Privacy Policy

1. Introduction

This Privacy Policy describes how BorstPhoto, LLC (“we,” “us,” or “our”) collects, uses, and protects information in theOddStack, the business-management software (CRM) we build and host for our own businesses and for client businesses (“theOddStack”). It covers in particular the information theOddStack receives when a user connects a Google account. Use of any other service we operate is governed by the policy listed for that service.

2. Google Account Data We Access

theOddStack accesses a Google account only when a user chooses to connect it, and only with the permissions shown on Google’s consent screen:

• Gmail, read-only (“gmail.readonly”): used by the receipt inbox feature. theOddStack reads only messages that carry the label the user sets for receipts (by default “Receipts”) and that arrived within a recent window (30 days by default). For each such message it reads the message text and any PDF attachment. It does not read other messages, send email, or change, label, or delete anything in the mailbox.
• Google Calendar (“calendar.events” and “calendar.readonly”): used by the calendar feature. theOddStack reads events from the connected calendar so they appear in the CRM calendar, and adds events the CRM schedules, such as bookings and filing deadlines, to that calendar.
• Basic account information (“openid” and “email”): the email address of the connected Google account, used to label the connection.

3. How We Use Google User Data

• From a receipt email, theOddStack extracts the vendor, amount, date and a suggested expense category, and creates a draft expense with the receipt PDF attached for the user to review.
• Calendar events are shown in the CRM calendar and kept in step with the connected Google Calendar.
• We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve, or train generalized artificial intelligence or machine-learning models.

4. Limited Use

theOddStack’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Service Providers

We share Google user data only with the service providers that run theOddStack, and only as needed to provide the features above:

• Anthropic: the text and PDF of a receipt email are sent to Anthropic’s Claude service to extract the receipt’s details.
• Supabase: hosts the CRM’s database and private file storage.
• Netlify: hosts the application.

We may also disclose information when required by law.

6. Storage and Security

Google sign-in tokens are encrypted at rest (AES-256-GCM) and are never sent to the browser. Draft expenses, receipt PDFs and calendar events are stored in the CRM’s database and private file storage, and are available only to the signed-in staff of the business that uses the CRM. Data is transmitted over encrypted (HTTPS) connections.

7. Retention and Deletion

• A receipt inbox can be removed at any time in Settings → Receipt Inboxes. Removing it deletes its saved Google sign-in, and no further messages are read.
• Google Calendar can be disconnected in Settings → Calendar → Google Calendar. Disconnecting deletes its saved Google sign-in.
• Access can also be revoked at any time from your Google Account at myaccount.google.com/permissions.
• Draft expenses and calendar events created in the CRM are kept as part of the business’s records until the business deletes them. To ask us to delete data, contact us using the details below.

8. Children

theOddStack is business software and is not directed to children under 13. We do not knowingly collect information from children.

9. Changes to This Policy

We may update this policy from time to time. The date at the top shows when it was last changed.

10. Contact Us

For questions about this policy or to make a privacy request, contact us at: