Privacy Policy
Effective September 13, 2026
This policy describes how Epiglass (“Epiglass,” “we,” “us”) collects, uses, and protects information when you use our website and our business-operations service (the “Service”). By using the Service you agree to this policy.
Information we collect
- Account information. Your name, email address, and authentication details when you create an account, processed through our sign-in provider.
- Connected business data. When you connect a system such as QuickBooks Online or Google Workspace, you authorize Epiglass — through that provider's own consent flow — to read business records such as vendors, customers, accounts, transactions, documents, and calendar items. We receive scoped, revocable access tokens; we never receive or store your passwords.
- Usage information. Standard technical logs (such as IP address, browser type, and pages visited) used to operate and secure the Service.
How we use information
- To provide the Service: building and maintaining your business's operational map, calendar, and reports.
- To secure, maintain, and improve the Service.
- To communicate with you about the Service.
We do not sell your information, and we do not use your connected business data to advertise to you or to anyone else.
How we store and protect information
- Each customer's business data is stored in its own isolated database.
- Access credentials for connected systems are encrypted at rest; nothing sensitive is stored in plaintext.
- Every read and change of a record is logged in an append-only audit trail.
- Access within Epiglass is limited to what is needed to operate the Service.
Sharing
We share information only with:
- Service providers that host and operate the Service on our behalf (such as cloud infrastructure, database, authentication, and AI-processing providers), bound to use it only to provide their services to us.
- Authorities, if required by law, subpoena, or to protect rights and safety.
Your choices
- Disconnect at any time. You can revoke Epiglass's access from within the Service or from the connected provider's own security settings (for example, your Intuit or Google account). Revocation takes effect immediately.
- Deletion. You may request deletion of your account and your business's data by writing to us; we will delete it within 30 days, except records we must retain by law.
- Access and correction. You may request a copy or correction of the information we hold about you.
Data retention
We retain information for as long as your account is active or as needed to provide the Service, then delete or de-identify it, except where retention is required by law.
Children
The Service is for businesses and is not directed to children under 13.
Changes
We will post any changes to this policy on this page and update the effective date. For material changes we will notify account holders by email.
Contact
Epiglass — forrest@epiglass.com