The short version: we connect to your accounts read-only, we can see numbers and nothing else, and your dashboard is your own private copy that no other customer shares.
What we can and cannot touch
Every connection to your accounts is read-only. The dashboard reads numbers so it can show and explain them, and that is all it does.
It cannot change, pause, or start an ad campaign.
It cannot send an invoice, edit a job, or change a customer record.
It cannot move money, pay a bill, or touch your books.
You connect each provider through that provider's own sign-in screen, where you click Allow. You never give us a password, and you can revoke our access from your own account at any time.
One optional exception: social posting. If you schedule social media posts with Buffer, you can switch on posting so the dashboard can schedule, edit, and remove those posts for you. It is off until you turn it on, only the owner can turn it on, and you can turn it off again at any time. With it off, the dashboard only reads your Buffer account.
Your own private copy
Each customer gets a separate, private deployment of the dashboard, with its own database, hosted on Cloudflare. There is no shared database. Your numbers, your call recordings, and your logins live in your copy and nowhere else.
How sign-in works
Per-person logins. Each person on your team signs in with their own name and password, added by invitation. Nobody shares an account, you decide what each person can see, and you can remove a person at any time; their access ends on their next click.
Roles. Owners see everything. Other roles see only what their job needs.
Money is guarded on the server. The money pages are for the owner and office manager only; the server refuses them to anyone else. Ad cost figures can be switched off for any person, and then they are stripped out before the page is sent to their screen. They are not merely hidden; they are never delivered.
Passwords are stored with slow, salted hashing. A hash is a one-way scramble that cannot be turned back into the password, and "slow and salted" means it is deliberately expensive to guess at, so a stolen copy would not give up your passwords.
A strict browser security policy. The dashboard tells your browser to run only its own code and to block outside scripts, which shuts the door on the most common way sites get hijacked.
Who else touches your data
We keep the list short. These are the companies that process your data on our behalf, and what each one receives:
Cloudflare hosts your private copy and its database.
Anthropic provides the AI that grades your phone calls and answers your questions. That means your call transcripts, and the numbers on the screen you are asking about, are sent to Anthropic for processing. Anthropic's AI also runs a weekly web search for public mentions of your business on social media and review sites.
Resend delivers the emails the dashboard sends: sign-in invitations, the evening summary, call coaching notes, and any alerts you turn on. Those emails carry what they report, such as a call summary or which page an ad visitor landed on.
Pushover delivers phone alerts, if you turn them on. An alert says what just happened, for example that a new lead just called or sent a form and where they came from, that someone clicked your ad and which page of your website they landed on, or that your ranking in AI search changed. Alerts carry no customer names, phone numbers, or money figures.
OpenAI (ChatGPT), Google (Gemini), and xAI (Grok) are asked, along with Claude, which companies they would recommend for your trade in each city you serve, so the AI Search tab can show whether you are named. The question contains only your trade, the city, and the state: the same thing any homeowner could type. None of your numbers, customers, or account data is sent, and your company name is not in the question; we look for it in the answers ourselves. Each assistant is asked only if it is switched on for your dashboard.
Each provider you connect (for example Google, CallRail, Jobber, or QuickBooks Online). We read from them. We never write to them, except Buffer if you switch on social posting (see above).
We do not sell your data and we do not share it with anyone else.
How long we keep it
We keep your data for the life of your subscription. After you cancel, we delete it within 30 days if you ask us to, and in any case we delete or de-identify it within 90 days as our Privacy Policy says, except anything we must keep to meet a legal, tax, or accounting obligation.
Agreements
A data processing agreement (DPA, the written contract that spells out how we handle your data and what we may and may not do with it) is available on request.