email address, and the signing events (opened, signed, declined), and is bound by its own privacy policy at signwell.com/privacy
• TypeSafe AI: automated screening of messages, and of photos attached to them, sent through a client’s website forms, to detect bots, unsolicited marketing and harmful images; receives the message, the attached photos, the sender’s name and email domain, the form’s answers, the page it was sent from, whether a phone number was given, and the business’s name, and states it does not train models on customer data
• Vercel (file storage): photos attached to a message are stored privately and kept with it
• Database, authentication, and caching providers used to run the service

We may also disclose information if required by law, or in connection with a merger, acquisition, or sale of assets (in which case this policy will continue to apply to previously collected information).

We retain account and billing records while your account is active and afterward as needed for legal, tax, and accounting purposes. Invoice records are retained in accordance with tax law requirements. If you close your account, you may request deletion of information we are not legally required to keep. Information we hold for clients about their visitors and customers is covered under “Data We Process on Behalf of Clients” above.

We use industry-standard measures to protect your information, including encrypted connections (HTTPS), hashed passwords, and access controls. No system is perfectly secure, and we cannot guarantee absolute security.

You can view and update your account and payment information in the Portal. You may contact us at alec@fullgrainsoftware.com to request access to, correction of, or deletion of your personal information, and we will respond to reasonable requests within a reasonable time. We will not discriminate against you for exercising any privacy rights.

Some browsers send “Do Not Track” signals. The Portal does not track users across third-party websites over time, and we do not respond differently to Do Not Track signals.

The Portal is a business tool and is not directed to anyone under 18. We do not knowingly collect personal information from minors.

We may update this policy from time to time. We will post the updated version here with a new effective date and, for material changes, notify you by email or through the Portal.

FULLGRAIN SOFTWARE LLC
alec@fullgrainsoftware.com