Privacy

What we store about people, for how long, and how to have it erased. This page says the same thing as the engineering document the code is written against (PRIVACY.md), in fewer words.

Who appears in the data

Your clients: name, email, phone, address and any notes — entered by you, not by them.

Anyone who signs: a client approving an estimate, change order, selection or invoice leaves their typed name, their email, the signature they drew, the address of the device they signed from, the exact wording they agreed to, and a fingerprint of all of it. That record is the evidence the price was agreed.

Your staff: name, email and phone. A project manager's contact details are shown to that project's client on purpose — a homeowner needs to know who to call.

Nobody else. There is no analytics, no tracking pixel and no third-party script anywhere in the product.

How long it is kept

• Client contact details: until erased on request.
• Jobs, estimates, invoices and payments: indefinitely — they are your financial record.
• Signatures, what was signed and its fingerprint: indefinitely. They are what an approval rests on.
• The device address and browser recorded with a signature: 24 months. They only corroborate a signature, and do so less usefully as time passes.
• Client link tokens: never stored — only a one-way hash of them, so a copy of the database cannot open anybody's project.

Erasing a client

An admin can erase a client from the Clients screen. Their name, email, phone, address and notes are blanked, and the jobs that referenced them say [redacted] rather than appearing to belong to somebody. The financial records themselves stay: an invoice that was issued and paid is a fact about money, not a fact about a person.

Card payments

Card numbers and security codes are never stored, and never reach our database. A payment keeps the card's brand and last four digits, and the processor's own reference for the charge.

Asking us about your data

Write to the address on your invoice from us. If you are a client of a contractor who uses SmetaLedger, ask the contractor — the data is theirs, and they can erase it themselves.