Privacy Policy

1. Introduction

Vuuv Software LLC ("Vuuv," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile applications (iOS and Android, including the Vuuv Sell register app) and website (collectively, the "Service"). Please read this privacy policy carefully. By using the Service, you consent to the practices described in this policy. If you are a customer of a business that uses Vuuv Sell to ring up in-person sales, Section 6.5 describes how your information is handled.

2. Information We Collect

Personal Information

When you create an account, we collect:

• Email address
• Name (if provided)
• Authentication credentials (via Apple Sign-In, Google Sign-In, or email/password)

Financial Information

To provide our financial tracking services, we collect:

• Transaction data (income, expenses, descriptions, amounts, dates)
• Category and payee information
• Property and real estate information
• Construction project information, customer records, change orders, job cost codes, and project-level billing data
• Tenant and lease information
• Mileage and trip data (including GPS route data when tracking)
• Time tracking entries
• Bank account information (if you use bank sync features)
• Marketplace data from connected sellers (Amazon, eBay, and Etsy), including sales, fees, refunds, shipping labels, payouts, and order metadata
• Project and property addresses used to render maps and evaluate job-site geofences (latitude/longitude resolved via Google Maps Platform)
• Receipt images (if uploaded)
• Documents you upload (contracts, leases, tax forms, etc.)
• Tax and depreciation data

Sensitive Personal Information (Tax Identifiers)

If you use our 1099 generation and tax-reporting features, you may enter sensitive tax identifiers — including Social Security Numbers (SSN), Individual Taxpayer Identification Numbers (ITIN), and Employer Identification Numbers (EIN) — for yourself and for contractors you pay. This information is treated as "sensitive personal information" under the CCPA/CPRA and is stored encrypted at rest in Firebase and transmitted only over TLS. We use it solely to generate the tax forms you request (e.g., 1099-NEC) and, where you elect, to prepare IRS FIRE e-filing packages. We do not use this information for any other purpose, do not sell or share it, and do not use it to train any AI model.

Payment Information

Payment processing is handled by third-party providers (Apple App Store for iOS purchases, Google Play Store for Android purchases, Stripe for web purchases and payment collection features). We do not directly store your credit card numbers or payment details. We receive confirmation of your subscription status from these providers.

Payment Collection Information

If you use Vuuv's payment collection features (invoicing, payment requests, or recurring payments via Stripe Connect), we process and store information related to those transactions, including payer names, email addresses, phone numbers, payment amounts, and payment status. This information is shared with Stripe to facilitate payment processing.

Automatically Collected Information

• Device information (device type, operating system)
• Usage data (features used, time spent in app)
• GPS/location data (only when actively tracking mileage, with your permission)
• IP address and browser type (web application)

3. How We Use Your Information

We use your information to:

• Provide and maintain our Service
• Sync your data across devices (iOS app, Android app, and web)
• Generate financial reports and tax summaries
• Process your subscription payments
• Facilitate payment collection through Stripe Connect
• Send important service-related communications
• Send SMS/text message notifications (with your consent)
• Send outbound CRM emails to your contacts on your behalf, only when you compose and click send (see Section 11.5 for details)
• Surface CRM inbox prompts when new leads are added or deals change state, to help you decide what to do next
• Improve and optimize our Service
• Comply with legal obligations
• Maintain audit trails for IRS compliance purposes

4. Data Storage and Security

Your data is stored securely using Google Firebase infrastructure, which provides:

• Encryption in transit (TLS/SSL)
• Encryption at rest
• SOC 1, SOC 2, and SOC 3 compliance
• ISO 27001 certification

Data residency. Our primary Firestore database and Cloud Storage buckets are hosted in Google Cloud's us-central1 (Iowa, USA) multi-region, and Cloud Functions execute in us-central1. We may use additional Google Cloud regions in the United States for redundancy, backups, or disaster recovery. For transfers of personal data from the EEA, United Kingdom, or Switzerland to the United States, we rely on Standard Contractual Clauses and other appropriate safeguards as described in Section 16.

We implement appropriate technical and organizational measures to protect your personal data, including role-based access controls, biometric authentication options, and immutable audit logging. However, no method of transmission over the Internet or electronic storage is 100% secure.

Data Breach Notification

If we become aware of a personal-data breach that is likely to result in unauthorized access, disclosure, alteration, or loss of your personal information, we will: (a) notify affected users without undue delay via email to the address on file and, where appropriate, through in-app or on-site notice; (b) where GDPR applies, notify the competent supervisory authority within 72 hours of becoming aware of the breach where required under GDPR Article 33; and (c) comply with applicable state breach-notification statutes (including California Civil Code § 1798.82 and analogous laws in other jurisdictions). Notifications will describe, to the extent known, the nature of the breach, the categories and approximate number of affected users, likely consequences, and the measures we have taken or propose to take in response.

5. Bank Sync (Plaid)

If you choose to connect your bank accounts, we use Plaid Inc. ("Plaid") to securely access your financial data. By using our bank sync feature, you acknowledge and agree to the following:

What We Access

When you connect a bank account through Plaid, we access:

• Account information (account name, type, and last four digits)
• Account balances (current and available balance)
• Transaction history (date, amount, merchant name, category)

What We Do NOT Access

• Your bank login credentials (username/password) - these are handled securely by Plaid
• The ability to initiate transfers or move money from your bank accounts
• Full account numbers

How We Use This Data

We use the transaction data from your connected accounts to:

• Automatically import transactions for bookkeeping purposes
• Display account balances in the Banking section
• Help you categorize and track expenses
• Identify potential duplicate transactions

Data Security

Your bank connection is secured using industry-standard practices:

• All data is encrypted in transit using TLS 1.2 or higher
• Access tokens are stored securely on our servers, never on your device
• You can turn on Biometric Lock in the iOS and Android apps, which requires Face ID, Touch ID, or your device passcode to open the app
• You can disconnect your bank at any time. This removes the stored connection and stops future imports. Transactions already imported stay in your books as part of your bookkeeping records, and you can delete your account if you want that data removed

Plaid's Privacy Policy

Plaid's handling of your data is subject to the Plaid End User Privacy Policy. By using our bank sync feature, you also agree to Plaid's privacy practices.

6. Payment Processing (Stripe Connect)

If you use Vuuv's payment collection features (invoicing, payment requests, or recurring rent collection), payments are processed through Stripe, Inc. ("Stripe") via Stripe Connect.

Data Shared with Stripe

When you or your payers use our payment features, the following data may be shared with Stripe:

• Your business information (name, address, tax ID) for Stripe Connect onboarding
• Payer information (name, email, phone number) for transaction processing
• Payment amounts and descriptions
• Bank account details for ACH payments (handled directly by Stripe)

Stripe's Privacy Policy

Stripe's handling of payment data is subject to the Stripe Privacy Policy. By using our payment collection features, you agree to Stripe's privacy practices. Vuuv does not store credit card numbers, bank account numbers, or other sensitive payment credentials -- these are handled entirely by Stripe.

Stripe Identity Verification and Risk Checks

Stripe independently performs identity verification ("Know Your Customer" / KYC), sanctions screening, anti-money-laundering checks, and ongoing transaction risk monitoring on Stripe Connect accounts using information you submit during onboarding (which may include legal name, date of birth, address, SSN or EIN, and business documentation). These checks are performed by Stripe, not by Vuuv, and are subject to Stripe's privacy policy and applicable law.

Public Invoice Payment Links

When you send an invoice or payment request, Vuuv generates a public payment URL (e.g., /pay/{token}) that anyone holding the link can open to view the invoice and submit payment. The link itself is the only credential required to view the invoice. The invoice page may display your business name, contact information, invoice amount, description, and (for property-related invoices) the associated property or unit address. You control who receives the link; you can regenerate or cancel the link at any time to invalidate prior URLs.

Stripe Security and Fraud Monitoring

To help protect your Stripe Connect account and the platform, Vuuv receives and stores webhook-driven security events from Stripe (including early-fraud warnings, Radar review openings and closures, payment disputes, and Stripe Connect account requirement changes) in a server-only stripeFraudAlerts record linked to your account. Authorized Vuuv operations personnel may review these events to triage fraud, investigate abuse, and contact you if action is required. These records are not visible to other users.

6.5 Vuuv Sell Point of Sale (In-Person Sales)

Vuuv Sell is our point of sale for selling in person at markets, fairs, and pop-ups. It includes a register app (the "Vuuv Sell" app for iOS and Android) used at the stand, plus management screens in the main Vuuv apps and on vuuv.co. This Privacy Policy covers the Vuuv Sell apps as well as the main Vuuv apps and website.

If You Bought Something From a Business That Uses Vuuv Sell

The seller is the business you transacted with. Vuuv processes the record of your purchase on the seller's behalf so the seller can give you a receipt and keep accurate books. For questions or requests about your information, contact the seller you bought from first; we assist sellers in responding to such requests. You can also contact us directly (Section 20).

A sale record contains the items sold, amounts, sales tax, date and time, and selling location. For card payments it also contains the card brand, the last four digits of the card number, how the card was read, the card network's application details, and the authorization code. Card networks require these fields on receipts, and they remain in the seller's books as part of the seller's financial records.

Your full card number is read by the Stripe card reader and processed by Stripe on the seller's own Stripe account. Vuuv never receives it. Stripe's handling of your payment is subject to the Stripe Privacy Policy.

If you ask for an email receipt, your email address is used for one purpose: delivering that receipt (sent through Twilio SendGrid, our email provider). It is stored in a restricted part of the sale record that the register cannot read back, it is never attached to your payment card, never shared with or reused for any other seller, and never used for marketing. It is automatically removed from the sale record 90 days after the send attempt, whether or not the email was delivered. Giving your email to one seller never causes receipts or messages from any other seller.

If a receipt reaches you that is not yours (for example, a mistyped email address), you can disregard it. The address it was sent to is removed automatically as described above, and it is not used for anything else. Email receipts also link to a digital copy of the receipt; the link itself is the only credential needed to view it, so treat the link like the paper receipt.

What We Do Not Do With Buyer Information

• We do not sell buyer information or share it for advertising.
• We do not send marketing to buyers or build profiles of buyers across sellers.
• We do not link a buyer's email address to their payment card.
• We do not use purchase records for credit, underwriting, or similar decisions.

Cashier Logins Are Devices, Not People

A Vuuv Sell register login identifies a device (for example, "ipad-1"), not a person. The seller creates these logins, and cashiers do not create personal accounts or provide personal information to Vuuv to run the register. A register login has no access to the seller's accounting data. If you operate a register for your employer and have questions about information collected at work, contact your employer.

Register App Permissions (Bluetooth and Location)

The Vuuv Sell apps request Bluetooth to pair the Stripe card reader, and device location because Stripe's Terminal software requires knowing where card payments occur to reduce fraud risk and disputes; card payments are unavailable if device location is off. Vuuv does not use these permissions to track buyers or cashiers, and does not use register location data for any purpose of its own.

7. Electronic Signatures (SignWell)

Vuuv integrates with SignWell for electronic document signing (e.g., lease agreements). When you use this feature, document data and signer information (name, email) is shared with SignWell to facilitate the signing process.

SignWell's handling of your data is subject to SignWell's Privacy Policy. Signed documents are stored securely and accessible through our Service.

8. Amazon Selling Partner Integration

If you connect an Amazon seller account, Vuuv uses Amazon's Login with Amazon (LWA) and Selling Partner API (SP-API) to retrieve financial and order data on your behalf.

What We Access

• Financial events: sales, fees, refunds, reimbursements, shipment events, and settlements
• Order metadata: order IDs, purchase date, totals, shipment status, and buyer shipping city, state, and postal code (we do not store full buyer names or street addresses)
• Seller account identifiers (seller ID, marketplace IDs)

How We Store Credentials

LWA access and refresh tokens are stored server-side in a Firestore collection that is unreadable to clients (enforced by security rules). Tokens are never transmitted to your device or browser. Access tokens are refreshed automatically when they expire.

How We Use the Data

We use Amazon financial and order data to (a) present a review list you can selectively import as Vuuv transactions, (b) categorize marketplace income, fees, and refunds, and (c) power reporting such as Schedule C summaries. We do not sell this data, and we do not use it to train any AI model.

Disconnection and Deletion

You may disconnect your Amazon seller account at any time through the Amazon integration screen. Disconnection revokes our LWA tokens and deletes the synced marketplace data. You may also revoke access directly from Amazon Seller Central.

Amazon's Privacy Practices

Amazon's handling of your seller data is subject to Amazon's own terms and privacy policies. See Amazon's Privacy Notice.

9. eBay Finances Integration

If you connect an eBay seller account, Vuuv uses eBay's OAuth 2.0 authorization and the eBay Finances API to retrieve transaction data on your behalf.

What We Access

• Financial transactions: sales, fees, refunds, shipping labels, payouts, credits, adjustments, and dispute records
• Payout and settlement information
• Seller account identifiers

How We Store Credentials

eBay access and refresh tokens are stored server-side in a Firestore collection that is unreadable to clients (enforced by security rules). Tokens are never transmitted to your device or browser.

Marketplace Account Deletion Compliance

As required by eBay's Marketplace Account Deletion program, Vuuv operates a compliance endpoint (ebayAccountDeletionNotification) that receives account-deletion notifications from eBay. When we receive a notification, we log the request to an immutable audit collection, revoke the associated OAuth tokens, and delete the affected seller data from our servers.

Disconnection and Deletion

You may disconnect your eBay seller account at any time through the eBay integration screen. Disconnection revokes tokens and, at your option, deletes the synced transaction data.

eBay's Privacy Practices

eBay's handling of your seller data is subject to eBay's own terms and privacy policies. See eBay's User Privacy Notice.

9.5 Etsy Shop Integration

If you connect an Etsy shop, Vuuv uses Etsy's OAuth 2.0 authorization and the Etsy Open API to read your shop's financial records on your behalf so that your Etsy revenue and fees are imported into your books for bookkeeping and tax preparation. Access is read-only and is limited to your own shop.

What We Access

• Your Etsy payment account ledger: sales, refunds, transaction and processing fees, listing and advertising fees, shipping label costs, taxes, and payouts
• Your shop's name, currency, and identifier

We request only read-only scopes (transactions_r and shops_r). Vuuv never writes to your shop, never manages your listings, inventory, orders, or checkout, and does not request or store buyer personal information such as buyer names or email addresses.

How We Store Credentials

Etsy access and refresh tokens are stored server-side in a Firestore collection that is unreadable to clients (enforced by security rules). Tokens are never transmitted to your device or browser.

Disconnection and Deletion

You may disconnect your Etsy shop at any time from the Etsy integration screen in Vuuv. Disconnection immediately deletes the stored tokens and stops all further Etsy API access and, at your option, deletes the imported Etsy records from your Vuuv account. You may also revoke Vuuv's access directly from your Etsy account settings.

Etsy's Privacy Practices

Etsy's handling of your data is subject to Etsy's own terms and privacy policy. See Etsy's Privacy Policy.

The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.

10. Developer Platform Integrations (App Store, Google Play, Steam, Patreon, YouTube, Upwork)

If you connect any of the following platforms, Vuuv uses each platform's OAuth or credential-upload flow to read your financial data on your behalf so that platform revenue is automatically imported into your books for tax preparation:

• Apple App Store Connect (App Sale, In-App Purchase, Subscription, refund, and Apple commission data via the App Store Connect Finance Reports API)
• Google Play Console (sale, in-app purchase, subscription, refund, and Google commission data via the monthly Earnings Report in the Cloud Storage bucket)
• Steam Partner (daily sales, returns, and gross revenue per region via Steam's IPartnerFinancialsService API)
• Patreon (paid pledges, patron status, charge dates, and amounts via the Patreon Members API and payment_history scope)
• YouTube and AdSense (finalized monthly earnings via the AdSense Reports API and YouTube Analytics API)
• Upwork (contract earnings, hourly billings, and milestone payments via the Upwork GraphQL API)

What We Access

Per platform, we read only the financial records and account identifiers needed to import revenue into your books. We do not read your messages, contracts, audience analytics beyond aggregate earnings, customer payment details, or any data unrelated to financial reporting.

What We Do NOT Access

• Messages, comments, posts, contracts, or proposals on any connected platform
• Audience analytics, view counts, or subscriber demographics beyond what is needed to compute aggregate earnings
• End-customer payment method details (card numbers, bank account numbers)
• Patron personally identifiable information beyond patron display name and patron status (for Patreon)
• Any data unrelated to revenue, fees, refunds, or platform commissions

How We Store Credentials

For OAuth connectors (Patreon, YouTube, Upwork), access and refresh tokens are stored server-side in Firestore collections that are unreadable to clients (enforced by security rules). Tokens are never transmitted to your device or browser. Access tokens are refreshed automatically when they expire.

For credential-upload connectors (Apple App Store .p8 private key, Google Play service-account JSON, Steam Financial API Key), credentials are stored server-side in Firestore collections that are unreadable to clients. Every server-side read of a stored credential is logged to a structured Cloud Logging entry for audit purposes; we never log credential contents.

How We Use the Data

We use connector data to (a) present a per-row review list you can selectively import as Vuuv transactions, (b) categorize income, fees, refunds, and platform commissions for bookkeeping, (c) prepare Schedule C and similar tax summaries, and (d) reconcile 1099-K and 1099-NEC thresholds. We do not sell this data, share it with any third party beyond what is required for the integration itself to function, or use it to train any AI model.

Data Retention

Synced connector data is retained while the connection is active and for as long as you retain the resulting Vuuv transactions. Because Vuuv handles your books and taxes, soft-deleted records are preserved for the IRS audit window (currently 7 years from the relevant tax year) so that the audit trail remains complete. You may request permanent deletion at any time (see Section 16, Your Rights).

Disconnection and Deletion

You may disconnect any connector at any time from the corresponding integration screen in Vuuv. Disconnection revokes the stored OAuth tokens or credentials with the connected platform and, at your option, soft-deletes the synced records from your Vuuv account. You may also revoke access directly with the platform: Patreon (Account Settings, then Apps and Plugins), Google for YouTube and AdSense (at myaccount.google.com/permissions), Upwork (Settings, then Apps), or by rotating or revoking the uploaded credential at Apple, Google Cloud, or Steamworks.

Each Platform's Privacy Practices

Each connected platform's handling of your data is governed by that platform's own terms and privacy policy:

• Apple Privacy Policy
• Google Privacy Policy (covers Google Play, AdSense, and YouTube)
• Steam (Valve) Privacy Policy
• Patreon Privacy Policy
• Upwork Privacy Policy

YouTube API Services Compliance

Vuuv's YouTube integration uses YouTube API Services. By connecting your YouTube channel, you agree to be bound by the YouTube Terms of Service. Vuuv accesses, uses, stores, and shares the data described above only as needed to provide the income-import feature, and complies with the Google Privacy Policy. Vuuv does not use any YouTube data to train machine-learning or AI models, and does not transfer YouTube data to third parties for advertising. You may revoke Vuuv's access to your YouTube data at any time via the Google security settings page.

11. Vuuv AI

Vuuv provides AI-assisted features that make existing app functions smarter (collectively, "Vuuv AI"). These features include:

• Receipt scanning (extracting merchant, amount, date, category, and for real-estate businesses an optional property attribution and a repair-vs-improvement tax classification)
• Automatic categorization of bank-imported and manually-entered transactions
• Duplicate transaction detection
• Recurring transaction pattern detection
• Audit-flag scans (missing receipts, unusual amounts, potential personal expenses, mismatched categories)
• Tax hints and year-end tax narratives for CPAs
• Profit-and-loss report narrative summaries
• Budget suggestions based on historical spending
• Document classification for uploaded files
• Natural-language transaction search
• Estimate document import (extracting line items from Xactimate, Symbility, or generic scope PDFs into a Vuuv Estimate)
• Project and cost-code suggestions for Projects-enabled businesses
• Property-maintenance reminder suggestions for real-estate businesses
• CRM welcome-email drafting and polishing ("Generate email" and "Enhance email" buttons on the compose dialog for a new lead). The model receives the contact's display name, the lead source you entered, the first ~200 characters of your notes on that contact, your business name and business type, and — for the Enhance flow — the rough draft you typed. AI never sends an email automatically; it only fills in the draft for your review.

How Vuuv AI Works

Vuuv AI runs on Google's Gemini models, accessed through Google's Vertex AI service on Google Cloud. When you use a Vuuv AI feature, Vuuv's Cloud Functions send the relevant input to Vertex AI on your behalf, receive a structured response, and store the response alongside the entity it describes (e.g., the parsed receipt fields are saved on the transaction tied to the uploaded image).

The data sent varies by feature, but is limited to what the model needs to produce the requested output:

• For receipt scanning, document classification, and estimate import: the image or rasterized PDF page (downscaled to a maximum of 1024 pixels on the longest edge), plus a small amount of business context (your business type, your category names, and — for real-estate businesses opting into property attribution — a list of property addresses).
• For transaction categorization, duplicate detection, recurring detection, audit flagging, tax narratives, and report summaries: the transaction or report fields needed for the analysis (description, amount, date, category) plus a small amount of business context.
• For natural-language search: your search query and a snapshot of the business context needed to translate the query into filters.

Requests are processed in Google Cloud's us-central1 region (United States).

Google's Contractual Commitments

Vuuv's use of Vertex AI is governed by Google Cloud's standard service terms, including the Cloud Data Processing Addendum and the Google Cloud Service Specific Terms (currently published at cloud.google.com/terms/service-terms). Under those terms, prompts and responses you submit through Vertex AI are not used to train Google's foundation models, are not retained to train future models, and are not reviewed by Google personnel except as permitted under those terms (for example, to investigate suspected abuse of the service). Vuuv has not opted in to any optional program that would expand Google's use of the data beyond those default terms.

No Training on Customer Data

We do not train, fine-tune, or otherwise improve any AI model — Vuuv's or anyone else's — using your User Content. Per Google's contractual terms above, your inputs to Vertex AI are likewise not used to train Google's models. Your User Content is used only to generate the output you request and to operate and secure the Service.

Inputs, Outputs, and Retention

The input you provide to a Vuuv AI feature is transmitted to Vertex AI for processing and is not separately retained by Vuuv after the response is returned. The structured output is stored as part of your normal User Content (for example, the parsed receipt fields appear on the saved transaction; an imported estimate's line items appear on the saved Estimate). Inputs and outputs are deleted when you delete the underlying entity or your account (see Section 17, Data Retention). Google's transient logging of Vertex AI requests is governed by the Google Cloud terms described above.

Changes to AI Providers

We will provide reasonable advance notice through this Privacy Policy if we change the third-party provider that powers Vuuv AI, or if we materially expand the set of data that Vuuv AI features send to that provider.

Accuracy

AI-generated output can be incomplete, inaccurate, or misleading. You are responsible for reviewing and verifying AI output before relying on it. See the Terms of Service, Section 7 and Section 15, for the full informational-only disclaimer.

11.5 Customer Relationship Management (CRM)

If you enable CRM on a business, Vuuv stores the contacts you add (name, email, phone, company, source, lifecycle status, notes, and any communication preferences you set like "do not email" or "skip welcome email"), the Deals you create against those contacts, your Activity timeline (notes, logged calls, logged emails, automated events tied to invoices, deals, or follow-ups), and your scheduled Follow-ups. This information is stored under your account on Google Firestore and visible only to you and any team members you've explicitly invited.

Outbound Emails to Your Contacts

When you compose and click Send on a CRM email — including the optional welcome email for a new lead — Vuuv delivers the message on your behalf through Twilio SendGrid (see Section 14, Sub-Processors). The recipient sees the message as coming from a Vuuv-operated infrastructure address with your business name on the From-line and your business contact email (or your account email) on the Reply-To header. Replies go directly to you, not to Vuuv.

Nothing is sent automatically. The "welcome new leads" toggle in Business Settings only surfaces a card in your CRM inbox prompting you to compose a welcome email; you choose whether to send it and what it says. The Generate and Enhance buttons on the compose dialog use Vuuv AI to draft or polish copy, but the draft sits in front of you until you press Send.

You are the legal sender of every CRM email you send through Vuuv. You're responsible for compliance with applicable anti-spam and consent laws (US CAN-SPAM Act, Canada's CASL, EU GDPR direct-marketing rules, and analogues in other jurisdictions). Vuuv honors per-contact opt-out signals you set (doNotEmail anddoNotSendWelcomeEmail) by preventing CRM emails to those contacts from being sent or even prompted.

CRM Inbox and Automation Triggers

When enabled per business, Vuuv surfaces inbox prompts on a few CRM events: a new lead is added (welcome-email card), a Deal moves to "Won" (draft-invoice card), or a sent Estimate has gone unsigned for 7+ days (stale-quote card). These prompts are stored under your account and shown only to you. Dismissing or acting on a prompt records a small audit + telemetry entry that lets us measure CRM adoption (we never read the content of your contacts or emails for analytics purposes).

CRM AI Drafting

When you tap Generate or Enhance in the welcome-email compose dialog, the data sent to Vertex AI for that single request is described in Section 11 ("Inputs, Outputs, and Retention"). Briefly: contact name, lead source, the first ~200 characters of your notes on the contact, your business name and type, and — for Enhance — the rough draft you typed. Inputs and outputs are governed by the same Google Cloud terms that apply to every other Vuuv AI feature (no training on your data, no human review except for security investigations).

Inbound Email Reply Threading

Each CRM email Vuuv sends on your behalf carries a Reply-To address that routes the recipient's reply back through Twilio SendGrid's Inbound Parse webhook to Vuuv. We use a signed token in the address to identify which contact and which business the reply belongs to, then attach the reply (sender, subject, plain-text body, and any attachments) to that contact's Activity timeline under your account. The reply is visible only to you and team members you've invited. We do not scan reply bodies for advertising or analytics purposes; replies are stored only for your reference and to keep the conversation history intact.

If you'd rather receive replies directly without Vuuv routing them, set your business's contact email or your account email as the Reply-To override in Business Settings.

CAN-SPAM Postal Address

When your business has a postal address on file (Business Settings → Address), Vuuv appends that address to the footer of every CRM email it sends on your behalf, next to the one-click unsubscribe link. This satisfies the CAN-SPAM Act's physical-address requirement. If you have not entered an address, the footer still includes the unsubscribe link; you remain responsible for ensuring the messages you send comply with the laws of your jurisdiction.

11.6 Bookings and Calendar Sync

Vuuv lets you publish a public Booking page (e.g., vuuv.app/book/your-slug) where prospects can pick a time slot and book themselves onto your calendar. When someone books, we collect the name, email, optional phone number, optional notes they choose to share, and the time slot they pick. That information is stored under your account, surfaces in your CRM as a Contact + Activity, and triggers confirmation emails to both you and the guest.

The guest confirmation email contains a one-click cancellation link signed with an HMAC token. Anyone who possesses the link (which we never publish) can cancel the booking; the cancellation flips the booking's status and emails both parties.

Two-Way Google Calendar Sync (optional)

If you connect a Google Calendar in Business Settings, Vuuv uses Google OAuth 2.0 to obtain a refresh token scoped to your primary calendar. We store the refresh token server-only (it is never visible to clients) under your account, and we use it to:

• Push new Vuuv Bookings to your Google Calendar so you see them alongside your other events.
• Pull your existing busy windows once an hour so the public Booking page's available-slot list automatically hides times you're already booked elsewhere.

When you open the CRM Calendar inside Vuuv, we make a real-time read against your connected Google or Outlook calendar to fetch the events in the visible date range so they can be displayed alongside your Vuuv bookings. We project only the minimum data needed: event title, start, end, location, and a deep-link back to the original event. We do not read attendee lists, the full event description, or any other field. Event data is not stored in Vuuv — it is fetched on demand each time you open the Calendar and discarded when you navigate away. We do not write events back to your calendar other than the ones a guest (or you, via the CRM Calendar's "New booking" action) creates through Vuuv. Edits to an existing Vuuv booking are pushed back to the linked event on your calendar; deleting a Vuuv booking deletes the linked event there too.

You can disconnect Google Calendar at any time from Business Settings. Disconnecting revokes the refresh token at Google, deletes our stored copy, and clears the cached busy windows. Use of the Google Calendar API is subject to Google's Privacy Policy and Google API Services User Data Policy, including the Limited Use requirements.

12. Location Data, Mileage, and Project Geofencing

Vuuv's mobile apps can capture location data in two optional, opt-in ways:

• Mileage tracking. When you actively track a mileage trip, we record the start and end locations and the GPS route between them. GPS route data is stored with the trip for IRS audit purposes.
• Project geofencing. When you enable geofence auto-suggestion, the app compares your device location to the lat/lng of your active Projects and suggests the nearest match when you create a transaction, time entry, or mileage trip. Evaluation runs on your device; location is not continuously streamed to Vuuv's servers.
• Vuuv Sell register apps. The register apps use device location only because Stripe's Terminal software requires it to accept card payments; see Section 6.5. Vuuv does not use register location for any purpose of its own.

Address Geocoding (Google Maps Platform)

When you enter a project or property address, we use Google Maps Platform (Places API and Maps JavaScript API) to (a) autocomplete the address, (b) resolve it to latitude/longitude, and (c) render map previews and geofence editors. The address text is sent to Google as part of this lookup. Your use of Google Maps Platform is subject to Google's Privacy Policy. We do not store your Google Maps API key on your device; Google Maps tiles and autocomplete responses are fetched by the client from Google directly.

Consent and Control

Location features are off by default and require OS-level location permission plus an explicit in-app toggle. You can revoke permission at any time through your device settings or by disabling the feature inside the app. Disabling the feature stops future location capture; previously saved trip and project-location data remains until you delete it.

13. SMS/Text Messaging

Vuuv may send SMS (text) messages to phone numbers you provide. By providing your phone number and opting in to receive text messages, you consent to receive SMS communications from us.

Types of Messages

We may send you the following types of text messages:

• Invoice and payment notifications
• Payment request alerts
• Payment confirmation receipts
• Account security alerts
• Service-related updates

Message Frequency

Message frequency varies based on your account activity. You will only receive messages related to transactions and account activities you initiate or that require your attention.

Opt-In

You opt in to receive SMS messages when you:

• Add your phone number to your account settings
• Enable SMS notifications in your preferences
• Provide your phone number when creating invoices or payment requests

Opt-Out

You can opt out of receiving SMS messages at any time by:

• Replying STOP to any message you receive from us
• Updating your notification preferences in your account settings
• Contacting us at [email protected]

After opting out, you will receive a confirmation message and will no longer receive SMS messages from us (except for critical security alerts, if required).

Costs

Message and data rates may apply. Vuuv does not charge for SMS messages, but your mobile carrier may charge you for receiving text messages based on your plan.

Help

For help with SMS messages, reply HELP to any message or contact us at [email protected].

14. Data Sharing and Sub-Processors

We do not sell your personal information. We may share your information with:

• Sub-Processors: Third-party service providers who process personal data on our behalf (see the sub-processor list below)
• Team Members: If you invite team members to your business, they will have access to business data based on their assigned role and permissions
• Payers: If you send invoices or payment requests, the recipient will see your business name, contact information, and payment details
• Legal Requirements: If required by law, legal process, or to protect our rights, safety, or property
• Business Transfers: In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the acquiring party agreeing to honor the commitments in this Privacy Policy

Current Sub-Processors

The following third parties process personal data on Vuuv's behalf as part of delivering the Service. This list is current as of the "Last updated" date at the top of this policy and may change from time to time; we will update this list and, where required, provide notice of material changes.

Note on AI features. Vuuv AI features are powered by Google's Gemini API on Google Cloud. See Section 11 for the full description, including the data sent, the processing region, and Google's contractual commitments not to train its models on your inputs.

15. Cookies, Local Storage, and Your Privacy Choices

Our web application uses cookies and browser local storage. We group them into three categories, and you control two of them through Vuuv's in-site Privacy Choices center. Non-essential trackers are off by default and are only enabled after you make an affirmative choice.

• Essential (always on): Required for authentication and session management, payment processing (including Stripe anti-fraud), saving your display preferences (e.g., theme, selected business), and protecting your account. These cannot be turned off because the Service cannot operate without them.
• Analytics (opt-in): Google Analytics 4. Helps us understand which features are used and where visitors get stuck. Runs only on our public marketing pages; GA4 is never loaded as a full tracker on logged-in app pages (e.g.,/dashboard, /transactions). Until you opt in, Google Consent Mode v2 ensures any events sent are cookieless "consent-mode pings."
• Marketing (opt-in): Meta Pixel, LinkedIn Insight Tag, and Google Ads signals used to measure which advertising brings new Vuuv customers. These run only on public marketing pages, never on logged-in app pages, and the Meta Pixel and LinkedIn Insight Tag scripts are not loaded at all until you grant marketing consent.

How to Set or Change Your Choices

A cookie banner appears on your first visit and lets you choose Accept all, Reject all, or manage individual categories. You can re-open the preference center at any time from the "Your Privacy Choices" link in our website footer. Your choice is stored locally in your browser; if you are signed in, it is also synced across your devices via your Vuuv account.

Geographic Treatment

Visitors from the European Economic Area, United Kingdom, or Switzerland see a prior opt-in flow as required by the GDPR and ePrivacy Directive — no non-essential trackers run until you choose. Visitors elsewhere see a dismissible banner and may exercise opt-out at any time; this satisfies our obligations under the CCPA/CPRA and similar U.S. state privacy laws.

Global Privacy Control (GPC)

If your browser sends a Global Privacy Control signal (as recognized under Cal. Code Regs. tit. 11 § 7025 and analogous state laws), Vuuv automatically treats it as an opt-out of sale and sharing. Analytics and marketing trackers are disabled for your browser and the preference-center toggles are locked in the "off" state while GPC is active. To re-enable those categories, turn GPC off in your browser settings.

Direct Opt-Out Tools

In addition to our in-site controls, you may use each provider's own tools:

• Google Analytics: Google Analytics Opt-out Browser Add-on.
• Meta (Facebook) Pixel: Facebook Ad Settings.
• LinkedIn Insight Tag: LinkedIn Ad Settings.

Our mobile applications use on-device storage for caching and offline functionality and do not load Google Analytics, Meta Pixel, or the LinkedIn Insight Tag. On iOS, advertising-related tracking is further governed by Apple's App Tracking Transparency prompt; on Android, by Google Play advertising-identifier controls.

16. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and data
• Export your data
• Opt out of marketing communications
• Opt out of SMS messages at any time
• Disconnect bank accounts and remove associated data

To exercise these rights, contact us at [email protected]. We will respond to your request within 30 days.

California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions (e.g., legal retention requirements).
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising purposes.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of Personal Information Collected: Identifiers (name, email), financial information (transactions, account data, marketplace data from Amazon and eBay), commercial information (subscription history), internet activity (usage data), geolocation (mileage tracking and project geofencing, when enabled), and professional information (business details).

Categories of Sensitive Personal Information Collected: government identifiers used for tax reporting (Social Security Numbers, ITINs, and EINs that you enter for yourself or for contractors when generating 1099 forms), precise geolocation (only when mileage tracking or project geofencing is actively enabled), and account log-in credentials. We collect and use sensitive personal information only for the specific purposes described in this policy (including tax reporting, mileage/project tracking, and authentication), and we do not use or disclose it for any purpose other than those purposes reasonably necessary to provide the Service. We do not use sensitive personal information to infer characteristics about you and we do not use it to train AI models.

To submit a CCPA/CPRA request, email us at [email protected]. We will verify your identity before processing your request.

European Economic Area Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Lawful Basis for Processing: We process your data based on contractual necessity (to provide the Service), your consent (for optional features like GPS tracking and SMS), and our legitimate interests (to improve the Service and prevent fraud).
• Right to Portability: You may request a copy of your data in a structured, machine-readable format.
• Right to Restrict Processing: You may request that we limit how we use your data in certain circumstances.
• Right to Object: You may object to processing based on our legitimate interests.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority.

Data Transfers: Your data is stored on servers located in the United States. By using the Service, you consent to the transfer of your data to the United States. We rely on Standard Contractual Clauses and other appropriate safeguards for international data transfers.

Data Protection Contact: For GDPR-related inquiries, contact us at [email protected].

17. Data Retention

We retain your data for as long as your account is active or as needed to provide services.

Exporting Your Data

You can export your financial data at any time through the app or website. We strongly recommend exporting your records before deleting your account, as your data cannot be recovered after deletion. As a user of financial software, you are responsible for maintaining your own tax records in accordance with IRS guidelines (generally 3-7 years).

Account Deletion

When you delete your account, all of your data is permanently deleted within 30 days. This includes your personal information, financial records, transactions, documents, receipt images, GPS route data, and all other content associated with your account. Your account will no longer be accessible on any platform. Deleted data cannot be recovered.

Vuuv Sell Sale Records and Receipt Emails

In-person sale records created through Vuuv Sell are part of the seller's books of record. They are immutable once written and are retained like the seller's other financial records, including records of refunds and of card dispute outcomes, until account deletion. A buyer's email address collected for an email receipt follows a shorter clock: it is automatically removed from the sale record 90 days after the send attempt, whether or not the email was delivered (see Section 6.5). The sale record itself is retained without it.

CRM Data Retention

CRM contacts, Deals, Activities, Follow-ups, inbox prompts, and automation telemetry are retained for the lifetime of the account. Per-contact soft-deletes are preserved for audit-trail integrity (IRS compliance) until full account deletion, after which they are removed along with the rest of your data per the 30-day window above.

18. Children's Privacy

The Service is only offered to users who are 18 years of age or older, as required by our Terms of Service. Separately, under applicable children's-privacy laws, we do not knowingly collect personal information from children under 13 (United States / COPPA) or under 16 (European Economic Area / GDPR). The 18+ minimum in our Terms of Service is the operative requirement for account creation and use of the Service. If you believe we have collected information from a child, please contact us immediately at [email protected] and we will take steps to delete it.

19. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page, updating the "Last updated" date, and, where appropriate, sending you a notification via email or in-app message. Your continued use of the Service after any changes constitutes acceptance of the new policy.

20. Contact Us

If you have questions about this Privacy Policy, please contact us at: