Draft for review. Not yet in force. Bracketed items are still being filled in.

Privacy Policy

Effective date: [Effective date]
Last updated: [Effective date]

This Privacy Policy explains how [Provider legal name] (“we,” “us,” or “our”) collects, uses, shares, keeps and protects information when you use AccountStride (the “Service”). The Service includes the AccountStride app for iPhone and iPad, the AccountStride web app, and the server systems that support them.

The Service is a customer relationship management (CRM) tool for business sales professionals. It is available by invitation only, and it is meant for business use by adults.

Privacy at a glance

Your workspace is private. Each user has a separate workspace. The database enforces this separation on every record, so other users cannot see your data.
Your company’s customer information stays theirs. We process it only to provide the Service to you.
No advertising and no tracking. We do not sell or rent personal information. We do not share it for targeted advertising, and we do not use advertising identifiers or third-party analytics trackers.
AI features are clearly limited. When you use an AI feature, the information needed for that request is sent to our AI provider, Anthropic. Under Anthropic’s commercial terms, that information is not used to train AI models. Several features run entirely on your device.
You stay in control. You can export your data at any time, edit your profile, delete anything JARVIS remembers, and ask us to delete your account and workspace.

1. Scope and our role

1.1 What this Policy covers

This Policy covers information about:

users: the invited people who sign in to the Service;
business contacts: the people whose business contact details users store in the Service, such as customers and prospects.

It does not cover websites or services run by others, even if the Service links to them (see Section 7).

1.2 Two kinds of information, two roles

Account and operational information is what we need to run your account and the Service: your sign-in email, profile, sessions, devices, usage counts and security records. We decide how this information is used, and this Policy describes those uses.
Customer Data is the business information you put into your workspace: accounts, contacts, notes, call and visit logs, tasks, quotes, routes, files, and the content of your AI requests and their responses. Customer Data usually belongs to the company you work for or represent (“Your Company”), or to you. We process Customer Data on behalf of you and Your Company, only to provide, secure and support the Service, as a service provider or processor.

2. Information we collect

2.1 Information you give us

Category	Examples	Why
Account details	Your email address, and the display name, work phone, territory and time zone you choose to add	To create your account, sign you in, and show your name and schedule correctly
Customer Data	Company accounts and addresses; business contacts’ names, titles, work emails and phone numbers; notes; call, visit and check-in logs; tasks and reminders; quotes and pricing; routes; files and photos you attach	To provide the CRM features you use
Business card scans	The text on a business card you scan, and the contact you choose to save from it	To fill in a new contact for you
JARVIS memory	Short facts you explicitly ask JARVIS to remember	To give more useful assistant answers. See Section 4.4
Imports	Spreadsheets you choose to import, such as an export from your company’s CRM	To add accounts and contacts to your workspace
Support messages	The message you send through the in-app support form, with your email and basic app details	To answer you and fix problems
Agreement acceptance	The version of the terms and this Policy you accepted, and when	To keep a record of what you agreed to

2.2 Information collected automatically

Category	What it includes	Why
Sign-in and session records	When you sign in and out, active sessions, and the sign-in method you used	Security, and to keep you signed in
Device registration	For each device you use: platform (iPhone, iPad, installed web app or browser), when it was last seen, and, if you allow notifications, its push notification token	To send reminders to the right devices, and to let you or the workspace administrator sign out a lost device
App diagnostics	The app version, platform and the time of your last successful sync. We keep only the latest report and replace it each time.	To find and fix problems, and to require updates when an old version is unsafe
Error reports	A short error code and the screen where it happened. Error reports never include your Customer Data or the error’s text.	To find and fix problems
AI usage totals	The number of AI requests, tokens used and their cost, per user. These totals never include what you asked or what came back.	To manage costs and prevent abuse
Administrative audit log	Invitations, membership changes, device revocations and agreement publications	Security and accountability
Server request logs	Our hosting provider records standard request information, such as IP address, time, request path and response code. These logs do not include Customer Data.	To operate and secure the Service

2.3 Information from other sources

Sign in with Google. If you choose it, Google shares your Google account email address and basic profile information (such as your name) with us. We use the email address to match your invitation and sign you in. We do not request access to your Gmail, Google Drive, contacts or calendar.
Your invitation. The person who invites you gives us your email address so that we can send the invitation.

2.4 Device permissions

The iPhone and iPad app asks for permission before it uses these features. Each one is optional: if you say no, the rest of the Service keeps working, and you can change your choice at any time in the iOS Settings app.

Permission	When it is used	What happens to the information
Location (while using the app)	Showing nearby accounts, planning routes, estimating drive times, and checking in at a visit	Your location is used on your device and sent to Google Maps Platform to calculate maps, places and routes. We do not store your location history on our servers.
Camera	Scanning business cards and taking photos to attach to accounts	Business cards are read on your device. Only the recognized text is ever sent onward (see Section 4.2). A photo is uploaded only if you attach it to an account or quote.
Photos	Choosing an existing photo to attach	Only the photo you pick is uploaded.
Contacts (add only)	Saving a business contact to the iPhone Contacts app when you tap to do so	The app opens Apple’s standard contact card. It does not read your address book.
Notifications	Task and follow-up reminders	A reminder shows the account name and the task title. It is delivered through Apple’s push notification service.
Siri, Shortcuts and Spotlight	Voice and Shortcuts requests to JARVIS, and finding your accounts from iPhone search	Apple processes what you say to Siri under Apple’s own privacy terms. The app receives the resulting request, such as “add a note to this account.” Account names for Spotlight search are stored only on your device and removed when you sign out.
Live Activities	Showing your current field visit on the Lock Screen	The account name and visit timer stay on your device.

2.5 Information we do not collect

We do not collect advertising identifiers, and we do not track you across other companies’ apps or websites.
We do not use third-party analytics, advertising or data-broker tools in the Service.
We do not collect biometric data. If iOS asks for Face ID or Touch ID, Apple handles it, and we never receive it.
We do not read your device’s address book, photo library (beyond the photos you pick), or other apps’ data.
We do not record audio.

Please do not enter the following into the Service: government ID numbers, financial account or payment card numbers, health information, information about children, or passwords for other systems. The Service is designed for ordinary business contact and sales information.

3. How we use information

We use information only to:

provide the Service: store and display your workspace, sync it across your devices, send reminders, plan routes, and run the features you choose;
secure the Service: authenticate users, keep workspaces separate, detect and prevent abuse, investigate incidents, and sign out lost devices;
support you: answer support requests and, when you ask us to, help with a problem in your workspace;
maintain and improve the Service: fix errors, measure reliability and plan capacity, using diagnostics and usage totals rather than your Customer Data;
manage costs: meter AI use per user;
keep records: keep evidence of agreement acceptance and administrative actions;
comply with law: meet legal obligations and respond to lawful requests;
communicate with you: send sign-in codes, invitations and important notices about the Service. We do not send marketing email.

We do not sell personal information. We do not use Customer Data for advertising, and we do not use it to train AI models. We do not use information for a new purpose that is incompatible with the purposes above without first telling you and, where required, asking for your consent.

4. AI features

4.1 What the AI features are

Some features use artificial intelligence:

account summaries and pipeline briefs;
the JARVIS assistant in the app;
pre-call briefs, sales talking points and objection handling;
company news;
reading a quote from a photo, PDF or pasted text;
reading a business card.

4.2 Your permission, what is sent, and to whom

Nothing is sent to the AI provider until you allow AI features. The app asks the first time you use one, and you can turn them on or off at any time under More → Account → AI features. Our servers check this choice before every request to the AI provider.

When you use an AI feature, we send the request and the information needed to answer it to our AI provider, Anthropic, PBC, and return the answer to you. Depending on the feature, that information may include:

details from the relevant account and its contacts;
recent notes and activity;
open quotes;
the photo, PDF or text you supplied.

We send only what the feature needs.

Public web search: company news and pre-call briefs may ask the AI provider to search the public web for information about the company, such as its name and location.
Business cards on iPhone and iPad: the card is read on your device by Apple’s text recognition. On devices that support Apple Intelligence, an on-device Apple model organizes the fields, and the information does not leave your device for that step. Only if the device cannot finish the job do we send the recognized text (never the photo) to Anthropic.
Business cards on the web app: the card photo is sent to Anthropic to read it.
Requests that use no AI provider: simple Siri and Spotlight requests (adding a task or a note, logging a check-in, or changing a stage) are carried out by our servers without an AI provider.

4.3 How the AI provider handles it

We use Anthropic’s commercial API. Under Anthropic’s commercial terms and published data practices:

No training: Anthropic does not use inputs or outputs from its commercial API to train its models.
Deletion: Anthropic automatically deletes API inputs and outputs within 30 days. The exceptions are where a longer period is needed to enforce its usage policy or to comply with law.

See Anthropic’s Privacy Center for details.

4.4 JARVIS memory

JARVIS remembers something only when you explicitly ask it to (“remember that…”). You can see and delete every saved memory in More → Account → What JARVIS remembers. Memory belongs to your workspace. The workspace administrator cannot see it.

4.5 Check the output

AI output can be wrong or out of date. Review it before relying on it, especially for prices, quantities and commitments to customers. If you do not want information sent to the AI provider, leave AI features off. The rest of the Service works without them.

5. Who can see your information

You can see everything in your workspace.
Other users cannot see your workspace.
The workspace administrator. The person who runs the pilot or your company’s subscription manages invitations and devices. Their tools show only:
- your sign-in email, display name, territory and time zone;
- whether your membership is active;
- your sessions and devices, and when each device was last seen;
- whether and when you accepted the current terms;
- your app version, platform and last sync time;
- your AI usage totals (counts and cost);
- counts of your activity, such as the number of calls logged or tasks completed, if that feature is turned on.
These tools never show your accounts, contacts, notes, quotes, routes, files, JARVIS memory, or the content of your AI requests.
Our operators. People acting for us run the systems the Service depends on and have technical access to them, as any operator does. We access Customer Data only:
- when you ask for help and allow it;
- to investigate a security incident, abuse, or a violation of our terms;
- to keep the Service working, for example when restoring from a backup;
- when the law requires it.

We share information only as described below.

6.1 Service providers

We use carefully selected service providers to run the Service. Each receives only what it needs to perform its function. Each is bound by contractual terms or published commitments that require it to protect the information and to use it only to provide its services. These protections are consistent with this Policy.

Provider	What it does for the Service	Information it receives	Privacy information
Supabase	Database, sign-in and private file storage, hosted in the United States	All categories described in Section 2	supabase.com/privacy
Vercel	Hosting for the web app and server functions, in the United States	Requests as they pass through, including Customer Data in transit; standard server request logs	vercel.com/legal/privacy-policy
Anthropic	AI features (Section 4)	The request and the information needed to answer it	privacy.claude.com
Google: Maps Platform	Maps, address and place lookup, and drive times	Addresses and place searches, map views, and your device location when you use location features	policies.google.com/privacy
Google: Sign-In	Optional sign-in with a Google account	Your sign-in with Google	policies.google.com/privacy
Resend	Sending sign-in codes, invitations and support messages by email	Recipient email address and the message content	resend.com/legal/privacy-policy
Apple	Push notifications, and app distribution through TestFlight and the App Store	Device push token and reminder text; app installation information	apple.com/legal/privacy
Public web-page fetchers (r.jina.ai, corsproxy.io, api.codetabs.com)	Looking up a public supplier price page in the sales calculator	Only the address of a public product web page. They never receive Customer Data.	Their own published policies

We will update this list before we begin using a new provider that receives Customer Data.

We may also disclose information:

when the law requires it: to comply with a law, regulation, court order or lawful government request. Where the law allows, we will tell you first, and we will challenge requests we believe are overbroad;
to protect people and the Service: when we believe in good faith that disclosure is needed to prevent fraud, to address a security problem, or to protect the safety or rights of any person;
in a business transfer: as part of a merger, acquisition, financing or sale of the Service. The receiving party must honor this Policy for the information it receives, and we will notify you before your information becomes subject to a different privacy policy;
with your direction or consent: for example, when you export your data or open a link in another app.

We do not sell personal information. We do not “share” it, as California law uses that word, for cross-context behavioral advertising.

7. Third-party services you use through the Service

7.1 Google Maps

The Service includes Google Maps features and content. Your use of them is subject to the then-current Google Maps/Google Earth Additional Terms of Service and the Google Privacy Policy. Google receives map searches, the addresses being looked up and, when you use location features, your device location. Google uses that information under its own privacy policy.

7.2 Supplier portals and other links

Some features open other services, such as:

a supplier’s ordering portal inside the app;
your email app, with a message already started;
phone, maps or calendar apps.

Those services are run by others under their own terms and privacy policies. When you sign in to a supplier portal inside the app, that sign-in is stored only on your device, separately from the Service, and is removed when you sign out of the Service. We never receive your password for that portal.

8. How long we keep information

We keep information only as long as we need it for the purposes in this Policy, unless the law requires us to keep it longer.

Information	How long we keep it
Customer Data and files	While your account is active. We delete it when you or Your Company asks, or after your access ends, as described in Section 9.3
Account, profile, session and device records	While your account is active. Removed when your account is deleted, except as noted below
Latest app diagnostics	Only the latest report, replaced each time your app reports
Detailed AI usage records and operational events	90 days
Monthly AI usage totals	The current month and the previous 11 months
Administrative audit log	2 years
Invitations	Expire 7 days after they are sent, unless resent
Record of agreement acceptance	Kept after your account is closed, as evidence of what you agreed to
Support messages	As long as needed to resolve your request, then deleted from our support inbox within [12 months]
Backups	Encrypted backups are kept for a limited period and then overwritten, normally within [7] days
Information on your device	Until you sign out. Signing out removes your saved session, offline copies of your data, Spotlight entries, pending reminders, Live Activities and supplier-portal sign-ins from that device

9. Your choices and rights

9.1 Access and export

You can download everything in your workspace at any time, in JSON or Excel format, from More → Account → Export my data.

9.2 Correction

You can edit your profile under More → Account, and edit or delete records in your workspace at any time.

9.3 Deleting your account and data

You can ask us to delete your account and workspace in either of two ways:

from the app, with More → Account → Delete my account;
through accountstride.com/support, from the email address on your account.

To protect you, we will confirm the request with you before we delete anything. We complete deletion within 30 days of confirming it, and we tell you when it is done. Deletion removes your account, profile, devices, Customer Data, files and JARVIS memory from our live systems. Copies in backups are overwritten on the schedule in Section 8. Deletion cannot be undone, so consider exporting your data first.

We keep only the records that the law, security or evidence of your agreement require. These are:

the record that you accepted the terms;
the administrative audit log;
usage totals.

None of these contain your Customer Data.

If Your Company manages your account, it may also ask us to delete the workspace it is responsible for.

Device permissions: turn location, camera, photos, notifications or Siri access on or off at any time in the iOS Settings app. The app keeps working without them.
Google sign-in: you can remove the Service’s access at myaccount.google.com/permissions.
AI features: turn them off at any time under More → Account → AI features.
JARVIS memory: you can delete any memory under More → Account.

Withdrawing consent does not affect processing that happened before you withdrew it.

9.5 Privacy rights under state law

Depending on where you live, you may have rights under state privacy laws, such as those of California, Colorado, Connecticut, Virginia and other states. These may include the right to:

know what personal information we hold about you;
get a copy of it;
correct it;
delete it;
opt out of its sale, sharing for targeted advertising, or profiling.

We do not sell personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. We honor requests to access, correct and delete personal information from every user, wherever they live.

To make a request, contact us as described in Section 14. We will verify your request using the email address on your account. You may use an authorized agent; we may ask for proof of the agent’s authority and confirm your identity directly. If we deny a request, you may appeal by replying to our decision, and we will respond to the appeal within the time the law requires. We will not discriminate against you for exercising these rights.

9.6 Business contacts

If your information was entered into the Service by one of our users, for example because you are their customer, that user and their company decide how your information is used. Please contact them first. You may also contact us, and we will forward your request or help as the law requires.

9.7 California “Shine the Light” and Do Not Track

We do not disclose personal information to third parties for their own direct marketing.

We do not track users across third-party websites or services. Because of that, Do Not Track browser signals and Global Privacy Control signals do not change how the Service works. We have nothing to switch off: we already do not sell or share personal information for advertising.

10. Security

We protect information with administrative, technical and physical safeguards that are appropriate to the information we handle. These include:

workspace separation: database access rules that separate every workspace, tested automatically on every change to the code;
encryption in transit: encrypted connections (HTTPS/TLS) for all traffic;
private file storage: files are reachable only through links that expire after a few minutes;
secure session storage: on iPhone and iPad, your sign-in is kept in the iOS Keychain on that device only;
protected server keys: keys stay on our servers and never reach your device;
stronger administrator sign-in: administrative actions require an authenticator app;
least-privilege access: for our operators, with secrets kept out of source code;
content-free error reports.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your email account and devices secure. Tell us promptly if you believe your account has been misused.

If a breach affects your information, we will notify you, and Your Company where appropriate, without unreasonable delay. We will do so within the time required by applicable law; Arizona law, for example, requires notice within 45 days of determining that a breach occurred. The notice will explain what happened and what we are doing about it.

11. Where information is stored

We are based in the United States, and the Service is intended for users in the United States. Information is stored and processed in the United States, in particular in our database provider’s US West region. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

12. Children

The Service is for business use by adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

13. Cookies and similar technologies

The Service uses only the storage it needs to work:

your signed-in session;
a random installation identifier, so that the Service can recognize your device and let you sign it out remotely;
your display preferences;
a cache of the app’s own code, so that it loads quickly.

We do not use advertising or analytics cookies. When a map is shown, Google Maps may set or read its own cookies under the Google Privacy Policy.

14. Contact us

For questions or requests about this Policy or your information, contact:

[Provider legal name] Attn: Privacy [Mailing address] accountstride.com/support

You can also reach us from the app through More → Account → Support.

15. Changes to this Policy

We may update this Policy as the Service changes. When we do, we change the “Last updated” date at the top.

If a change is material, we tell you in the app before it takes effect. Where required, we ask you to accept the new version before you continue using the Service.

We do not use information already collected in a materially different way without your consent. Previous versions are available on request.