Privacy Policy
Published · Updated
This policy covers smallwright.com and every Smallwright product (currently Grommetbook at grommetbook.smallwright.com), operated by VINNYROO LLC ("we"). In short: we store what you and your AI assistant put into a product so the product can work, we never sell it or use it for advertising, we don't store your conversations with your AI, and you can export or delete your data at any time. Questions: support@smallwright.com.
What we collect
| Data | Why |
|---|---|
| Your email address (sign-in), the account and shop it belongs to, and the email addresses of teammates the owner adds | To sign you in by emailed link and keep your data separate from everyone else's. |
| What your AI assistant sends a product's tools. For Grommetbook: shop profile (name, logo URL, tax rate, deposit, terms), Price Book (Materials, Rates, Products), Customers (names, emails, phone numbers, notes), Quotes, Jobs, feature requests | This is the product: we store it so you, your staff and your assistant can use it. |
| Audit log of changes: time, which assistant (its client name), which tool, inputs and result | So the viewer can show what changed and why, and to investigate problems. |
| Quote approvals: approver's typed name, time, IP address and browser user agent | A record that your customer approved the Quote. |
| Connected assistants: client name, scopes, when last used (we store hashes of access tokens, not the tokens) | So you can see and disconnect them. |
| Billing: Stripe customer id, subscription status and period. Card details go to Stripe and never reach us | To know whether a shop is on a trial or subscribed. |
| Usage events: a one-way hash of the account id, tool name, outcome (ok / error / limit), latency, assistant client name and plan. No names, emails or free text, with one exception: the words of a feature request you file (emails, phone numbers and links removed, at most 280 characters), so we can read requests across products | To find errors and see which features are used. |
| Website analytics on smallwright.com pages (Cloudflare Web Analytics: no cookies, no cross-site tracking) and standard server logs (IP address, URL, time) | To see which pages help people and keep the service secure. |
| Emails you send to support | To answer you. |
We do not collect or store your conversations with your AI assistant, its memory or your files, beyond what the assistant sends to one of our tools. Your AI provider (Anthropic, OpenAI, …) handles your conversations under its own privacy policy.
Your customers' data
When you store your own customers' details in a product (for example Customers and Quote approvals in Grommetbook), you decide what goes in and why, and we process it on your behalf to provide the service. Third-party text, such as a customer's approval note, is shown to your assistant labelled as third-party text. The approver's IP address and browser are kept as the approval record and are never sent to your AI assistant. A data processing agreement is available on request.
Who processes it
- Google Cloud / Firebase (United States): hosting, database, sign-in, logs.
- Stripe: payments and invoices.
- Cloudflare: DNS, email forwarding for smallwright.com addresses, website analytics.
- Google (Gmail): our support mailbox, and the sender of sign-in link emails.
We don't sell or share personal information for advertising, and we don't use your data to train AI models.
How long we keep it
- Account and product data: while your account exists. If you ask us to delete it, within 30 days. If an account has had no sign-in and no tool calls for 24 months, we delete it after emailing the owner.
- Server logs: up to 30 days. Usage events (hashed, no personal content): up to 13 months.
- Billing records: as long as tax law requires (Stripe keeps its own records).
Your choices and rights
You can export everything at any time (in Grommetbook, ask your assistant to run export_shop_data), disconnect any assistant in the viewer, and ask us to correct or delete your data by emailing support@smallwright.com from the account owner's address. Depending on where you live (for example California or the EU/UK) you may have further rights to access, correct, delete or port your data and to object to processing; we honour these requests for everyone. You can complain to your local data protection authority.
Security
Data is encrypted in transit (HTTPS) and at rest by Google Cloud. Each account's data is isolated by account id on every request, sign-in has no passwords, access tokens are stored as hashes, and assistants can be disconnected instantly.
Children
Our products are business tools and are not meant for anyone under 18.
Changes
We update the date above when this policy changes and list material changes in the changelog.