Privacy Policy

This policy explains what Soap Workbench, LLC, a Florida limited liability company, collects when you use Soap Workbench and what we do with it.

What we collect

Only what the Service needs to work: your email address and sign-in details; the business name, books, statements, receipts, recipes, photos, and other records you enter or import; the sales data you choose to connect; problem reports you send with the "Report a problem" button, along with the page you were on, your browser, and your screen size; and basic technical logs (such as IP address and browser) kept by our hosting providers for security and troubleshooting. We don't ask for your Social Security number, date of birth, or card or bank login details, and you don't need to enter them anywhere.

For sales, we keep order numbers, dates, items, and amounts, not your customers' details. When you import a sales file, the app reads only the columns you choose in your browser, so customer names, emails, and addresses in the file aren't sent to us.

How we use it

Only to run, secure, and improve the Service for you, and to contact you about your account or the test. We don't sell or rent your data, show ads, use it to train AI models, or share it with anyone except the providers below.

Who processes it

• Supabase: database, sign-in, and file storage, in the United States.
• Resend: sends our account emails (confirming your email address and resetting your password), so it sees your email address and the email we send you, in the United States. It also sends the reminders described under "How long we keep it" if your account goes unused.
• Vercel: hosting the website, in the United States.
• GitHub: keeps encrypted copies of the database (backups) for 90 days, in the United States, so we can recover from a mistake. Only we hold the key to open them.
• Google: if you choose "Continue with Google", Google confirms who you are and shares your name, email address, and profile picture link with us. Supabase keeps them with your sign-in details; we use the email to sign you in and don't show or use the picture. We don't get your Google password or anything else in your Google account. You can remove our access in your Google account settings at any time; you can still sign in by setting a password with "Forgot your password?".
• Gmail: if you email us, your message reaches our inbox there.
• Shopify: if you connect a Shopify store, we read its orders (order numbers, dates, items, quantities, prices, discounts, shipping, tax, tips, and refunds), its Shopify Payments fees and payouts, with the read-only access you approve on Shopify. We don't ask Shopify for your customers' names, emails, or addresses and don't store them. The store's access key is kept encrypted. You can disconnect in Sales > Channels, or uninstall the app in Shopify, at any time; sales already brought in stay in your records until you delete them.
• Square: if you connect a Square account, we read its completed orders (order ids, dates, items, quantities, prices, discounts, service charges, tax, tips, and refunds), the processing fees on them, and its payouts, with the read-only access you approve on Square. We don't read your customers' names, emails, or addresses and don't store them. The account's access key is kept encrypted. You can disconnect in Sales > Channels at any time, which also asks Square to cancel our access; sales already brought in stay in your records until you delete them.
• Etsy: if you connect an Etsy shop, we read its paid orders (order numbers, dates, items, SKUs, quantities, prices, discounts, shipping, and refunds) and its payment account entries (Etsy's fees and payouts to your bank), with the read-only access you approve on Etsy. Etsy's orders include buyers' names and addresses, but we don't read or store them. The shop's access key is kept encrypted. You can disconnect in Sales > Channels, or remove the app in your Etsy account settings, at any time; sales already brought in stay in your records until you delete them. The term 'Etsy' is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.
• WooCommerce: if you connect a WooCommerce store with a read-only key, we read its paid orders (order numbers, dates, items, SKUs, quantities, prices, discounts, shipping, tax, and refunds) from your store. Orders include buyers' names, emails, and addresses, but we don't read or store them. The key is kept encrypted, and you can disconnect at any time and revoke the key in WooCommerce.
• Stripe: if you connect Stripe with a restricted read-only key, we read your balance activity: payments and their descriptions, Stripe's fees, refunds, and payouts. We don't read your customers' details. The key is kept encrypted, and you can disconnect at any time and delete the key in Stripe.
• Other sales channels: you import files you download from them yourself. Sales already brought in from any channel stay in your records until you delete them.

We don't use analytics, advertising, or tracking tools, and the app's font is served from our own site. All of these providers store and process data in the United States, so if you use the Service from another country, your data goes to the United States. If we add or change a provider, we'll update this list and the date above, and ask you to accept the policy again.

Cookies and storage in your browser

We use only the cookies the app needs to work: Supabase's cookies that keep you signed in, and one of ours that remembers which of your businesses you're working in (it lasts a year), and one that notes you've used the app today, so we only record that about twice a day (it lasts 12 hours). The app also saves a few preferences on your device, such as the last area you opened and the last account you posted from, so it opens where you left off. If you use the lye calculator without an account and choose to sign up to save your recipe, that recipe waits on your device until you sign in, and is then removed from it. None of this tracks you across other sites or is shared with anyone, which is why there is no cookie banner. Clearing your browser's site data removes it and signs you out.

Do Not Track and Global Privacy Control: we don't track you across other websites over time, we don't let anyone else do so through our site, and we don't sell or share your information for advertising. So there is nothing for those browser signals to turn off, and the Service works the same whether or not your browser sends them.

Emails

We send only the emails you ask for or need to use your account, such as confirming your email address when you sign up, resetting your password, and warning you before we delete an account nobody has used for 6 months. We don't send marketing email. If we ever do, every one will have an unsubscribe link, and we'll only send it if you agree.

Who can see it

Only you and the people you invite to your business, with the role you give them. Problem reports you send are seen only by you and by us, not by others in your business. We may look at your data only when needed to fix a problem you report, to keep the Service secure, or when the law requires it. To run the Service we also look at site-wide totals built from what we already store, such as how many accounts there are, how many signed in recently, and how many businesses use each part of the app. Those totals never show what's in your business.

Your choices: see, fix, export, or delete

You can see and correct your records in the app, and download everything in a business from Settings at any time. To delete your account and data, use "Delete my account" in Settings or email us. We'll confirm the request came from you, then delete it within 30 days, except for backups that expire on their own schedule and anything the law requires us to keep. If you own a business that others can open, deleting your account deletes that business's records for everyone, so export first. We delete an account with a tool that removes your sign-in, every business you own and everything in it, your place in other people's businesses, and your problem reports. Files you uploaded to those businesses, such as receipts and photos, are removed from storage by hand within the same 30 days.

How long we keep it

Your records stay as long as your account and business exist, so your books stay complete; you can delete entries yourself at any time. When you ask us to delete your account, we delete it within 30 days as described above. A sales channel's access key is deleted when you disconnect the channel. We record when you last used the Service. If nobody uses your account for 6 months, we email you a warning, and a last reminder 30 days later. Signing in at any point keeps your account. If you don't sign in within about 6 weeks of the first email, we may delete the account and everything in it, the same way as when you ask us to. Problem reports are kept with the business they came from. Our hosting providers keep technical logs and backups for a limited time on their own schedules, then delete them. Our own encrypted backups of the database are deleted after 90 days.

Security

Data is encrypted in transit and at rest by our providers, and each business's records are separated by database access rules. No system is perfectly secure, so keep your own backups. If a breach affects your data, we'll tell you as the law requires.

Children

The Service is for businesses and isn't meant for anyone under 18. We don't knowingly collect information from children under 13. If you believe a child has given us information, email us and we'll delete it.

Changes

When we change this policy we'll update the date above and ask you to accept it again before you continue.

Contact

Soap Workbench, LLC · Questions or requests: SoapWorkbench@gmail.com