Legal

Privacy Policy

Effective date: 2026-07-15 · Last updated: 2026-10-16

Our two roles

SMB Automate is a business tool. For information about you as an app user (for example, an owner or staff member of a business that uses SMB Automate), we act as a “controller.” For your business’s own operational and customer data that the app processes on your behalf, your business is the controller and we act as a service provider / processor acting on your business’s instructions. If you are a customer of a business that uses SMB Automate and have questions about your data, please contact that business directly.

Information we collect

Account information: your username, a securely hashed password, display name, and role. Accounts are provisioned by your administrator or by us; there is no public self sign-up.
Device and technical information: device model and operating system, app version, IP address, a push-notification token (provided through the Apple Push Notification service, Firebase Cloud Messaging, and/or Expo), and diagnostic or crash logs.
Content you create in the app: crew notes, edits to estimates and jobs, approvals and other actions you take, and photos you capture or upload (such as before/after job photos and property photos).
Business and customer data processed on your behalf: customer names, phone numbers, email addresses and service addresses; job, estimate, booking and invoice details; message content; and calendar events, synced from the tools your business connects to its agent (for example, its task board, calendar, messaging/SMS provider, and accounting software).
Usage information: features used, timestamps, and in-app events.

Location: If your account is set up for route tracking, the app can record your device’s precise location, including while the app is in the background, but only while you have turned the on-shift switch ON. Tracking is off by default, you choose when to start and stop it, and while it is running your device shows a persistent indicator (a blue status bar on iOS, an ongoing notification on Android) so it is never hidden. Location points are used to show where and when work was performed and to verify job visits. Accounts that are not set up for route tracking do not have this feature and no location is collected from them. You can stop tracking at any time from the app, or revoke location permission entirely in your device settings; either one stops collection. Apart from this, the app uses only the addresses your business enters as part of its records.

How we use information

To operate and provide the Service and your automation agent; authenticate you and keep the Service secure; send push notifications you enable; draft messages and estimates and analyze photos using AI (see below); sync and display your business’s data; record on-shift route location where enabled, to show where and when work was performed; provide support and troubleshoot; prevent fraud and abuse; comply with legal obligations; and improve the Service using aggregated or de-identified data.

AI processing

Some features, such as drafting messages and estimates in your voice, summarizing activity, and analyzing photos, are performed using a third-party AI provider (Anthropic’s Claude). Content sent to power these features is processed to generate the requested output and is not used by us or the AI provider to train their models. Prices in estimates are computed from the rules your business sets, not invented by the AI; you review and approve outbound content before it is sent.

Google user data

If your business connects its Google account in SMB Automate (Admin > Google Business), you sign in with Google and choose what to allow. For this connection we ask only for your Google account’s email address and permission to manage your Google Business Profile.

What we access: the email address of the Google account you connect; the Business Profiles that account manages (name, address, phone number and website), so you can choose which profile to post to; and the posts we create on that profile for you.
How we use it: only to publish the “What’s new” posts that an owner or admin of your business writes or approves and tells us to send, now or at a time they schedule; to confirm that Google published them; and to show which Google account and profile are connected. We do not read, change or delete anything else on your profile.
How it is stored and protected: the access Google grants us, the connected account’s email address, the profile you chose and a record of the posts we created are kept on our servers in the United States. Access is limited to the Service and to the staff who operate it, and the access token is never shown in the app.
Sharing: we do not sell Google user data, use it for advertising, or send it to our AI provider, and we do not use it to develop or train AI models. We share it only as needed to provide this feature (sending your post to Google), when required by law, or with your permission.
Removing access and deleting it: choosing Disconnect in Admin > Google Business revokes our access at Google and deletes the stored connection from our servers. You can also remove our access at any time in your Google Account (Security > Third-party connections), or email privacy@quantumcoremip.com and we will delete it.

Google Calendar

If your business connects a Google Calendar (Admin > Google Calendar), you sign in with Google and pick the one calendar your bookings go on. This is a separate choice from connecting your Google Business Profile. It asks only for your Google account’s email address and the calendar permissions below.

What we access: the email address of the Google account you connect; the list of calendars on that account, so you can pick one; and the events on the calendar you pick (time, title, description, location and the name, phone number and email a customer entered when booking).
How we use it: to notice a new booking on that calendar, match it to the right job by the customer’s phone number, move that job forward and note the appointment time on it; to show your appointments in the app’s Calendar screen and in your daily summary; to warn you when rain is forecast for an appointment; and to create, change or delete the appointments that you make in the app. We do not read your other calendars, and we do not use calendar information for any other purpose.
How it is stored and protected: the access Google grants us, the connected account’s email address and the calendar you chose are kept on our servers in the United States. The appointment time we note on a matched job is kept with that job. The access token is never shown in the app.
Sharing: we do not sell calendar information or use it for advertising, and we do not use it to develop or train AI models. We do not send your calendar to our AI provider. Once a booking is matched to a job, the appointment date and time are part of that job, and our AI provider may see them when it drafts a message about that job for you to approve.
Removing access and deleting it: choosing Disconnect in Admin > Google Calendar revokes our access at Google and deletes the stored connection from our servers. You can also remove our access at any time in your Google Account (Security > Third-party connections), or email privacy@quantumcoremip.com and we will delete it.

SMB Automate’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Facebook and Instagram data

If your business connects Facebook in SMB Automate (Admin > Facebook and Instagram), an owner or admin signs in with Facebook and chooses what to allow, then picks the one Facebook Page the business posts to. The Instagram professional account linked to that Page comes with it. We ask only for permission to see the Pages you manage, publish to the Page you pick and to its linked Instagram account, and read back the posts we publish.

What we access: the name and ID of the Facebook account that connects; the Pages that account manages (name, ID and whether you can post to it), so you can pick one; the Instagram professional account linked to that Page (ID and username); which permissions you granted; and the posts we publish for you.
How we use it: only to publish the photos, videos and captions that an owner or admin of your business writes or approves and tells us to send, now or at a time they schedule; to confirm that Facebook or Instagram published them; to delete a post we published when you ask us to; and to show which Facebook account, Page and Instagram account are connected. We do not read your messages, your personal profile or your friends, and we do not post anything you did not approve.
How it is stored and protected: the access Facebook grants us (a sign-in token for your Facebook account, used only to list your Pages, and the access token for the Page you picked), the connected account’s name and ID, the Page and Instagram account you chose, the permissions you granted and a record of the posts we published are kept on our servers in the United States. Each business’s connection is kept separate from every other business. Access is limited to the Service and to the staff who operate it, and the tokens are never shown in the app.
Sharing: we do not sell Facebook or Instagram data, use it for advertising, or use it to develop or train AI models. When you ask the app to write a caption, our AI provider sees the photo being posted, the job’s general area and the name of the Page it will post as. Otherwise we share this data only as needed to provide the feature (sending your post to Facebook or Instagram), when required by law, or with your permission.
Removing access: choosing Disconnect in Admin > Facebook and Instagram removes our app from your Facebook account and deletes the stored connection from our servers. You can also remove SMB Automate at any time in Facebook (Settings and privacy > Settings > Business integrations), which stops our access right away.

Deleting your Facebook and Instagram data

To have us delete the data we hold from your Facebook or Instagram connection, do any one of the following:

In SMB Automate on the web, go to Admin > Facebook and Instagram and choose Disconnect. This deletes the stored connection (tokens, account name and ID, Page and Instagram account) right away.
Remove SMB Automate in Facebook under Settings and privacy > Settings > Business integrations, then email us as in step 3 so we also delete the stored connection.
Email privacy@quantumcoremip.com with the subject “Facebook data deletion” and the name of your business or Facebook Page. We will delete the connection and the record of posts we published within 30 days and reply to confirm.

Posts already published on your Facebook Page or Instagram account belong to you and stay there until you delete them on Facebook or Instagram.

We do not sell your personal information. We share information with:

Service providers and integrations that operate on our behalf or that your business connects, such as: the AI provider (Anthropic); your messaging/SMS provider (for example Twilio, OpenPhone, or Google Voice); your task/pipeline and calendar tools (for example Atlassian Trello and Google Calendar); the social accounts your business connects for posting (for example Google Business Profile, Facebook, Instagram and TikTok); push notification and app-distribution platforms (Apple and Google/Firebase); networking (Cloudflare); and any accounting or other tools your business links (for example Intuit QuickBooks). Their handling of data is governed by their own terms and privacy policies.
Your organization: administrators and staff in your business can see the business data in the app.
Legal and safety: we may disclose information if required by law or legal process, to protect rights, safety, or property, or in connection with a merger, acquisition, or sale of assets.

Storage, location and retention

Data is stored on infrastructure operated by us and/or your business (which may include a dedicated always-on device that runs your business’s agent) and with the third-party services your business connects. Data is stored in the United States. We retain information for as long as your business’s account is active and as needed to provide the Service, after which we delete or de-identify it, unless a longer period is required by law. Location points collected by on-shift route tracking are kept for 90 days and are then permanently deleted.

Security

We use measures including authenticated access (token-based login), hashing of passwords, restricted access to secrets, and separation of each business’s data from other businesses. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Your choices and rights

You can access, correct, or request deletion of your account information by contacting your administrator or emailing privacy@quantumcoremip.com. You can control push notifications in your device settings. Depending on where you live, you may have rights under laws such as the California Consumer Privacy Act (as amended) or the EU/UK GDPR, including rights to access, correct, delete, port, or object to processing of your personal information. Because we often act as a processor, requests about a business’s customer data should be directed to that business. We do not sell or “share” (as defined under California law) personal information for cross-context behavioral advertising.

Account and data deletion

You may request deletion of your SMB Automate app account and associated personal data at any time by emailing privacy@quantumcoremip.com or asking your administrator. We will delete or de-identify your personal data within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. To delete data from a Facebook or Instagram connection, see Deleting your Facebook and Instagram data.

Children

The Service is intended for businesses and is not directed to children under 13, and we do not knowingly collect personal information from children.

Changes

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date, and will provide additional notice of material changes where required.

Contact us

HHI Computer Guys LLC, d/b/a Quantum Core MIP, privacy@quantumcoremip.com · 843.422.2201 · Hilton Head Island, South Carolina, USA.

Continue to our Terms of Service.