Privacy Policy

What we access

When an authorized administrator connects a firm, COREboards uses BQE CORE's OAuth flow to obtain read-onlyaccess to that firm's CORE data (projects, time and expense entries, invoices, payments, and employee records). We use this data solely to compute and display the dashboards and timecard within the app. COREboards never sees or stores your BQE CORE password — authentication happens entirely on BQE's own sign-in pages.

What we store

• Your firm's CORE OAuth tokens, encrypted at rest (AES-256-GCM).
• Basic account records: firm name, your name, email, CORE employee id, and assigned role.
• Your in-app preferences (filters, thresholds, timecard layout).

We do not sell your data, and we do not use it for advertising. Computed metrics are served per request and scoped to your role; the app does not expose another firm's data.

Connected calendars (Google Calendar)

Connecting a calendar is optional. If you choose to, COREboards uses Google's OAuth flow to obtain read-onlyaccess to your calendar events (the “calendar.events.readonly” scope) and your email address (used only to label the connection). We use this access for a single purpose: to show your events inside the timecard so you can turn them into time entries, and to suggest which project, phase, and activity each event belongs to. COREboards never creates, edits, or deletes anything on your calendar.

COREboards' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, do not use it for advertising, and do not use it to train generalized artificial-intelligence models.

We store only what the feature needs: your encrypted OAuth token, and — for events you choose to log — a small record linking the event to the time entry it created (the event's id, title, and date) plus the mapping rules you confirm. Calendar data is transmitted over encrypted connections (HTTPS), your OAuth token is encrypted at rest (AES-256-GCM), and everything is held in an access-controlled database reachable only by the COREboards server.

Who we share, transfer, or disclose Google user data with

We share Google user data only with the service providers below, only to operate the features described above, and only to the extent each one needs:

• Anthropic (Claude)— to suggest which project and phase an event belongs to, the event's title and the email domains of its guests (never full guest addresses) are sent transiently at the moment you request a suggestion. Anthropic does not retain this content or use it to train their models.
• Supabase — hosts the access-controlled database that holds your encrypted OAuth token and the records of events you logged.
• Vercel — hosts the COREboards application server that requests and processes calendar data in transit.
• BQE CORE — receives only the time entries you review and confirm. No calendar event reaches BQE CORE unless you choose to log it.

We do not share, transfer, or disclose Google user data to any other party, for any other purpose, except where we are required to by law. Only the individual user who connected a calendar can see their own events — no colleague, firm administrator, or other customer can view them.

Revoking access & deleting Google user data

Disconnecting your calendar from within the timecard revokes COREboards' access at Google and deletes the stored OAuth token immediately. You may also revoke access at any time from your Google Account permissions page; either route stops all future access. Event records kept for time entries you already logged are deleted along with your account — email us at the address below to request deletion sooner, and we will action it promptly.

Sub-processors

COREboards runs on Vercel (hosting) and Supabase (database and authentication). BQE CORE is the source system for firm data, and Google provides calendar data when you connect a calendar. We use Anthropic (Claude) to generate optional AI suggestions and insights. These providers process data on our behalf under their own security and privacy commitments.

Data retention & deletion

We keep your firm's COREboards data for as long as your firm has an active subscription or free access. When that access ends, for example because you cancel or a free period ends without a subscription, we keep the data for 90 days so you can come back and find everything where you left it.

After 90 days we permanently delete it: user accounts, settings, staffing plans, saved reports, history, uploaded files and stored OAuth tokens. We email your firm's COREboards administrators at least 14 days before that happens. Subscribing again before the deletion date cancels it. Your data in BQE CORE is never affected; COREboards only reads from it, and anything COREboards wrote to CORE stays there.

After deletion we keep only a record that the deletion took place (your firm's name and the date), billing and payment records that our payment processor, Stripe, holds and that we must keep for tax and accounting purposes, and routine email delivery logs. Database backups that still hold the data expire on their own within 30 days of the deletion.

You may disconnect your firm at any time, which revokes our access and removes the stored OAuth tokens. To have your account or firm records deleted sooner than 90 days, email us at the address below and we will do it promptly.

Contact

Questions about this policy? Email support@thewelldesignedfirm.com.