Privacy policy.
What ObsidianStrategies LLC collects through this website and the client portal, why, who helps us handle it, and what you can ask us to do with it.
The short version
- We collect what you give us (through the contact form, the scheduler, and your portal account) and the records we need to keep accounts secure.
- No analytics, advertising tags, or trackers. The portal's cookies exist only to sign you in and keep your account safe.
- We never sell your information or use it for advertising.
- The portal only reads from QuickBooks. It shows each client its own invoices and payments, and nobody else's.
- You can ask to see, correct, or delete your information at privacy@obsidianstrategiesagency.com.
Who we are
ObsidianStrategies LLC (“Obsidian Strategies”, “we”, “us”) is a Hard Carbon Group company based in Southwest Florida. We design how service businesses operate and build the systems that run them: assistants, automations, websites, and custom software.
This policy covers obsidianstrategiesagency.com (“the website”) and the client portal you reach through Client login (“the portal”), including the portal's connection to QuickBooks Online. We are responsible for the personal information described here.
What this policy doesn't cover
- Information inside systems we build or run for a client. There the client decides what is collected and why, and we handle it on the client's instructions under our agreement with them. If you are a customer of one of our clients, ask that business first; we will help them answer.
- Information about our own staff and contractors, which we handle separately.
- Other companies' sites and services that we link to, such as Intuit's payment pages. Their own policies apply.
What we collect
When you contact us or book a call
- Your name, business, and email address, the topic you choose, anything you write in the notes, and the time you pick for a call.
- The IP address, browser type (user-agent), and time of the request, which we use to stop spam and abuse.
- Like any website, our host also keeps standard request logs (IP address, browser, page, and time) for security and troubleshooting.
When you use the client portal
- Account details: your name, email address, phone number, job title, the client organization you belong to, and a profile photo if you add one. Photos are checked automatically on our own servers and may need a staff member's approval before they appear.
- Sign-in and security details: your password (stored only as a one-way hash), your two-step verification setup (the secret is encrypted; recovery codes are hashed), and records of your sign-ins and devices, including IP address, browser type, a random device ID, and times.
- What you and our team add: messages, files, project details, tasks, requests for new projects, and the meetings you book.
- An activity log of important actions, such as sign-ins, downloads, and changes to accounts and settings, with the account, time, IP address, and browser involved.
Billing and QuickBooks
- Invoices we have issued to your organization: number, the dates it was issued, due, and sent, line items, amounts, balance, the message to the customer, and any documents we marked to send with the invoice.
- Payments recorded against those invoices: date, amount, method, and reference number.
- Details that come with payments you send us directly, such as the bank details printed on a check.
- We do not copy QuickBooks' private notes into the portal, and the portal never receives full card or bank account numbers from QuickBooks or from Intuit's payment page.
What we don't collect
We use no analytics, advertising tags, tracking pixels, or fingerprinting, and we do not buy information about you from anyone. Please don't send us sensitive information, such as health or financial account details, unless the work requires it and we have agreed how to handle it.
How we use it
- To answer your inquiry and hold the calls you book.
- To run the portal: signing you in, showing your organization its projects, files, messages, and invoices, and sending account email such as invitations, password resets, new-device alerts, and notices about your work.
- To do the work we have agreed with your organization, and to bill for it.
- To keep accounts and systems secure: spotting and stopping abuse, investigating problems, and enforcing our terms.
- To meet legal, tax, and accounting obligations, and to establish or defend legal claims.
We do not sell personal information, share it for cross-context behavioral advertising, or use it to make automated decisions that have legal or similarly significant effects on you. If we ever want to use it for a purpose that is materially different from these, we will ask first.
QuickBooks and Intuit
We keep our books in QuickBooks Online, made by Intuit. The portal connects to our own QuickBooks company through Intuit's official API, with permission that one of our owners grants and can withdraw at any time.
- The portal only reads from QuickBooks: customers, invoices, payments, and invoice attachments. It never creates, changes, or deletes anything there.
- Each client sees only the invoices issued to it (including its projects in QuickBooks), and only once an invoice has been sent, has a payment on it, or we have chosen to show it. Attachments appear only if we marked them to send with the invoice.
- The portal uses QuickBooks data only to show clients their invoices, documents, and payments, and to help our staff manage billing. We do not sell it, use it for advertising, or use it to train AI models.
- The keys for the connection are encrypted when stored. If the connection is switched off, the portal stops reading from QuickBooks, and the copies it already holds stay as a record of what was billed and paid, marked with the date they were last updated. A client's copied invoices and payments are deleted when we unlink that client, or sooner if you ask.
- “Pay online” opens Intuit's own payment page. What you enter there goes to Intuit, not to us, and is covered by Intuit's privacy statement.
AI tools
We use Anthropic's Claude in our work. Our team uses it to write and maintain software, including client projects, and to work with internal documents and project information. What we send it, such as code, task lists, and notes, is processed by Anthropic to provide its service to us.
The client portal itself does not send your information to any AI service. Which AI providers a system we build for you uses is set out in our agreement with you.
How we protect it
- All traffic to the website and portal is encrypted in transit, and the database is reached only over our host's private network or an encrypted connection.
- Passwords are hashed with scrypt and checked against common and breached passwords. Two-step verification is required for our staff and available to every client.
- Two-step verification secrets and the QuickBooks connection keys are encrypted at rest with AES-256-GCM.
- The database enforces separation between clients, so one client's records cannot be read in another client's session.
- Staff access follows permission levels. Any change to a client's sign-in needs the staff member's own admin PIN, and sensitive changes, such as to two-step verification, require signing in again.
- Files are held in private storage and handed out through links that expire within minutes.
- Important actions are written to an activity log that the portal itself cannot edit or delete.
No system is perfectly secure. If a breach affects your information, we will tell you without undue delay and as the law requires. If you find a security problem, please report it to privacy@obsidianstrategiesagency.com.
How long we keep it
- Contact and scheduling requests: deleted two years after they arrive, unless you have since become a client, in which case they stay with your account records.
- Sign-in records: sessions and sign-in steps are deleted once they expire, expired sign-in links 30 days later, and remembered devices after 400 days without use.
- Portal accounts and project records: while your organization works with us, then as long as our agreement, our records, or a possible legal claim requires. When your organization tells us someone has left, we switch off their account promptly.
- Invoices and payment records: as long as tax and accounting rules require. The portal's copies of QuickBooks invoices are part of that record; they are deleted when a client is unlinked.
- Security and activity records: for as long as the portal runs, because they are how we investigate problems and show who did what.
A daily cleanup applies these periods automatically. Information we delete may remain in backups for a limited time until those backups are replaced.
Your choices and rights
Wherever you live, you can ask us to give you a copy of your personal information, correct it, delete it, or stop or limit a particular use of it, and you can withdraw consent you have given. Email privacy@obsidianstrategiesagency.com from the address on your account, or tell us how to confirm it's you. We aim to answer within 30 days, always within the time the law allows, and won't treat you differently for asking.
Some information we have to keep, such as invoices and security records. If so, we'll tell you what we're keeping and why. When we delete a portal account, what you added for your organization (messages, ticked tasks, project requests) stays with it, signed “Former member” instead of your name. You can change your password, two-step verification, and profile photo yourself in the portal.
California
We do not sell or share personal information as California law defines those terms, and we use sensitive information, such as account passwords, only to provide and secure the portal. The categories we collect, where they come from, why, and who receives them are set out above. You or an authorized agent can exercise your rights to know, correct, and delete as described here.
European Economic Area, United Kingdom, and Switzerland
We rely on these legal bases: performing our contract with your organization (the portal and the work), our legitimate interests (answering inquiries, running and securing our business), legal obligations (such as tax records), and your consent where we ask for it. Your information is processed in the United States, with safeguards our providers offer, such as standard contractual clauses. You may complain to your local data protection authority, though we would like the chance to help first.
Children
The website and portal are for businesses. Portal accounts are for adults, and we do not knowingly collect information from anyone under 18. If you think we have, tell us and we will delete it.
Where it's processed
We are based in the United States, and our service providers process information mainly in the United States. If you use the website or portal from elsewhere, your information will be transferred to and handled in the United States.
Changes to this policy
When we change this policy, we update the date at the top. If a change materially affects how we handle portal users' information, we will tell portal users by email or in the portal before it takes effect.
Contact us
Questions, requests, and complaints: privacy@obsidianstrategiesagency.com. ObsidianStrategies LLC, Southwest Florida, United States.