Privacy notice
The short version
LevelPenny, a Carina Dataworks product, runs in your web browser. You need an account to use it. Your business profile, logo, jobs, estimates, invoices and customer details are kept on your device, in your browser's local storage, and while your free trial or subscription is active a copy is also kept on our servers (run by Cloudflare) so it can sync between your devices. Payments go through Stripe. We don't sell your data or use it for advertising.
What is stored, and where
- On your device: everything you enter — business profile and logo, saved jobs, estimates, invoices, customer names and contact details, your settings, whether you've completed the welcome tour, and that you accepted the Terms (with the date). If you sign in, also a sign-in token and sync status.
- Backups you download: a JSON file saved wherever you choose. You control it. Treat it as confidential: it contains your customers' details.
- Your account: your email address, whether you have confirmed it, a scrambled form of your password (a salted hash; we can't read your password), sign-in sessions (stored as a hash of the token), and your plan status (free trial, active or ended, and the dates). This is kept on servers run by Cloudflare, Inc., our hosting provider, under its own privacy policy.
- Email we send you: password-reset links and email-confirmation links are sent from levelpennyapp@gmail.com through Google (Gmail and Google Apps Script), so Google processes your email address and the message under its own privacy policy. The links are single-use; we store only a scrambled (hashed) form of each, and they expire (reset links after 1 hour, confirmation links after 3 days). During your free trial we also send two short reminders the same way, about 3 days before it ends and on the day it ends, unless you've already chosen a plan. We don't send marketing email.
- One free trial per email: so the free trial can't be restarted, we keep a one-way scrambled (hashed) form of the email address and the date its trial ends, even after an account is deleted. It can't be turned back into your email address, and nothing else is kept with it.
- Your synced data (while your free trial or subscription is active, and kept, locked, if the trial ends without a plan): the same business profile, saved jobs, estimates, invoices and customer details as on your device, plus the last few earlier copies as backups. Also stored with Cloudflare. We use it only to sync it to you; we don't look at it except when you ask us to help, or when the law requires it.
- Payments: handled securely by Stripe, Inc. No card is needed for the free trial. When you choose a plan you enter your card on Stripe's checkout page and your card details go straight to Stripe, so Carina Dataworks never sees or stores your card. We receive only your email, the plan you chose, the subscription status and its dates, and the Stripe customer and subscription IDs, so we can show your plan and help with billing. Stripe processes payments under its own privacy policy.
- Security: to stop password guessing, our servers count sign-in, sign-up and password-reset attempts per IP address and per email for a few minutes, stored in scrambled (hashed) form and deleted within a day. Cloudflare may keep short-lived request logs (such as IP address and time).
- Visit counting: we use Cloudflare Web Analytics to count page visits. It doesn't use cookies or track you across sites, and it never receives the data you type into the app.
- Not used: no advertising trackers and no cookies are used by the app. The only third-party script the app loads is that Cloudflare visit counter; it loads no third-party fonts.
Hosting
The app is hosted on Cloudflare Pages. Cloudflare may keep standard server logs (such as IP address, browser type and the time of the request) under its own privacy policy. Those logs do not include the data you type into the app.
Questions form
The Pricing page has an optional form for sending us a question. It asks for your email, whether you're considering monthly or yearly billing, and an optional note. Nothing is saved on your device. Submitting the form sends only those fields (plus the app name) to LevelPenny by email at levelpennyapp@gmail.com, and saves them in a private Google Sheet in that account. This runs through Google Apps Script, so Google processes your message under its own privacy policy. We use them only to reply to you. We don't sell them. Your jobs, documents and customer details are never part of a question. We keep questions until you ask us to remove them or we no longer need them. You can ask us to delete yours at any time.
Sending a question doesn't create an account or a subscription.
Payment links
If you add a “Pay online” link to your business profile, it is printed on your invoices. When your customer opens it, they leave this app and go to the payment provider you chose (for example Stripe, Square, PayPal or Venmo), whose own privacy policy applies.
Your customers' information
You are responsible for the customer information you enter and for having the right to use it. Protect your devices, your password and any backup files. If you sync, we store that information for you only to provide the Service.
Deleting your data
Delete individual jobs and documents in the app, or remove everything from a device by clearing this site's data in your browser settings. To delete your account, use Delete account on the Account page: it deletes your account, your synced data and its earlier copies from our servers right away, and cancels any subscription. Stripe keeps records of past payments as the law requires. Signing out lets you choose to keep or remove the synced copy on that browser. If a subscription ends we keep your synced data, so you can come back to it, until you delete your account or ask us to delete it.
Your rights
You can ask to see or delete a question you sent us by emailing levelpennyapp@gmail.com. We will do it within 45 days. Depending on where you live (for example California or Connecticut), you may have other rights under state privacy law; ask and we will help. We do not sell personal information or share it for advertising. You can download your data (Download backup, and Earlier cloud copies on the Account page) and delete it at any time, or email us and we'll do it within 45 days.
Children
The Service is a business tool and is not directed to children under 13. We do not knowingly collect information from them. If you think a child sent us a question, email us and we will delete it.
Changes
If this notice changes, we'll update the “Last updated” date above. If a change affects how we use account or synced data, we will tell account holders by email before it takes effect.
Contact
Questions about this notice, or to have a question you sent deleted: email levelpennyapp@gmail.com (LevelPenny, a Carina Dataworks product).