Privacy policy

1. Information we collect

• Account information: name and email address when you register. Sign-in is handled by Firebase Authentication (Google LLC); we never receive or store your password.
• Workspace data: company name, reporting periods, job data, and WIP assumptions you enter.
• QuickBooks Online data: financial records you authorize us to sync via the QuickBooks Online API, including job costs, billings, and chart-of-accounts items.
• Usage data (pages visited, features used, and error events) is collected via Google Analytics with IP anonymization.
• Technical data: browser type, device type, and session identifiers. If you use the public demo, we also record the requesting IP address for abuse prevention; demo sessions and their data are deleted within 24 hours.
• Billing information: subscription plan, billing status, and Stripe customer and subscription identifiers. Full payment card details are collected and stored by Stripe, Inc., not by ClearWIP.
• QuickBooks health check: if you run our free diagnostic, we read company information, customers, invoices, and account data from QuickBooks to score your setup. We discard the OAuth tokens the moment the check finishes. Your result summary — company name, QuickBooks realm ID, score, and the outcome of each check — is kept for 7 days. A minimal audit entry (realm ID, score, and check count) is kept for at least 365 days so we can investigate abuse.

2. How we use your information

• Provide and improve the ClearWIP service.
• Sync your QuickBooks Online data and produce WIP schedules.
• Communicate with you about your account, security events, and product updates.
• Comply with legal obligations.
• Share reports you choose to share: when you create a share link for your banker or bonding agent, anyone with that link can view the shared WIP report without signing in. The shared view shows job names and figures, totals, calculation states and warnings, the reporting period and snapshot details, your company name, reconciliation results, and the methodology behind the numbers. If the report was attested, the attester's name (or their email, if they never set a name) and the attestation date appear too. Your own name and business email are shown only when you opt in while creating the link. Every link expires, can be revoked at any time, and every view is counted and timestamped.

We do not sell, rent, or share your personal information with third parties for advertising purposes.

3. Data retention

We keep your account and workspace data for as long as your account is active. You can ask us to delete your account and its data at the address below, and we complete deletion requests within 30 days. Two exceptions: the immutable audit log (kept at least 365 days) and records the law requires us to keep. QuickBooks sync data stays available to support period comparisons and audit trails; you can ask us to purge it separately. Results from the public QuickBooks health check are deleted after 7 days.

ClearWIP sets two essential cookies: a signed sign-in session cookie (up to 14 days) and, in the public demo, a 24-hour demo cookie. Our public pages set no analytics cookies at all — Google Analytics runs there in cookieless mode with IP anonymization, which is why there is no cookie consent banner on them. Inside the app, visitors from the EU see a consent banner before any analytics cookies are set; that choice lives in your browser's local storage and resets if you clear the site's data. Analytics data follows Google's default retention periods, and you can block or delete cookies at any time in your browser.

4. Data security

Here is how we protect your data:

• All data is encrypted in transit using TLS 1.2 or higher.
• Authentication is delegated to Firebase Authentication (Google LLC); ClearWIP never stores your password.
• Share-link tokens are stored only as SHA-256 hashes — the raw value leaves our systems once, when the link is created. QuickBooks refresh tokens are encrypted (AES-256-GCM) with a key unique to your workspace, and QuickBooks access tokens are never written to disk at all.
• Access to production systems is restricted and logged.
• We keep an immutable audit log of material changes — period locks, member and role changes, QuickBooks connections, sharing and billing events — for at least 365 days.

5. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data. To exercise these rights, contact us at the address below. We will respond within 30 days.

6. Third-party services

ClearWIP uses the following third-party services:

• QuickBooks Online (Intuit Inc.): accounting data sync.
• Firebase Authentication (Google LLC): user authentication.
• Stripe, Inc.: subscription billing.
• Google Analytics: product analytics with IP anonymization.
• SendGrid (Twilio Inc.): transactional email delivery (invitations and notifications); SendGrid processes recipient addresses and message content.
• Google Cloud Platform (Google LLC): cloud hosting, storage of generated report files, and infrastructure logging.

Each third party's data practices are governed by their own privacy policies.

7. Contact

Questions about this Privacy Policy? Contact us at privacy@clearwip.com or through our contact page.