Privacy policy

Who we are and what this covers

Smart Business HQ is a service of The Coverdale Group LLC, 732 S. 6th St., Ste. V, Las Vegas, NV 89101, USA. In these pages "we", "us" and "our" mean The Coverdale Group LLC, and "you" means the person using the site or the service and, where you act for a business, that business too.

This policy covers the website, the board designer on it, booking a meeting, the emails we send, and the private dashboard (your "board") we build and run for clients. It does not cover the websites or services of other companies you reach from here or connect to your board; each of those has its own policy.

When we run a board for a business, that business decides what personal information goes on it, for example about its own customers, and we handle that information for the business under our agreement with it. For that information, the business is responsible for telling you how it is used, and requests about it are best sent to the business first. If you send one to us, we pass it on to the business.

Your use of the site and the service is also governed by our terms of service.

What we collect

We may collect information in these ways.

• What you give us. Your name, email address, phone number, business name and details, the website address you type, what you type to the designer, the messages and notes you send, meeting details, billing details, and anything else you send us or enter on your board, including designs you make for your board and the instructions you give automations and agents.
• What comes from your connected accounts. When you connect an account to your board, the board may read data from it, such as messages, reviews, orders, calendar events, contacts and files, as needed for the features you use. Data from a connected Google account is covered by the Google user data section below.
• What your board records. Your board may keep an action log: a record of activity on it, such as approvals, changes to tool settings, freezes, and actions taken by Abel, automations and agents, with who or what did them and when.
• What your own AI sends us. If you use an AI of your own to use the site for you, we receive what it sends us and treat it as coming from you: to create your account, your email address, business name, name and phone number, and whether the account is for a business or for personal use and the language you want; then any design, files and messages it sends. A design can be sent only after you confirm the account from our email; messages it sends before then are kept and reach us once you confirm. We also keep the name of the AI, from what it tells us, from the name its software gives, or from the network the request comes from, and a record of the sign-up, such as when it was made, confirmed and last used, and a scrambled form of the internet address it came from. To limit abuse and to tell which AI is using the site, we may check whether a request comes from a known AI provider's network.
• What the designer reads. When you give the designer your website address, it may read the public pages of that website to draft your sample board.
• What the designer learns. We also keep the answers you give the designer, with the industry you tell it, the language you use and the question each one answers, and we count them by industry, language and question. Your contact details, the words read from your website and the names you give a board's panels and tabs are not in those counts. Once enough people designing the same kind of board have given the same answer to a question, the designer may offer that answer as a choice to the next person designing that kind of board, beside the box to type their own.
• What is collected automatically. Device and usage data such as your IP address, browser and device type, pages visited, time stamps and approximate location, and logs of activity on your board. Our hosting and security providers record this to serve and protect the site.
• Cookies and similar storage. We use cookies or similar browser storage that are needed for sign-in and security, and we may use analytics tools. See Cookies and analytics below.
• Payments. A payment processor handles card and bank payments for us. We do not store full card or bank account numbers. We may keep payment records such as amounts, dates, status, and the card brand or bank and the last four digits.

How we use it

We may use information to:

• provide, build, run and support the site, the designer and your board, including drafting work and carrying out tasks with AI, running automations and agents, and keeping the action log;
• arrange and hold meetings, answer messages, and prepare quotes and invoices;
• bill you and collect payments;
• send service emails and, if you have agreed, promotional email (see Emails we send below);
• secure the site and the boards, and prevent spam, fraud and abuse;
• understand how the site and the service are used and improve them, except where the Google user data section below limits that;
• comply with the law, respond to lawful requests, enforce our terms, and establish, exercise or defend legal claims.

AI drafting and actions

Abel, the designer, and the automations and agents on your board may use AI models run by other companies. To draft or to carry out a task, what you type and the content needed for the task, which may include data from your connected accounts, may be sent to those companies. They process it under their own terms.

Your data goes to outside AI companies only when that is necessary to run a feature or to keep token costs down, and only the part the feature needs. If you would rather not use cloud AI at all, contact us: a build with no third-party AI is available on request.

If you use an AI of your own with the site, what it reads on the site or receives from us, such as how your sign-up is going and our replies to its messages, goes to that AI and to the company behind it, under that company's own terms and privacy policy, not ours. The line above about outside AI companies covers the AI we use, not an AI you choose.

Where a board uses a key or a plan the business holds with an AI company, or an agent the business connects, what the board sends to that company is covered by the business's own agreement with it, not ours.

Emails we send

Service emails, such as sign-in codes, account confirmations, meeting confirmations, invoices and receipts, and account and security notices, are part of the service. We send them whether or not you agree to promotional email.

Promotional email, meaning tips, offers and news from Smart Business HQ, goes only to people who ticked the box that reads "Email me tips, offers and news from Smart Business HQ. Optional. Unsubscribe anytime." Every such email has an unsubscribe link and our postal address. Leaving the box unticked, or unsubscribing later, does not affect booking a meeting or being a client.

If you save a board in the designer without booking a meeting, we may send you one reminder about it, once. It carries an unsubscribe link.

The legal grounds we rely on

Where data protection law asks us to name a legal basis, ours are: performing our contract with you, or taking steps you ask for before entering one; your consent, where we ask for it, such as for promotional email; our legitimate interests in running, securing, improving and promoting our business; and compliance with our legal obligations.

Cookies and analytics

We use cookies or similar browser storage that are needed to sign you in, keep your session secure and protect forms from abuse. Without them, signing in does not work.

We may also use analytics tools to understand which pages are read and how visitors find the site. These tools may use cookies or similar identifiers and process data under their own terms. You can block or clear cookies in your browser settings, though parts of the site may then stop working.

We use Google Analytics on our public pages to see which pages get read. If you visit from the European Economic Area, the United Kingdom or Switzerland, it runs only after you say yes. Your choice is kept for 180 days in a cookie named sbhq_consent, and you can change it at any time under Cookie settings. Google's own policy explains how Google uses information from sites that use its services.

We also use an analytics provider that records page visits and clicks, including recordings of visits with everything typed hidden. It follows the same choice as Google Analytics, and when you book a demo, send us a note or create an account, it connects your visits to your email address.

Who we share it with

We may share information with:

• service providers that process it for us, such as for hosting, servers, security, email, payments, calendar and meetings, and AI. We may or may not use outside providers for any part of the site and the service, and we may change them at any time. Clients receive the list of the providers that process their board's data in our Data Processing Addendum;
• the companies whose accounts you connect to your board, when your board acts on those accounts as you direct;
• our professional advisers, such as lawyers and accountants;
• authorities, courts and other parties where the law requires it, to respond to a lawful request, or to protect our rights, our clients, other people or the public;
• a buyer or successor if our business, or the part of it that runs Smart Business HQ, is sold, merged or reorganised.

We do not sell personal information.

Google user data

If you connect your business's Google Business Profile to your dashboard, we ask Google for permission to manage that profile on your behalf. With that permission, the dashboard reads the business accounts and locations your Google sign-in manages, the name and address of the location you choose, the reviews left for that location with each reviewer's name, profile photo, rating and comment, the replies to those reviews, and the location's average rating and review count.

How we use it

We use this data only to provide the reviews feature to your own business. It lets you see your Google reviews and ratings in your private dashboard, and it lets your team prepare replies to them. A reply is posted to Google only after a person on your side approves it. We do not use the data for any other purpose.

What we never do with it

We never sell Google user data. We never use it for advertising, including personalised, retargeted or interest-based advertising. We never use it to develop, improve or train artificial intelligence or machine learning models, and we do not allow any service we work with to do so.

We do not share it with anyone else, except where that is needed to provide this feature to you, such as the hosting provider that runs your dashboard server or an AI service that helps prepare a reply for your approval; where the law requires it; or where it is needed to protect against security threats, fraud or abuse. Nobody on our team reads your reviews data unless you ask us to, for example while helping you with a problem, or unless security or the law requires it.

How it is stored and for how long

The data is stored on the private server that runs your business's dashboard, and it travels between Google and that server over encrypted connections. The sign-in token Google issues is kept encrypted at rest. The short-lived access token made from it is held in memory only and never written to disk.

Reviews are kept for as long as the connection is active, so your dashboard can show their full history. When you disconnect Google Business Profile, or when your account with us is closed, the dashboard deletes the stored token, the stored reviews and the connection's settings.

How to remove access

You can remove our access at any time. In your dashboard, open Setup and disconnect Google Business Profile. You can also remove it from your Google Account at https://myaccount.google.com/permissions. Once access is removed, the dashboard can no longer read your reviews or post replies.

Google API Services User Data Policy

Our use of information received from Google APIs, and any transfer of that information to another app, complies with the Google API Services User Data Policy, including its Limited Use requirements.

Cloudflare Turnstile

We use Cloudflare Turnstile to tell people from automated traffic. Turnstile is covered by the Cloudflare Turnstile Privacy Addendum.

YouTube

Where a board shows information from YouTube, it uses YouTube API Services. Google's Privacy Policy, at https://policies.google.com/privacy, explains how Google handles information.

Where it is processed

We are based in the United States, and information is processed and stored in the United States. Some of our providers, and some of the people who work for us, may also process it or access it from other countries. Privacy law there may differ from the law where you live. Where the law requires safeguards for such transfers, we rely on the safeguards our providers offer.

How long we keep it

We keep information for as long as needed for the purposes above and as the law requires, including to keep business and tax records, resolve disputes and enforce our agreements. In particular:

• Information on a client's board is kept while the service runs. When the service ends, the client can export its information for 30 days, and the board then stays open to it read-only for a further 30 days. The board and the information on it are then deleted, apart from the records in the next point.
• The action log and approval records of each board, our sign-in, access and security records, and billing records may be kept for up to six years, including after the service ends, to keep the service secure, to keep a record of what was done and by whom, to establish, exercise or defend legal claims, and to meet our legal obligations. We use them for nothing else.
• Backups of a board are kept for a limited time. When the board is deleted, they are deleted, or made unreadable and then removed. Backups of our own systems, such as whole servers and our sign-in service, are kept for a limited time and then deleted.
• Information from YouTube API Services that a board shows is kept only as long as YouTube's rules allow.

How long data from a connected Google account is kept is set out in the Google user data section above.

Security

We use reasonable technical and organisational measures to protect the information we hold. No website, server or transmission is completely secure, and we cannot guarantee that information will not be accessed, lost or changed without authorisation. Keep your sign-in details and your email account secure.

Your choices and rights

You can ask us for access to the personal information we hold about you, ask us to correct it or delete it, and opt out of promotional email at any time by using the unsubscribe link in any such email. To make a request, write to the contact address below. We may need to confirm your identity first, and we may keep information the law allows or requires us to keep.

People in the European Economic Area and the United Kingdom: depending on where you live, you may also have the right to object to or restrict some processing, to receive a copy of your information in a portable form, to withdraw consent you have given without affecting what was done before, and to complain to your data protection authority.

People in California: depending on where you live, you may have the right to know what personal information we collect and how we use and disclose it, to ask us to delete or correct it, and not to be treated differently for using a privacy right. We do not sell personal information.

People in other US states: depending on where you live, the privacy law of your state may give you similar rights, such as to know, access, correct, delete or get a copy of your personal information, and to opt out of its sale, of targeted advertising or of certain profiling. If we decline your request, you may appeal by replying to our answer and saying that you are appealing.

People in Mexico: this policy is also our privacy notice (aviso de privacidad) for the personal information we handle as the responsible party (responsable), such as information about visitors to the site, people who book a meeting or sign up, and our contacts at our clients. The responsible party is The Coverdale Group LLC, 732 S. 6th St., Ste. V, Las Vegas, NV 89101, USA, and you can reach us at the contact address below. For information on a client's board, the client is the responsible party and we handle it for the client as its processor (encargado), as set out under Who we are and what this covers.

We use your information for the purposes our relationship with you needs, set out under How we use it: to provide, run and support the site and the service, to arrange meetings, to bill, to send service emails, to keep the site and the boards secure, and to meet the law. We also use it for purposes that relationship does not need: to send promotional email, and to understand how the site is used through analytics. You can tell us at any time that you do not want your information used for those purposes, by writing to the contact address below, by using the unsubscribe link in any promotional email, or under Cookie settings. Saying so does not affect the service.

We do not ask for sensitive personal information (datos personales sensibles). We share information as set out under Who we share it with. Where the law requires your consent before we share your information with another company, we ask for it first.

You may ask us to give you access to your personal information, to correct it, to delete it or to stop using it (your ARCO rights), and you may withdraw your consent or ask us to limit how we use or share your information. Write to the contact address below with your name and a way to reply, a document that shows who you are (or, if someone asks for you, their authority to do so), a clear description of the information and of what you are asking for, and anything else that helps us find it. We reply within the time the law sets. We tell you about changes to this notice by updating this page and the date at the top.

Age

The site and the service are for businesses and for adults 18 years or older. We do not knowingly collect information from anyone under 18. If we learn that we have, we may delete it.

Links to other sites

The site, your board and our emails may link to websites and services run by other companies. They run under their own terms and privacy policies, and we are not responsible for them.

Changes to this policy

We may update this policy at any time as the service, the providers we use or the law change. The date at the top of this page changes when we do, and the version on this page is the one that applies. We may publish this policy in other languages. If a translation differs from the English version, the English version controls, except where the law requires otherwise.

Contact

Questions about this policy, or requests about your data, can be sent to alex@thecoverdalegroup.com.