Privacy Policy

1. Who handles your information

RWP Ventures LLC, Virginia, USA operates Groundwork Facilities. Contact info@rwp-ventures.com for privacy questions or requests. We handle account and inquiry information to operate the service. When a business enters its customers’ or staff’s records, that business controls its purposes for that data, and we process it to provide the service for that business. Customers and staff should ordinarily direct record-related requests to their business administrator.

2. Information the service processes

Account information includes your name, email, authentication records and business membership or role. We also store your explicit EULA and Privacy Policy acceptance records, including the document version, document text and timestamp, to evidence agreement and require renewed acceptance when either document changes. This acknowledgment does not replace separate consent where the law requires it. Business information includes the records authorized users create or upload: customers and contacts, property addresses, estimates, jobs, schedules, crews, routes, invoices, payments, expenses, equipment, photos and activity history. Not every business uses every feature.

Demo and contact forms collect your company and contact name, email and any optional phone, team size, interests or message you supply. Technical records can include request and error details, timestamps and device or network information processed by hosting and authentication providers for service delivery, troubleshooting and security. Do not include passwords or sensitive financial credentials in free-text fields.

3. QuickBooks data and limits

When an authorized manager connects a business’s QuickBooks account, the app reads customer names, billing/service addresses, phone numbers, email addresses, estimates, invoices, payments and unique identifiers for linking records. These transaction records include dates, statuses, amounts, balances, tax totals, line-item details and references necessary to display and reconcile them. Customer activity flags, parent identifiers and update timestamps support selection, relationships and synchronization.

The integration does not read unrelated entities such as employees, payroll, vendors or bank-account records. Customer tax flags, terms, standalone customer balances and private notes are not copied into the customer import. Full customer payloads are not saved; customer import history retains only template-shaped contact/address data and import results. Provider responses can contain additional fields transiently; the app retains only the fields it uses from the approved record types.

QuickBooks access is inbound-only: no accounting record is created, edited, sent or deleted in QuickBooks. Intuit’s accounting consent is broader than the app’s permitted operations. The app enforces a read-query allowlist. Stored OAuth access and refresh tokens are used only on the server to perform authorized reads and renew the connection, not exposed to the browser. Sync logs store record identifiers, status and retry details, not complete QuickBooks response payloads.

4. Why information is used

We use information to authenticate users, enforce business and role permissions, deliver customer/work/financial workflows, reconcile imports, schedule enabled QuickBooks reads, respond to inquiries, and investigate service or security problems. Processing is based on providing the requested service, legitimate operational and security needs, consent where required, and applicable legal obligations. Connecting QuickBooks is optional; disconnecting stops new reads.

The application does not sell customer or QuickBooks records or send them to an advertising integration. Business records are not made public by the QuickBooks connection. Information is not used for unrelated marketing merely because it was imported.

5. Who can access it

Business records are associated with a business identifier and protected by database-enforced membership and role permissions. Authorized managers and office staff can access financial records; field and read-only roles do not receive financial access. Business administrators control their own staff access. Public demo inquiries are restricted to authorized platform administrators.

Service providers process information necessary to operate the service: Lovable Cloud and its hosting, database, authentication and storage infrastructure; Intuit when you connect QuickBooks; and Mapbox for enabled address/map and route features, which can receive site addresses or coordinates. Hosting and diagnostic providers may process technical service records. Provider processing can occur outside your state or country. This notice does not claim a verified region-specific hosting location or a complete provider retention schedule.

We may access or disclose information where necessary to respond to a verified support request, protect the service, comply with applicable law or a valid legal demand, or carry out a business transfer subject to appropriate confidentiality safeguards. Staff access must be limited to an authorized purpose.

6. Security and storage

The application uses authenticated access, business-scoped database rules, role-based financial permissions, HTTPS connections in deployment, and private job-photo storage. Photos are downloaded using the signed-in session and displayed using revocable local object URLs. QuickBooks app secrets are held in the encrypted server secret store; QuickBooks access and refresh tokens are encrypted with AES-GCM before database storage and decrypted only on the server.

Customer and transaction records remain structured database records so authorized business users can search and work with them; they are not described as end-to-end encrypted or unreadable to the infrastructure operator. Database and storage security also depends on the hosting provider’s controls. No independent certification, guaranteed breach prevention or specific backup-deletion deadline is claimed here. Avoid storing card numbers, bank credentials or government IDs in the app.

7. Sessions, cookies and local storage

Authentication uses a persistent session in browser storage, while local preferences keep navigation and display choices. Hosting or authentication services may also use cookies required to provide the service. Signing out clears the app’s active data cache and ends its session. Blocking browser storage can prevent sign-in or preferences from working. This policy does not claim that provider-level telemetry is disabled.

8. Retention and disconnection

Business records, imported data, mappings and activity history remain until removed through available authorized workflows or a verified request is handled, subject to legal and business retention needs. Some workflows archive records rather than permanently erase them. The app does not implement a universal automatic retention or purge period. Provider backups and logs can have separate retention lifecycles.

Disconnecting QuickBooks from the import screen removes the app’s stored access and refresh tokens, disables further scheduled reads, and keeps previously imported records and linking identifiers to avoid duplicate imports on reconnection. You can also manage or revoke connected-app access through Intuit. Disconnection alone does not delete historic invoices, payments, estimates or customers.

9. Access, correction and deletion requests

Depending on applicable law, you may have rights to access, correct, delete or receive a copy of personal information, object to or restrict processing, or withdraw consent. Email info@rwp-ventures.com with the business and records involved, without sending passwords or tokens. We verify identity and authority before acting and respond in accordance with applicable law. For a customer or employee record, we may direct your request to the business that supplied it.

Available tables support selected CSV exports; there is no single complete account-export or self-service account-erasure flow. Contact us for assistance. A request may be limited by another person’s rights, accounting/legal requirements or records needed to protect the service. Applicable rights are not waived by using the app.

10. Children and policy changes

Groundwork Facilities is intended for business use, not directed to children. If you believe a child has supplied personal information, contact us so we can investigate and address it. Revised policies will be posted with an updated effective date, and material changes will receive appropriate notice. Contact RWP Ventures LLC at info@rwp-ventures.com for questions.