Privacy Policy

This Privacy Policy explains how Linchpin Software LLC ("Linchpin," "we," "us") collects, uses, and protects information when you use Linchpin (the "Service").

1. Information we collect

• Account information: your name, email, phone number, business name, and contact details.
• Business data you enter: clients, invoices, appointments, inventory, receipts and receipt images, contractor records, and payment logs.
• Payment information: processed by Stripe. We do not store full card numbers; Stripe handles card data under its own security and compliance.
• Contractor tax information: when you collect a contractor's W-9, their tax identifier (SSN/EIN) is entered directly into our filing partner's (Track1099/Avalara) hosted form and is not stored in Linchpin's own database; we store only limited references and status. When you file 1099s, you enter your own business's EIN into a Linchpin form, which we relay directly to Track1099/Avalara to register you as the filer — we do not store it in our database, but it does pass through our servers in that request.
• Support content: messages you send to our support assistant.
• Usage & technical data: log data, IP address, and basic device information used to operate and secure the Service.
• Product analytics: privacy-friendly event counts (for example, that someone started signup or created an invoice). We do not send invoice contents, client names, emails, dollar amounts, or receipt text to our analytics provider.

We do not store sensitive personal information (Social Security Numbers, government IDs, financial account numbers, health, biometric, or precise location data) in our database — the one exception is your own business's EIN if you file 1099s, described above, which passes through our servers but is not stored — and we do not collect information about you from third-party sources.

2. How we use information

• To provide, maintain, and improve the Service.
• To process payments and manage subscriptions.
• To send transactional email (confirmations, invoices, receipts, notices).
• To provide support and answer questions.
• To secure the Service, prevent abuse, and comply with law.
• To track internal usage and business metrics (for example, our own MRR/KPI reporting).

We do not sell your personal information.

3. Service providers (subprocessors)

We share information only as needed with providers that help us run the Service, including:

• Supabase — database, authentication, file storage
• Vercel — application hosting
• Stripe — payment processing and subscription billing
• Track1099 / Avalara — W-9 collection and 1099 e-filing
• Google Cloud Vision — receipt image scanning (OCR) to extract vendor, date, and amount from uploaded receipts
• Resend — sending and receiving email
• OpenAI — powers our support chat assistant, and suggests an expense category for uploaded receipts based on the vendor, amount, and scanned receipt text
• Umami — privacy-friendly product analytics (page views and named events without advertising profiles)

These providers process data on our behalf under their own security and privacy commitments. We disclose information to these providers as needed to run the Service; we do not sell or share it for advertising purposes.

4. AI-powered features

We offer three features powered by third-party AI: a support chat assistant (OpenAI) that answers your questions about using Linchpin; receipt scanning (Google Cloud Vision) that reads text from uploaded receipt images to auto-fill vendor, date, and amount; and receipt category suggestions (OpenAI), which send the scanned vendor, amount, and up to 500 characters of the receipt's scanned text to suggest an expense category you can edit or override. Your inputs to these features (chat messages, receipt images, scanned receipt text) are shared with the relevant provider solely to deliver that feature.

5. Cookies

We use an essential cookie to keep you securely logged in (managed by Supabase Auth). We also use a first-party cookie only if you opt out of product analytics (lp_analytics=off), so we remember that choice on this browser.

When analytics is enabled, we load a privacy-friendly analytics script from Umami. It does not set advertising cookies, does not sell your data, and is configured to honor Do Not Track. You can turn analytics off anytime in Settings (or by setting the opt-out cookie above). We do not use advertising pixels, and we do not permit third parties to track you for ads on our Service.

Operators can also disable analytics entirely with an environment kill switch (NEXT_PUBLIC_ANALYTICS_ENABLED=off) or by leaving the Umami website id unset.

6. How we protect information

Data is encrypted in transit. Each account's data is isolated using row-level security, and uploaded files (receipts, logos) are stored in private storage accessible only to the owning account. Sensitive tax identifiers are routed to our filing partner rather than stored by us. No system is perfectly secure, but we take reasonable measures to protect your information.

7. Data retention

We retain your data for as long as your account is active, or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion of your account and associated data (subject to legal retention requirements) by contacting us — see "Contact" below.

8. Your rights

Depending on where you live (for example, under the California CCPA/CPRA, other US state privacy laws, or the EU/UK GDPR), you may have rights to access, correct, delete, or export your personal information, and to object to certain processing. The easiest way to exercise these rights is by visiting uselinchpin.com/support or emailing us at the address below. If we decline a request, you may appeal by emailing the same address; we'll respond in writing. If you are a California resident, you may also request, once a year and free of charge, information about any personal data we've disclosed to third parties for direct marketing purposes under California's "Shine the Light" law — we do not use your data for direct marketing, so this disclosure is currently empty.

9. Children

The Service is intended for adults running a business and is not directed to anyone under 18. We do not knowingly collect information from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date above, and we'll notify active accounts by email when the changes are material.

11. Contact

Questions or requests? Email our Data Protection Officer at support@uselinchpin.com, or write to us at 230 Wagner St, Troutman, NC 28166, United States.