Privacy Policy

1. Information We Collect

Account Information

• Name (first and last) and email address provided at registration.
• Authentication credentials (password hash, or OAuth provider identifier if you sign in with Google).
• Organization name and membership role (owner or member).

Billing Information

• Subscription plan and status, trial dates, and cancellation dates.
• Stripe customer and subscription identifiers. We do not store credit card numbers — all payment data is processed and stored by Stripe.

Vendor and Compliance Data

• Vendor names and email addresses you add to the Service.
• License information: license numbers, holder names, license types, states, expiration dates, and statuses — whether sourced from government databases or entered manually.
• Uploaded documents: certificates of insurance (COI), W-9 forms, safety certificates, contracts, and other compliance documents (PDF, PNG, JPEG, GIF, up to 10 MB each).
• AI-extracted insurance data: insured name, policy number, carrier, effective and expiration dates, coverage types, coverage limits, certificate holder, and description of operations — extracted automatically from uploaded COI documents.
• Project names, vendor-project assignments, and per-project insurance minimum requirements.

Activity and Usage Data

• Audit trail: timestamped logs of actions performed within your Organization (e.g., adding vendors, uploading documents, changing settings).
• Notification records: which compliance alerts were sent, to whom, and when.
• General usage data such as pages visited, features used, and session information.

Compliance Assessment Data

• When you use the free Compliance Assessment, we collect the business type you select, your answers to the assessment questions, and the email address you give us so we can send you the report.
• These responses are transmitted to Google's Gemini AI service to evaluate your compliance process and generate a personalized report. The report and your responses are stored in our database.
• If you provide your email address, it is stored and used to deliver your report. No account is created.
• Assessment data is not linked to any Organization account and is retained for up to 90 days, after which it is deleted.

Vendor Self-Service Data

• When vendors use tokenized upload links, we collect the documents and license selections they submit. Vendors do not need to create an account, but their email address is stored as part of the upload request.

QuickBooks Online Data (only if you connect QuickBooks)

Connecting QuickBooks Online is optional. If an owner of your Organization connects it, you sign in on Intuit's own page and authorize TrackMyVendor; you never give us your QuickBooks password. We then receive and store:

• Authorization tokens — the access and refresh tokens Intuit issues for your company, stored encrypted.
• Company identifiers — your QuickBooks company ID and company name. We request your company information once, when you connect, and keep only the name.
• Your vendor list — we retrieve your QuickBooks vendors so you can match them to your contractors, and keep only each vendor's QuickBooks ID, display name and active status. Any other vendor details in Intuit's response are discarded and not stored.
• Your matches — which contractor you matched to which QuickBooks vendor, and a record of the status files we attached.

We do not read your transactions, invoices, bills, payments, accounts, bank data, reports, customers or employees. Intuit's authorization covers your company's accounting data generally; the Service only ever reads your company information, your vendor list, and the attachments it created itself.

What we write to QuickBooks: a PDF attached to each vendor you matched, showing that contractor's compliance status, and the removal of the previous PDF we attached when the status changes. We never change a vendor's details, transactions, accounts or any other record, and never write to a vendor you did not match.

Government-Sourced Data

• We download and store publicly available professional license records from government agencies (including Texas TDLR, Florida DBPR, California CSLB, Washington L&I, Oregon CCB, Illinois IDFPR, and Colorado DORA). This data includes license holder names, license numbers, types, states, expiration dates, and statuses. This data is public record and is not collected from you.

2. How We Use Information

• Provide the Service — display license data, calculate compliance scores, store and manage your documents, and facilitate vendor self-service uploads.
• Automated alerts — send email notifications about expiring licenses, insurance, and documents based on your configured alert windows.
• AI document processing — transmit uploaded documents to Google's Gemini AI service to extract their details and fill in fields automatically: policy data from insurance certificates; the business name, tax classification, TIN type and the last four digits of the TIN from W-9s; and the type of document, for any other upload, so it can be filed correctly. The full TIN is not extracted or stored in our database; the W-9 file itself is stored as uploaded.
• Contractor import — when you import contractors from a spreadsheet, transmit its column headers and first five rows to Google's Gemini AI service to work out which column holds which field.
• Compliance Assessment — transmit your assessment responses to Google's Gemini AI service to evaluate your compliance process and generate a personalized report with a compliance health score and recommendations.
• QuickBooks Online integration — if you connect it, to let you match contractors to QuickBooks vendors and to attach each matched contractor's compliance status to their vendor record. QuickBooks data is used for nothing else: not for advertising, not for analytics about you, not to train any AI model, and it is never sent to an AI service.
• Billing — process subscriptions, manage trials, and handle payment events via Stripe.
• Communications — send transactional emails including team invitations, vendor upload requests, compliance alerts, and account-related messages.
• Improve the Service — analyze usage patterns to fix bugs, improve features, and maintain security.
• Support and feedback — transmit feedback you send through the Service, with your name, email address and the page you sent it from, to Google's Gemini AI service to categorize it and draft a reply for our team to review.
• Prevent abuse — detect and prevent unauthorized access, fraud, and violations of our Terms of Service.

3. Third-Party Services and Data Sharing

We share data with the following categories of third-party providers, solely as necessary to operate the Service:

Each provider's use of your data is governed by their own privacy policies. We do not sell, rent, or trade your personal information to third parties for marketing purposes.

QuickBooks data is never sold and never shared with any third party. It is shown only to users of the Organization that connected QuickBooks and, where that Organization has authorized an agency to act for it in the Service, to that agency's users. TrackMyVendor staff access it only to provide support you ask for, to keep the Service secure, or where the law requires it.

We may also disclose information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4. Data Retention

• Active accounts — We retain your data for as long as your account is active and your subscription is in effect.
• After cancellation — Upon account cancellation, we retain your data for up to 90 days to allow for reactivation, after which it will be scheduled for deletion.
• Backups — Deleted data may persist in encrypted backups for up to an additional 30 days before being purged.
• Legal obligations — We may retain certain data longer if required by law or necessary to resolve disputes or enforce our agreements.
• QuickBooks Online data — Kept while QuickBooks is connected. When an owner clicks Disconnect in the Service, we ask Intuit to revoke our access and immediately delete the tokens, the stored vendor list and your matches. If access is instead withdrawn from within QuickBooks, or expires, the tokens are deleted the next time the Service tries to use them; your matches and vendor list are then kept so you can reconnect, until you disconnect in the Service or delete your account. When your Organization's data is deleted, all QuickBooks data we hold is deleted with it. The PDFs already attached in QuickBooks belong to your QuickBooks company and remain there after you disconnect; you can delete them in QuickBooks at any time.
• Government-sourced license data — Publicly sourced license records are retained indefinitely as part of the Service's database and are not tied to any individual user account.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Deletion — Request deletion of your personal data, subject to our retention obligations.
• Export — Request an export of your data in a portable format.
• Objection — Object to certain processing of your personal data.

You can also disconnect QuickBooks Online at any time, from Settings → Integrations in the Service or from the list of connected apps in QuickBooks.

To exercise any of these rights, email support@trackmyvendor.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

Note that deleting your account will remove your Organization's vendor data, documents, and compliance history. This action cannot be undone after the retention period expires.

6. Data Security

We implement reasonable technical and organizational measures to protect your data, including encrypted connections (TLS), secure credential storage, and access controls. However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

For QuickBooks Online specifically: every exchange with Intuit uses TLS; the tokens Intuit issues for your company are encrypted at rest with AES-256-GCM; our Intuit application credentials are kept in encrypted server configuration, never in source code or in anything sent to a browser; and only owners of your Organization — or of an agency you have authorized, acting for you — can connect, disconnect or change what is published.

7. Cookies and Tracking

The Service uses essential cookies required for authentication and session management. These are strictly necessary for the Service to function and cannot be disabled. We do not use third-party advertising or tracking cookies.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Contact

For privacy inquiries, email support@trackmyvendor.com.