Privacy

This Privacy Policy describes how Scopivo (“Scopivo,” “we,” “us”) collects, uses, and shares information when you use scopivo.com and the Scopivo web application (the “Service”).

1. The data we collect

Account information. When you sign up we collect your name, email, password (stored as a hash through Firebase Authentication), organization name, profession, timezone, and industry.

Content you put into Scopivo. Client records, proposals, contracts, invoices, projects, time entries, expenses, deliverables, templates, uploaded files (logos, receipts), bookings, and form submissions.

Payment information. If you upgrade to Pro, billing details (card brand, last four digits, billing address) are collected and stored by Stripe, our payment processor. We never receive your full card number.

Stripe Connect details. If you connect your own Stripe account so your clients can pay you through Scopivo, the Stripe account ID and connection state are stored on your organization. The actual payments and payouts flow through Stripe; we never hold the funds.

Usage and device data. When you use the Service we log the pages you visit, the actions you take (creating a proposal, sending an invoice, etc.), browser, operating system, viewport size, and an SHA-256 hash of your IP address (we never store the raw IP). Pageview and session records auto-delete after 90 days via a Firestore time-to-live policy.

Activity logs. Each meaningful action (proposal sent, contract signed, invoice paid, etc.) is recorded for the organization that owns it so the dashboard can show recent activity. These records auto-delete after 90 days.

Email-failure records. If an outbound email bounces or is rejected by the recipient's server, we record the entity and the error so you can see what happened. We don't log the body of any client-facing email.

Cookies. A session cookie keeps you signed in. A small cookie stores your theme preference. An analytics session cookie (24-hour expiry) lets us count distinct visitors without identifying you. See the Cookie Policy for details.

2. How we use the data

• To provide the Service to you (showing your data back to you, sending invoices to your clients, processing your subscription).
• To secure the Service (rate limiting, bot protection, fraud prevention).
• To improve the Service (anonymous, aggregated usage analytics; we can see “X people sent a proposal today” not “Amjad sent his client a proposal at 9:43 AM”).
• To communicate with you about your account, billing, security, and material product changes.
• To comply with legal obligations.

We do not sell your personal data. We do not use your client lists, proposals, contracts, invoices, or any other Content to train machine-learning models. We do not run advertising and do not share your data with advertising networks.

3. Google Workspace integration

If you choose to connect your Google account in Settings → Integrations, Scopivo requests permission to access specific Google data on your behalf through Google's OAuth consent flow. We request only the narrow scopes required for the integrations you enable, and you can disconnect at any time.

Scopes Scopivo requests:

• Email (userinfo.email): we read your primary Google account email address so the integrations panel can show “Connected as you@example.com.” We never email this address through Google's services.
• Calendar (calendar.events): if you enable Calendar sync, Scopivo inserts, updates, and deletes events on your primary calendar (or a calendar you choose) for invoice due dates, proposal expirations, and project deadlines. Scopivo writes events one-way; we never read events you have created in your calendar.
• Drive (drive.file): if you enable Drive sync, Scopivo creates a “Scopivo” folder in your Drive and writes signed proposals, signed contracts, and paid invoices as PDFs into that folder. The drive.file scope is narrow: Scopivo only sees files it created.
• Sheets (spreadsheets): if you enable Sheets sync, Scopivo creates a “Scopivo CRM” spreadsheet in your Drive and refreshes its tabs with your clients, invoices, and time entries on every change. We never read other spreadsheets in your account.

How tokens are stored. Scopivo stores a Google OAuth refresh token, encrypted with AES-256-GCM using a key held in Google Cloud Secret Manager. The encrypted token lives in our Firestore database alongside the rest of your organization record. Access tokens (short-lived) are cached in memory only and never persisted.

Disconnecting. You can disconnect Google from Settings → Integrations at any time. On disconnect, Scopivo revokes the OAuth tokens with Google and deletes the encrypted refresh token from our database. Files and events already written to your Google account remain in your account; we do not reach in to delete them.

Limited Use compliance. Scopivo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace data for advertising, do not transfer it to third parties except as necessary to provide and improve the user-facing features of Scopivo, and do not allow humans to read it except as necessary for security, compliance, or with your explicit consent.

4. Sub-processors we share data with

We use third-party service providers (“Sub-processors”) to operate the Service. They process data on our behalf under written agreements consistent with this Policy. Our current Sub-processors:

• Google Cloud / Firebase (USA) — hosting, databases, authentication, file storage. Your account and Content are stored in Google's us-central1 region.
• Stripe (USA) — processes our subscription payments and powers Stripe Connect, which handles client-to-you payments.
• Resend (USA) — transactional email delivery (proposals, contracts, invoices, account emails).
• Cloudflare Turnstile (USA) — bot challenges on public forms (waitlist signup, public booking, intake forms). Turnstile is privacy-friendly and does not use cookies.

We may also share data when required by law, in response to a valid legal process, to protect our rights, or in connection with a merger, acquisition, or sale of assets (we'll notify you before that happens).

5. International data transfers

Our Sub-processors are based in the United States. If you access the Service from outside the United States, your data will be transferred to and processed in the U.S. We rely on Standard Contractual Clauses (or equivalent transfer mechanisms) where required.

6. Data retention

We keep your account and Content for as long as your account exists. When you delete your account, we permanently remove your data, including from production databases and Cloud Storage, within a few days. Activity logs and pageview records auto-delete after 90 days regardless of account status. We do not maintain backups of deleted accounts.

7. Your rights

Depending on where you live, you may have rights under privacy laws such as the EU/UK GDPR or the California CCPA. These typically include:

• Access and export of your data. From Settings → Account you can download a JSON file with everything we hold about your organization.
• Deletion. Delete your account permanently from the same Settings page; this wipes your Content and revokes your authentication record.
• Correction — edit anything in the dashboard directly, or email us if something can't be edited inline.
• Objection / restriction for specific types of processing, where applicable.
• Right to lodge a complaint with a data protection authority where you live.

To exercise these rights or ask questions, email hello@scopivo.com. We'll respond within 30 days.

8. Children's privacy

The Service isn't intended for children under 16. We don't knowingly collect personal data from anyone under 16. If you become aware that a child has provided us with personal data, contact us and we'll delete it.

9. Security

We use reasonable administrative, technical, and physical measures designed to protect your data: passwords hashed by Firebase Auth, TLS in transit, encryption at rest by Google Cloud, IAM controls on production data, rate limiting on unauthenticated and public-portal endpoints, signed-URL access to file uploads (logos, receipts, deliverables), AES-256-GCM encryption of stored third-party integration tokens, Cloudflare Turnstile bot protection on public forms, and a content security policy on the web app. No system is perfectly secure; if we ever discover a breach affecting your data, we'll notify you without undue delay as required by applicable law.

10. Changes to this Policy

We may update this Policy as the Service evolves. The “Last updated” date at the top of this page reflects the latest revision. For material changes, we'll notify you through the Service or by email at least 14 days before they take effect.

Contact

Privacy questions, data requests, or anything else: email hello@scopivo.com.