Privacy Policy

What we access

When an authorized administrator connects a firm, COREboards uses BQE CORE's OAuth flow to obtain read-onlyaccess to that firm's CORE data (projects, time and expense entries, invoices, payments, and employee records). We use this data solely to compute and display the dashboards and timecard within the app. COREboards never sees or stores your BQE CORE password — authentication happens entirely on BQE's own sign-in pages.

What we store

• Your firm's CORE OAuth tokens, encrypted at rest (AES-256-GCM).
• Basic account records: firm name, your name, email, CORE employee id, and assigned role.
• Your in-app preferences (filters, thresholds, timecard layout).

We do not sell your data, and we do not use it for advertising. Computed metrics are served per request and scoped to your role; the app does not expose another firm's data.

Connected calendars (Google Calendar)

Connecting a calendar is optional. If you choose to, COREboards uses Google's OAuth flow to obtain read-onlyaccess to your calendar events (the “calendar.events.readonly” scope) and your email address (used only to label the connection). We use this access for a single purpose: to show your events inside the timecard so you can turn them into time entries, and to suggest which project, phase, and activity each event belongs to. COREboards never creates, edits, or deletes anything on your calendar.

COREboards' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not use it to train generalized artificial-intelligence models.

We store only what the feature needs: your encrypted OAuth token, and — for events you choose to log — a small record linking the event to the time entry it created (the event's id, title, and date) plus the mapping rules you confirm. Calendar data is transmitted over encrypted connections (HTTPS), your OAuth token is encrypted at rest (AES-256-GCM), and everything is held in an access-controlled database reachable only by the COREboards server.

Who we share, transfer, or disclose Google user data with

We share Google user data only with the service providers below, only to operate the features described above, and only to the extent each one needs:

• Anthropic (Claude)— to suggest which project and phase an event belongs to, the event's title and the email domains of its guests (never full guest addresses) are sent transiently at the moment you request a suggestion. Anthropic does not retain this content or use it to train their models.
• Supabase — hosts the access-controlled database that holds your encrypted OAuth token and the records of events you logged.
• Vercel — hosts the COREboards application server that requests and processes calendar data in transit.
• BQE CORE — receives only the time entries you review and confirm. No calendar event reaches BQE CORE unless you choose to log it.

We do not share, transfer, or disclose Google user data to any other party, for any other purpose, except where we are required to by law. Only the individual user who connected a calendar can see their own events — no colleague, firm administrator, or other customer can view them.

Revoking access & deleting Google user data

Disconnecting your calendar from within the timecard revokes COREboards' access at Google and deletes the stored OAuth token immediately. You may also revoke access at any time from your Google Account permissions page; either route stops all future access. Event records kept for time entries you already logged are deleted along with your account — email us at the address below to request deletion sooner, and we will action it promptly.

Sub-processors

COREboards runs on Vercel (hosting) and Supabase (database and authentication). BQE CORE is the source system for firm data, and Google provides calendar data when you connect a calendar. We use Anthropic (Claude) to generate optional AI suggestions and insights. These providers process data on our behalf under their own security and privacy commitments.

Data retention & deletion

You may disconnect your firm at any time, which revokes our access and removes the stored OAuth tokens. To request deletion of your account or firm records, email us at the address below and we will action it promptly.

Contact

Questions about this policy? Email support@thewelldesignedfirm.com.