Privacy Policy

This Privacy Policy explains how Reckonen Inc. (“Reckonen”, “we”) collects, uses, and shares personal information when you visit https://www.reckonen.com, create an account, or use the Reckonen service (the “Service”). It also explains the choices and rights you have.

It applies to three kinds of people:

• Account holders — the trades business owners and team members who sign up and use the app. For your data, Reckonen is the “controller” / “business.”
• End customers — the people an account holder quotes, invoices, and reminds. If you received an invoice from a contractor through Reckonen, the contractor is the controller of your data and Reckonen processes it on their behalf as a “processor” / “service provider.” Direct requests about your data to the business that sent the invoice; we will help them respond.
• Visitors — anyone browsing our public website or a hosted invoice or quote page.

Information you give us

• Account: name, email address, password (hashed by our authentication provider; we never see it), phone number.
• Business profile: business name, address, phone, logo, timezone, tax and late-fee defaults, follow-up schedule.
• Customer Data you enter about your customers: names, company, emails, phone numbers, service addresses, contacts, notes, quotes, jobs, invoices, line items, payment records, and photos you upload of job sites.
• Communications: messages you send us for support and messages you compose to your customers through the Service.

Information from payments

• Stripe onboarding: to enable payouts, Stripe collects identity details (legal name, date of birth, SSN/EIN, address, bank account) directly in an embedded Stripe form. That information goes to Stripe, not to Reckonen; we receive only status flags (e.g. “charges enabled,” “requirements due”) and your Stripe account ID. See Stripe’s Privacy Policy.
• Invoice payments: when an end customer pays, card or bank details are entered on Stripe-hosted pages and never touch our servers. We receive the payment amount, status, last-4/brand for display, and the payer’s email if provided.
• Your subscription: your subscription payment method is stored by Stripe; we store a Stripe customer ID and subscription status.

Information collected automatically

• Log and device data: IP address, browser and OS, pages viewed, timestamps, referring URL, and error reports, kept in server logs for security and debugging.
• Document events: when a hosted invoice or quote is opened, we record the time so the sender can see it was viewed.
• Cookies: see the Cookie Policy. We currently set only strictly-necessary cookies. Analytics or marketing cookies would be set only with your consent via the banner.

We do not collect precise geolocation, biometric data, or data about children. We do not use facial recognition on uploaded photos.

We use personal information to:

• provide the Service: create and send quotes and invoices, schedule jobs, store records, process payments through Stripe, and send follow-up reminders you configure;
• send transactional messages on your behalf to your customers (invoice, quote, reminder, receipt emails and, if enabled, text messages);
• operate your account: sign-in, security alerts, billing, support, and notices about changes to the Service or these terms;
• keep the Service secure: detect fraud, abuse, and unauthorized access; enforce our Terms;
• understand and improve the Service, using aggregated or de-identified data where possible;
• comply with law, including tax, accounting, and lawful requests from authorities.

What we don’t do. We do not sell personal information. We do not “share” it for cross-context behavioral advertising. We do not use Customer Data to market to your customers, to train machine-learning models, or for any purpose other than providing the Service to you. We do not send you marketing email without an opt-in, and every marketing email has an unsubscribe link.

We share personal information only with:

• Service providers (subprocessors) who process it on our instructions under contracts that limit their use — listed below.
• Stripe, as an independent controller for payment processing, identity verification, and fraud prevention. When you connect an account you also agree to Stripe’s terms.
• Your customers — your business name and contact details appear on documents you send them, and payer details you enter appear on their invoice.
• Your team — users you invite to your business see its data.
• Authorities or others when legally required — to comply with law, protect rights and safety, or enforce our Terms. We will notify you of requests for your data unless prohibited.
• A successor in a merger, acquisition, or asset sale, subject to this Policy and with notice to you.

Subprocessors

We will update this list and, for account holders with a Data Processing Addendum, give 30 days’ notice before adding a subprocessor that handles Customer Data.

We set only strictly-necessary cookies today (sign-in session, security, and the record of your cookie choice). Analytics or marketing cookies would be set only after you opt in through the consent banner, which offers Accept all, Reject non-essential, and per-category controls with equal prominence. The full list, by name, is in the Cookie Policy.

Your choice is stored for 180 days. You can change or withdraw it at any time — withdrawing is as easy as consenting:

We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months. Because the CCPA/CPRA gives California residents the right to opt out anyway, this page and the banner’s “Marketing / sharing” toggle serve as that opt-out and are honored if our practices ever change. We also honor the Global Privacy Control signal automatically.

To record or change your preference, reset the banner below and choose “Reject non-essential” or turn off “Marketing / sharing.” Authorized agents may submit requests to support@withholden.com.

• Account and Customer Data: for as long as your account is open. After you close it (or 60 days after a suspension for non-payment) we delete it within 90 days, except as below.
• Invoices and payment records: retained for 7 years to meet tax and accounting obligations, then deleted.
• Server logs: 30 days. Backups: rolling, purged within 35 days.
• Support correspondence: 2 years after the ticket closes.
• Consent records (cookie choices, marketing opt-ins): as long as needed to demonstrate compliance.

Where we no longer need personal information we delete or de-identify it.

All traffic is encrypted in transit (TLS 1.2+) and data is encrypted at rest by our hosting providers. Access to production systems is limited to personnel who need it and protected by multi-factor authentication. Passwords are hashed with a modern algorithm; magic links and email confirmations expire. Payment card and bank details are handled exclusively by Stripe, a PCI DSS Level 1 service provider. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you and any applicable regulator without undue delay and within the timeframes required by law.

Regardless of where you live, you can:

• Access and export your data from the app at any time (PDF and CSV).
• Correct business, account, and customer records directly in the app.
• Delete your account from Settings, or ask us to at support@withholden.com.
• Control cookies via Cookie preferences in the footer and your browser settings.
• Opt out of marketing with the unsubscribe link in any marketing email. Transactional messages (receipts, security notices) continue while you have an account.

To exercise a right you cannot handle in-app, email support@withholden.com. We will verify the request using your account email (or, for end customers, the details on the document you received) and respond within 30 days (45 for California residents, extendable once with notice). You may use an authorized agent; we will ask for proof of authorization. We will not discriminate against you for exercising your rights.

End customers: the contractor who invoiced you controls your data. Contact them first; we will support their response. If you contact us directly we will forward your request to them.

This section is our Notice at Collection and supplements the rest of this Policy for California residents.

Your California rights: to know what we collect and how it is used and shared; to delete; to correct; to opt out of sale or sharing; to limit use of sensitive personal information; and to non-discrimination. We do not sell or share personal information as those terms are defined by the CPRA, and we have not in the preceding 12 months. We use sensitive personal information only to provide the Service. We honor Global Privacy Control browser signals as an opt-out of sale/sharing. You may also use the Do Not Sell or Share My Personal Information link in the footer.

To submit a request: email support@withholden.com. Retention periods are in Section 5. We do not knowingly collect information from anyone under 16.

Reckonen is US-based and built for US trades businesses, but if GDPR or UK GDPR applies to you, this section explains the additional details.

Legal bases

• Contract (Art. 6(1)(b)) — account, business profile, Customer Data, payments, transactional messages: needed to provide the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — security logs, fraud prevention, aggregated product analytics, and service notices. You may object at any time.
• Consent (Art. 6(1)(a)) — non-essential cookies and marketing email. Withdraw any time via the footer link or unsubscribe.
• Legal obligation (Art. 6(1)(c)) — tax and accounting retention, responding to lawful requests.

Your rights

Access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal effect (we make none). To exercise them, email support@withholden.com. You also have the right to lodge a complaint with your local supervisory authority.

International transfers

Data is processed in the United States. Where we transfer personal data from the EEA, UK, or Switzerland we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) with our subprocessors, plus supplementary measures such as encryption. Copies are available on request.

Processor terms

For Customer Data, Reckonen acts as your processor. Our Data Processing Addendum — which incorporates the Article 28 terms, the subprocessor list above, and the SCCs — is available on request at support@withholden.com and is deemed part of the Terms for accounts subject to GDPR.

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18 (or under 16 in California). If you believe a child has provided us information, email support@withholden.com and we will delete it.

We may update this Policy as the Service or the law changes. We will post the new version here with a new effective date and, for material changes, notify account holders by email or in the app at least 30 days before they take effect.

Privacy questions and requests: support@withholden.com. We are Reckonen Inc., a US company; we do not publish a physical mailing address and handle all requests by email. If you are in the EEA or UK and need our representative’s details, email the address above.