Privacy policy

This policy explains what data SOWLedger collects, how we use it, how we handle third-party integrations like Google Calendar and QuickBooks, and what rights you have over your data.

Summary

SOWLedger stores operational workspace data, encrypted integration tokens, and hashed API keys. Payments are handled by Stripe. Integration data (Google Calendar, QuickBooks) is used only to deliver the features you connect and is never sold or shared. You can export or delete your data at any time.

Workspace dataEncrypted tokensHashed keysStripe paymentsNo data selling

What we collect

Account email, display name, workspace metadata, clients, projects, time records, schedule records, billing identifiers, API key metadata, integration connection metadata, and support messages you submit. When you connect third-party services (such as Google Calendar or QuickBooks), we store encrypted OAuth tokens scoped to the permissions you grant.

How we use it

We use workspace data to provide scheduling, timers, completed work logging, analytics, exports, invoices, API access, support, security monitoring, and billing operations. Google Calendar data is used exclusively to sync scheduled work blocks and import busy events to prevent double-booking. QuickBooks data is used exclusively to push approved invoices. We do not use third-party integration data for advertising, profiling, or any purpose beyond delivering the features you connect.

Third-party integrations

SOWLedger connects to Google Calendar, Slack, and QuickBooks when you explicitly authorize the connection. We request only the minimum OAuth scopes needed: calendar event read/write for Google Calendar, incoming webhook delivery for Slack, and invoice create/read for QuickBooks. You can disconnect any integration at any time from your workspace settings, which revokes SOWLedger's access and deletes stored tokens.

What we do not store

API key secrets are shown once and stored only as salted hashes. Payment card details are handled entirely by Stripe and never touch SOWLedger servers. Raw Google or QuickBooks API responses are not persisted beyond the sync operation that processes them.

Data sharing

We do not sell, rent, or share your workspace data or integration tokens with third parties. Data is shared only with infrastructure providers (database hosting, deployment platform) strictly to operate the service, and with Stripe to process payments. No workspace data is used for training machine learning models.

Data security

Integration credentials are encrypted at rest using AES-256. All data in transit uses TLS 1.2 or higher. API keys are hashed with a secure one-way algorithm. Workspace data is isolated by workspace ID in every query. Access to administrative functions requires manager or owner roles.

Data exports and portability

Workspace owners and managers can export operational data in CSV or JSON at any time. Exports exclude secrets and include SHA-256 integrity headers. You own your workspace data and can request a full export or deletion at any time.

Your rights

You may access, correct, export, or request deletion of your personal data by contacting support. If you are in the EU, UK, or California, you have additional rights under GDPR, UK GDPR, and CCPA respectively, including the right to object to processing and the right to data portability. We will respond to verified requests within 30 days.

Retention

Operational records stay available until deleted through product workflows or by a verified workspace request. After account deletion, data is purged within 30 days, subject to legal, billing, and security obligations.

Changes to this policy

We may update this privacy notice from time to time. Material changes will be communicated via email to workspace owners before they take effect. Continued use of the service after notice constitutes acceptance.

Contact

Privacy questions can be sent through the contact page or emailed to privacy@sowledger.com. Include the workspace name and the email tied to your account.

Privacy questions

Include workspace context and account email. Do not include API keys or card data.

Contact support