Privacy Policy

Paint Portal, a trade name of Boma Digital Inc., a corporation located in Corunna, Ontario, Canada ("Company," "we," "us," or"our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Paint Portal application and related services (the "Service").

1. Information we collect

1.1 Information you provide directly

• Account information — name, email address, phone number, and organization details when you create an account.
• Business data — project information, client details, estimates, invoices, schedules, time entries, production logs, equipment records, and other data you enter into the Service.
• Financial information — when connecting Stripe for payment processing or QuickBooks for accounting, authentication tokens are stored securely. We do not store your bank account numbers, credit card numbers, or payment credentials directly.
• Communications — messages sent through the client portal, email notifications, and support inquiries.
• Photographs and files — project photos, documents, and attachments you upload.

1.2 Information collected automatically

• Usage data — pages visited, features used, and actions taken within the Service.
• Device information — browser type, operating system, device type, screen resolution.
• Log data — IP address, access times, and referring URLs.
• Location data — GPS coordinates when using location-based features (for example attendance check-in or equipment GPS tracking), only with your explicit permission.
• Push notification tokens — Firebase Cloud Messaging (FCM) device tokens when you enable push notifications, linked to your user account to deliver real-time alerts.

1.3 Information from third-party integrations

When you connect third-party services, we may receive:

• QuickBooks Online — customer lists, vendor lists, product/service catalogs, and invoice data (only when you explicitly initiate a sync).
• Stripe — payment status, payout information, and subscription details.
• Google Authentication — email address and profile name (via Firebase Authentication).

1.4 QuickBooks Online — detailed data disclosure

When you connect your QuickBooks Online account, the following access is granted via Intuit's OAuth 2.0 authorization:

Read access (pulled from your QuickBooks account): customer records (name, email, phone, billing address); vendor records (name, contact information); items/services catalog (names, descriptions, rates); invoice records (number, amounts, line items, status); payment records (date, amount, method, linked invoice).

Write access (pushed to your QuickBooks account): invoice creation and updates synced from Paint Portal; payment recording when payments are received through Paint Portal; customer creation when new clients are added in Paint Portal.

How this data is used: QuickBooks data is stored within your organization's isolated database scope and is never shared across organizations. Synchronization occurs only when you initiate a sync or enable automated sync. We do not access your QuickBooks bank data, payroll data, tax filings, or anything beyond the scopes above.

Data deletion: when you disconnect QuickBooks, the OAuth tokens are immediately revoked and deleted. Previously synced records remain in your Paint Portal account unless you delete them. You may request complete deletion of all QuickBooks-sourced data by contacting support@trypaintportal.com.

1.5 Information about your clients and employees

Much of the data in Paint Portal is information your business enters about other people — your clients (names, contact details, project information, portal messages) and your employees or subcontractors (pay rates, time entries, location check-ins). For that data, we act as a service provider, processing it on your business's behalf and under its instructions to provide the Service. Your business is responsible for having the necessary consent or legal basis to collect and use it — including consent from crew members for location-based features and from clients for the communications you send them.

If you are a client or employee of a business that uses Paint Portal, your relationship is with that business — contact them first about their data practices, and we will support their response. You may also contact us directly at support@trypaintportal.com.

1.6 Text messages (SMS)

Businesses that use Paint Portal can send their own clients text messages about that client's job — for example, that a quote is ready, appointment reminders, that the crew is on the way, payment receipts, and a request for a review after the job. A client's mobile phone number and their text-message consent are recorded by the business; texts are only sent to clients the business has marked as opted in (see our text message program page). We use mobile numbers and consent records only to send these job messages and to honour opt-outs. Replying STOP to any message opts that number out; replying HELP returns contact information. Message frequency varies (usually 2–6 messages per job). Message and data rates may apply.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories of sharing described in this policy exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties, except with our SMS delivery provider (Twilio) solely to deliver the messages.

2. How we use your information

We use your information exclusively to:

• Provide and operate the Service — project management, estimating, scheduling, invoicing, and financial tracking.
• Process transactions — payment processing via Stripe and accounting sync via QuickBooks.
• Send transactional communications — quote notifications, invoice reminders, appointment confirmations, and system notifications.
• Improve the Service — analyze usage patterns to improve features, fix bugs, and optimize performance.
• Provide customer support — respond to your inquiries and resolve issues.
• Ensure security — detect, prevent, and address fraud, abuse, or technical issues.

3. What we do NOT do with your information

• We do not sell your personal or business data to any third party.
• We do not share your data with advertisers, data brokers, or third-party AI services.
• We do not use your data for targeted advertising.
• We do not provide your data to competitors or industry aggregators.
• We do not expose your individual financial information, client lists, or pricing data to other users.

How we use anonymized data to improve the Service: we may analyze anonymized, aggregated data — from which no individual user or business can be identified — to improve the Service, develop features, build industry benchmarks, and train models that benefit all users (such as smarter cost estimates or suggested line items). Your individual business data is never exposed, attributed, or traceable in these analyses.

4. Third-party services and data sharing

We share your information with third-party services only as necessary to provide the features you have explicitly enabled:

Each provider maintains its own privacy policy. We encourage you to review them: Google Cloud Privacy Notice, Stripe Privacy Policy, and Intuit Privacy Policy, and Twilio Privacy Notice.

We also use two operational services to keep the Service reliable: Sentry (error monitoring) receives technical error reports including device information and your account identifiers (user ID and email address) so we can investigate issues affecting your account; screen recordings of error sessions have text content masked before capture. Google Analytics receives aggregate usage data to help us understand how the Service is used — you can decline analytics via the cookie banner. Neither service receives your business content (projects, clients, financials).

5. Data storage and security

Your data is stored on Google Cloud Platform (Firebase) servers located in the United States. We implement industry-standard security measures including:

• Encryption in transit — all data between your device and our servers is encrypted using TLS 1.2+.
• Encryption at rest — data stored in Firestore and Cloud Storage is encrypted at rest by Google.
• Authentication — Firebase Authentication with support for email/password and OAuth providers.
• Access controls — role-based access control with organization-level data isolation.
• Server-enforced security rules — Firestore and Storage rules prevent unauthorized data access, verified by an automated test suite on every change.
• Input validation — server-side validation on all API endpoints.
• CORS protection — origin allow-listing on our web endpoints.

Despite these measures, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. For a plain-English overview, see our security page.

6. Data retention

• Active accounts — your data is retained for as long as your account is active.
• Deleted accounts — upon account deletion we delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as financial records for tax compliance).
• Backups — backup copies may persist for up to 90 days after deletion.
• Location traces — GPS traces collected by location-based features are automatically deleted after 90 days.

7. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, port, object to, or restrict processing of your personal data. To exercise any of these, contact support@trypaintportal.com. We respond within thirty (30) days. For portability requests, we provide your data in a commonly used, machine-readable format (such as CSV or JSON).

8. Children's privacy

Paint Portal accounts are for adults: you must be at least 18 to create an account. Employers may keep ordinary employment records (such as time entries) about crew members under 18 where employment law permits; those records are the employer's responsibility (see Section 1.5). We do not knowingly collect personal information directly from children, and will delete it promptly if we learn we have.

9. Cookies and tracking

We use minimal cookies and local storage for authentication (Firebase session tokens) and preferences (theme, recent searches, UI settings stored locally via localStorage). Where Google Analytics is enabled, a first-party analytics cookie measures aggregate usage — you can decline it via the cookie banner. We do not use advertising pixels or cookies that track you across other websites.

10. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, used, shared, or sold; to correct inaccurate personal information; to delete personal information; to opt out of the sale or sharing of personal information (we do not sell or share personal information); to limit the use of sensitive personal information — precise geolocation collected by location features is used only to provide those features and can be disabled; and to non-discrimination for exercising these rights.

11. International data transfers

Your data is primarily stored on Google Cloud Platform servers in the United States. If you access the Service from Canada or elsewhere, your data may be transferred to and processed in the United States. We ensure such transfers comply with applicable laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

12. Canadian privacy rights (PIPEDA)

If you are in Canada, you have the right to access your personal information, to challenge its accuracy and have it amended, to withdraw consent (subject to legal or contractual restrictions), and to file a complaint with the Office of the Privacy Commissioner of Canada. We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate, with your knowledge and consent.

13. Data breach notification

If a security breach results in unauthorized access to or loss of your personal information, we will notify affected users as soon as reasonably practicable — by email and, where feasible, an in-app notice — describing the incident, the information affected, our response, and steps you can take to protect yourself. Where required by law, we will also report the breach to the relevant regulators (including the Office of the Privacy Commissioner of Canada) and keep records of the incident.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will note material changes by updating the "Last updated" date and, where feasible, by notice through the Service or email. Continued use after changes constitutes acceptance of the revised policy.

15. Contact us

See also our Terms of Service andguarantee.