MarginCraft Solutions LLC ("MarginCraft," "we," "us," or "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the MarginCraft Client Hub web application, the MarginCraft Mobile app, and all related services (collectively, the "Service"). By using the Service, you consent to the practices described here.

1. Information We Collect

1.1 Information You Provide

Account information: Name, email address, and password when you register
Business data: Customer names, addresses, phone numbers, email addresses, job details, estimates, payment records, follow-up notes, and other operational data you enter into the Service
Billing information: Payment method details collected and processed by Stripe on our behalf. We do not store full card numbers
Settings and preferences: Business name, logo, service area location (city, zip, or address and its coordinates), review links, and notification preferences
Communications: Messages you send to our support team

1.2 Information Collected Automatically

Log data: IP address, browser type, pages visited, time and date of access, and referring URLs
Usage data: Features used, actions taken within the Service, and session duration
Device data: Device type, operating system, and browser version
Cookies and session tokens: Used to authenticate your session and maintain your logged-in state. On mobile, a secure bearer token is stored in your device's encrypted secure storage instead of a cookie
Push notification tokens: If you enable push notifications on MarginCraft Mobile, your device's push token is stored in our database to deliver notifications such as daily digests. You can disable push notifications at any time through your device settings

1.3 Device Permissions (MarginCraft Mobile)

Location: Only when you tap to plan a route from where you are. Your current coordinates are sent once to plan the route and are not stored. We never track location in the background
Camera and photos: Only when you take or choose a photo, such as job photos, before-and-after photos, or a picture of a lead or customer to scan. Those photos are stored with your business data
Microphone and contacts: Not used

Each permission is optional and can be turned off at any time in your device settings.

1.4 Information from Third Parties

If you connect third-party integrations (such as QuickBooks Online), we receive data from those services only as needed to provide the integration features. See Section 3.4 for details on QuickBooks specifically.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Service
Process transactions and manage your subscription
Authenticate your identity and maintain session security
Send transactional emails such as estimate notifications, follow-up messages, and billing receipts
Send push notifications to MarginCraft Mobile if you have enabled them
Power AI-assisted features (see Section 3.5)
Retrieve weather forecasts for your service area (see Section 3.6)
Respond to your support requests and communications
Monitor and analyze usage to improve the Service
Detect, prevent, and address technical issues, fraud, or abuse
Comply with legal obligations

We do not sell your data to third parties. We do not use your business data to train AI models.

3. How We Share Your Information

We may share your information only in the following circumstances:

3.1 Service Providers

We share information with trusted third-party vendors who assist us in operating the Service, subject to confidentiality obligations:

Stripe — subscription billing and, if you connect a Stripe account, payment processing for your customers via Stripe Connect (see Section 3.3)
Resend — transactional email delivery
Replit — hosting and infrastructure
Anthropic — AI processing for the Marge assistant and Job Margin analysis (see Section 3.5)
Apple — weather forecast retrieval via WeatherKit (see Section 3.6)
Mapbox — driving times and route order for route planning. Stop coordinates and, if you choose, your current location are sent; no names or customer details
U.S. Census Bureau Geocoder — turning job and customer street addresses into map coordinates for routes. Only the address is sent
OpenStreetMap Nominatim — turning job addresses into map coordinates for scheduling and weather. Only the address is sent
Our financing partner — if one of your customers chooses to apply for optional consumer financing on an estimate, their name, contact information, and the estimate amount are shared with the partner to start the application. Sensitive details (such as Social Security number or income) are entered directly with the partner, not through MarginCraft; we store only the application status and a reference ID
Intuit (QuickBooks) — accounting integration, if enabled by you (see Section 3.4)

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

3.3 Stripe Connect and Payment Processing

If you choose to connect your own Stripe account through MarginCraft Payments, your customers can pay invoices and estimates directly by card. MarginCraft acts as a platform on top of Stripe Connect; you are the merchant of record for those transactions.

What we share with Stripe: Customer name, email address, and invoice or estimate amount when initiating a payment session
Card data: All card details are entered directly into Stripe's hosted checkout. MarginCraft never sees or stores card numbers, CVVs, or expiration dates
Affirm installments: If you enable Affirm on an invoice or estimate, Affirm appears as a payment method option in Stripe's checkout flow for amounts between $50 and $30,000. Affirm's underwriting and payment processing are handled entirely by Affirm and Stripe — MarginCraft only stores whether the option was enabled on a document and the resulting payment status
Stripe's policies: Payment processing via Stripe Connect is also governed by Stripe's Privacy Policy and Stripe's Connected Account Agreement

3.4 QuickBooks Integration

If you choose to connect your QuickBooks Online account, MarginCraft accesses the following data from Intuit's API on your behalf:

Company information — your QuickBooks company name, read once at connection time
Customer records — names, email addresses, and contact information searched by email or name to find existing QuickBooks customers before creating new ones, avoiding duplicates
Invoice identifiers and sync tokens — QuickBooks-assigned IDs required by Intuit's API to update existing invoices without conflicting edits
Pay Now links — payment URLs returned by Intuit when an invoice is created, used to give your customers a direct payment link
Payroll reports — read-only payroll data used to populate the payroll panel within MarginCraft

Token storage: QuickBooks OAuth 2.0 access and refresh tokens are stored encrypted with AES-256-GCM. They are never stored in plain text, written to logs, or exposed to the browser.

Disconnection: When you disconnect QuickBooks, MarginCraft immediately revokes the OAuth tokens with Intuit and deletes all stored tokens. QuickBooks-sourced data previously synced into MarginCraft is not automatically deleted; contact us to request deletion.

Intuit's policies: Your use of this integration is also governed by Intuit's own Privacy Statement.

3.5 AI Features (Anthropic Claude)

MarginCraft includes an AI assistant named Marge, AI-powered Job Margin analysis, and AI tools that read photos, screenshots, and spreadsheets you choose to import to pull out lead and customer details. All of these are powered by Anthropic's Claude API. No other AI provider receives your data.

What is sent to Anthropic: When you use Marge or generate a Job Margin, relevant portions of your business data — such as job details, financial figures, customer context, follow-up notes, and weather conditions — are sent to Anthropic's API to generate a response
Your consent: MarginCraft Mobile asks for your permission before Marge is used for the first time, and Marge only works after you agree
What is not sent: We do not send payment card data, passwords, or raw QuickBooks OAuth tokens to Anthropic
Model training: We do not use your data to train AI models. Anthropic's API terms prohibit using API inputs and outputs to train their models without explicit consent
Anthropic's policies: Data processed through Anthropic's API is subject to Anthropic's Privacy Policy

3.6 Weather Data (Apple WeatherKit)

If you set a service area location in settings, MarginCraft sends those coordinates (latitude and longitude) to Apple's WeatherKit REST API to retrieve daily weather forecasts. This data is used to power weather risk alerts on the Schedule page and weather context in the Marge assistant.

Only the coordinates you provide are sent — no personal information, customer data, or account identifiers are included in WeatherKit requests. Apple's use of this data is governed by Apple's Privacy Policy.

3.7 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

4. Data Retention

We retain your account and business data for as long as your account is active or as needed to provide the Service. You can delete your account at any time yourself, in the web app (account menu → Delete account) or in MarginCraft Mobile (Settings → Delete account). Your access ends immediately, and your account and business data are permanently removed within 30 days (this short window allows recovery if the deletion was a mistake). You may also request deletion by contacting us at contact@margincraftsolutions.com.

Log and usage data may be retained in aggregated or anonymized form for analytical purposes after account deletion.

5. Data Security

We implement industry-standard security measures to protect your data, including:

Encrypted data transmission via HTTPS/TLS
Encrypted storage of passwords using bcrypt hashing
Session tokens stored in secure, HTTP-only cookies (web) or device-encrypted secure storage (mobile)
Third-party OAuth tokens (e.g., QuickBooks) encrypted at rest with AES-256-GCM
Database access restricted to authorized application processes
Regular security reviews of our infrastructure

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your personal data, subject to legal retention requirements
Portability: Request an export of your business data in a common format
Push notifications: Disable push notifications at any time through your device settings; this will stop delivery without affecting your account
Opt-out: Unsubscribe from non-transactional communications at any time

To exercise any of these rights, contact us at contact@margincraftsolutions.com. We will respond within 30 days.

7. Cookies and Local Storage

The web application uses cookies and session tokens solely for authentication and session management. The mobile app uses device-encrypted secure storage for the same purpose. We do not use third-party advertising cookies or tracking pixels. You may configure your browser to refuse cookies, but doing so may prevent you from logging in to the web application.

This marketing website (margincraftsolutions.com) uses Google Analytics only if you accept analytics cookies in the cookie banner; if you decline, analytics cookies are not set. Information you submit through our contact or demo request forms (such as your name, business, email, and phone) is used only to respond to you.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will delete it.

9. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you access through the Service.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy in the Service or by email at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

MarginCraft Solutions LLC
contact@margincraftsolutions.com
6808 University Ave, STE 108 #1605, Middleton, WI 53562