Privacy Policy
Effective August 23, 2026. Applies to surewright.app, app.surewright.app and the SureWright mobile app.
SureWright is a product of ProofWright LLC (“SureWright”, “we”, “us”). SureWright is software that small home-service businesses (“operators”, “you”) use to manage customers, schedule visits, send quotes and invoices, and collect payments. This policy explains what data we handle, why, and what you can do about it. It is written in plain language on purpose.
1. Two kinds of people
Operators create a SureWright account and run their business in it. Customers are the operator’s clients, whose details the operator enters into SureWright. If you are a customer of a business that uses SureWright, that business controls your data and this policy describes how we process it on their behalf. Contact the business first; contact us if you cannot reach them.
2. What we collect
From operators
- Account details: name, business name, email address, phone number, password (stored as a one-way hash), time zone and language.
- Business records you create: customers, properties, plans, jobs, visits, quotes, invoices, notes and photos.
- Billing for your SureWright subscription, handled by Stripe. We store the subscription status and the last four digits and brand of the card, never the full card number.
- Device and usage data: device type, app version, IP address, crash reports and which screens you use, so we can fix what breaks.
About customers (entered by the operator)
- Name, email address, phone number, service address and access notes (for example a gate code).
- Quote approvals and signatures, with the time and IP address of the approval.
- A payment method on file, stored by Stripe as a token. SureWright never sees or stores full card numbers or bank account numbers.
- Payment history: what was charged, when, and for which visit.
3. Google user data (Gmail)
An operator can connect a Google account so that quotes, invoices and receipts are sent from the operator’s own Gmail address instead of from a SureWright address. This section applies only if you choose to connect Google.
| What | Detail |
|---|---|
| Scope requested | https://www.googleapis.com/auth/gmail.send (“Send email on your behalf”), plus your basic profile (name, email address) to show which account is connected. |
| What we access | The ability to send an email from your address. We do not read, list, search, modify or delete any message in your mailbox. We never request a Gmail read scope. |
| Why | So the quote or invoice you send a customer comes from you, lands in their inbox as a normal email from you, and their reply goes to you. |
| What we store | Your connected email address, an encrypted OAuth refresh token, and a log of each message SureWright sent (recipient, subject, time, and the message ID Google returned). We do not store message bodies beyond the quote or invoice you already created in SureWright. |
| Who sees it | Only the operator who connected the account, through the SureWright app. Our staff access it only to investigate a problem you report, for security, or when the law requires. |
| Sharing | We do not sell Google user data. We do not use it for advertising. We do not share it with any third party except our hosting and email-delivery infrastructure needed to perform the send you asked for. |
| Retention | The token is kept until you disconnect Google in Settings, revoke access at myaccount.google.com/permissions, or delete your account. On disconnect we delete the token immediately. Send logs are deleted within 30 days of account deletion. |
SureWright’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular: we only use Google user data to provide the email-sending feature you turned on; we do not transfer it to others except as needed to provide that feature, to comply with law, or as part of a merger or acquisition with notice to you; humans do not read it except with your consent, for security, to comply with law, or for internal operations where the data has been aggregated and anonymized; and we never use it for advertising, credit-worthiness or lending.
4. Microsoft user data (Outlook / Microsoft 365 mail)
The same feature is available for Microsoft accounts. We request the Mail.Send permission and your basic profile, and nothing that reads your mailbox. Everything in section 3 about what we store, who sees it, sharing and retention applies equally. Revoke access at any time in SureWright Settings or at myaccount.microsoft.com.
5. Accounting sync (QuickBooks Online, Xero)
If you connect QuickBooks Online or Xero, SureWright copies your customers, invoices and payments into your accounting file so you do not type them twice, and reads back payment status so both systems agree. We store an encrypted OAuth token, your company ID, and the ID mapping between SureWright records and accounting records. We do not read your bank feeds, payroll, or reports. Disconnect at any time; the token is deleted immediately and the mapping within 30 days.
6. Payments (Stripe)
Card and bank payments are processed by Stripe. Each operator has their own Stripe account connected to SureWright and is the merchant on every charge. Card details go directly from the customer to Stripe; SureWright stores only a token, the card brand and last four digits. Stripe may collect identity information from operators as required by financial regulation; that collection is governed by Stripe’s own privacy policy and services agreement.
7. Text messages (Twilio)
When SMS features launch, appointment reminders, quote links and invoice links may be sent by text message through Twilio. Customers can reply STOP to any message to opt out and HELP for help. Message and data rates may apply. We store the phone number, the message text, and delivery status. We do not sell phone numbers or use them for marketing unrelated to the operator’s business.
8. Who we share data with
We do not sell personal data. We share it only with the providers below, each under a contract that limits them to providing their service to us:
- Supabase (database and file storage) and Vercel (hosting), in the United States.
- Stripe for payments and subscription billing.
- Google and Microsoft for sending email from your address, only if you connect them.
- Intuit (QuickBooks) and Xero for accounting sync, only if you connect them.
- Twilio for text messages, when that feature is available and enabled.
- Law enforcement or courts when legally required, and a successor business in a merger or sale, with notice to you.
9. Security
Data is encrypted in transit (TLS) and at rest. OAuth tokens are encrypted with a key separate from the database. Access to production systems is limited to people who need it and is logged. Each operator’s data is isolated from every other operator’s by database-level rules. No system is perfectly secure; if we learn of a breach affecting you, we will tell you without undue delay.
10. Retention and deletion
We keep your data while your account is active. When you delete your account, or ask us to, we delete your personal data and your customers’ personal data within 30 days, except records we must keep for tax, accounting, anti-fraud or legal reasons (for example payment records, which Stripe and we retain as required by law). Backups are overwritten on a rolling schedule of no more than 35 days. To delete your account, use Settings in the app or email us.
11. Your choices and rights
- See, correct, export or delete your data from Settings, or by emailing us.
- Disconnect Google, Microsoft, QuickBooks or Xero at any time from Settings.
- Opt out of text messages by replying STOP.
- If you live somewhere with a privacy law that gives you additional rights (for example California, the EU or the UK), you can exercise them by emailing us. We will not discriminate against you for doing so.
12. Children
SureWright is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.
13. Changes
If we change this policy in a way that matters, we will email operators and show a notice in the app before the change takes effect. The date at the top is the date the current version took effect.
14. Contact
ProofWright LLC, Florida, United States.
Email: support@proofwright.ai