← PowerABL

Privacy Policy

Effective July 6, 2026 · Version 2026-07-06

Your data is isolated per tenant. We do not sell, trade, or distribute user data. You are responsible for securing your account credentials and devices.

1. What we collect

  • Account data: email, authentication tokens, password hashes (never plain passwords)
  • Business records you enter: inventory, sales, tax worksheets, organization address
  • Bank metadata: institution name, masked account numbers, encrypted tokens (Plaid) — we do not store full account numbers in plain text for manual entries beyond encrypted fields
  • Compliance proof: policy version accepted, timestamp, SHA-256 hashes of IP and browser signature (not plain IP)
  • Security audit events: license activation, demo mode, publish attempts (hashed metadata)

2. Optional product improvement sharing

You may opt in at signup or in Security settings to share anonymous usage patterns (e.g., which features you open). This never includes item names, photos, bank numbers, or sales amounts unless you separately export them. You can turn this off anytime.

3. How we use data

To operate your vault, sync devices, calculate estimates, link banks via Plaid, publish SKUs to connected stores, and provide support. We do not sell your personal or business data.

4. Storage & security

  • Supabase PostgreSQL with row-level security (only your account reads your rows)
  • AES-256-GCM encryption for sensitive bank fields at rest
  • Private photos via expiring signed URLs
  • TLS 1.2+ in transit; security headers on every page
  • Leaked-password blocking (HaveIBeenPwned integration via Supabase)
  • Optional TOTP two-factor authentication

5. Third parties

We use Supabase (auth/database), Vercel (hosting), Stripe (subscriptions), and Plaid (bank linking). Each has its own privacy policy. We share only what is needed to provide the feature you use.

6. Retention & deletion

Records remain until you delete your account or request removal, subject to legal retention. Policy acceptance logs may be retained for compliance defense.

7. Your rights

Contact us to access, correct, or delete your data where applicable law allows. Louisiana and U.S. users may have additional state privacy rights.

8. Children

PowerABL is not directed to children under 13. We do not knowingly collect their data.

9. Contact

Questions: email support@powerabl.com.