AYS Operations

Privacy Policy

Effective date: July 10, 2026

AYS Operations ("AYS Operations", "we", "us", or "our") provides business-management software for consultants and small businesses at aysops.com. This policy explains what information we collect, how we use it, and the choices you have. By using AYS Operations you agree to this policy.

Information we collect

  • Account information — your name, email address, company name, and password (stored only as a secure hash), provided when you create an account.
  • Sign-in identities — if you sign in or connect Google or Microsoft, we receive your basic profile from that provider: name, email address, and profile picture. We do not receive your Google or Microsoft password.
  • Business data you enter — information you and your team add while using the service, such as customer records, estimates, work orders, invoices, expenses, mileage logs, notes, and uploaded files. This data belongs to you.
  • Payment information — subscription payments are processed by Stripe. We store your subscription status and billing history; we never see or store full card numbers.
  • Technical information — session cookies, security events (such as blocked requests and login attempts), and standard server logs used to keep the service secure and reliable.
  • Device and sign-in activity — for each browser you sign in from we record an anonymous device identifier, the IP address, the country (and, where available, the approximate city) that address resolves to, and the browser's user-agent string. We use this only to detect a compromised or shared login — for example the same account being used from two countries within minutes. It is never used for advertising or profiling, and we do not track precise location. These records are deleted automatically after 90 days of not being seen.
  • Calendar availability — if you connect the optional Calendar Sync add-on, we periodically read busy/free intervals from your own calendar so your team's work calendar can show when you are unavailable. You can also choose additional calendars of your own to be treated the same way; none are included unless you tick them, and you can untick one at any time, which removes the times it contributed. From any calendar — your default one or any you add — we store only the start time, end time, and which calendar the interval came from — never event titles, locations, descriptions, or attendees. Intervals are refreshed on a rolling 60-day window and deleted shortly after they pass; disconnecting your calendar stops the collection.
  • Meeting transcripts — if you use the AysOps for Zoom add-on and switch on the optional transcript import, then for meetings you chose to record in Zoom we download the transcript Zoom produces and store it as an ordinary file in your account, filed against the relevant customer. We store the text only — never the audio or video recording. This is off unless you switch it on, we never start or request a recording ourselves, and transcripts are kept, deleted, and access-controlled exactly like any other file you hold. Switching the setting off stops any further import.
  • Events on the AYS Operations calendar — the Calendar Sync add-on creates a separate calendar in your account for your work appointments. That one is two-way: if you add or change an event on it, we read and store the event's title, description, and times so it appears in AYS Operations and can be edited from either side. This applies only to the calendar AYS Operations created — we never read the contents of your personal or other calendars. Deleting the AYS Operations calendar, or disconnecting, stops it.

Google user data

When you sign in with Google, we request only your basic profile information (name, email address, and profile picture) to create and secure your account. We do not request access to your Gmail, Google Drive, Contacts, or any other Google service data.

If you choose to connect the optional Calendar Sync add-on with a Google account, we additionally request two narrow Calendar permissions: the ability to manage only the calendar AYS Operations creates (where your work appointments are pushed — we read and write the events on that one calendar, including their titles and descriptions, and we cannot see or change your other calendars), read-only free/busy access, which tells us when you are busy but not what any event is, and permission to see the list of your calendars — their names only, so we can offer them for you to choose from. We do not read the events in them. You can revoke this at any time by disconnecting in AYS Operations or from your Google account's security settings.

AYS Operations's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your information

  • To provide, maintain, and improve the service.
  • To authenticate you and secure your account (including two-factor authentication).
  • To process subscription billing and send transactional emails (such as invoices you choose to send, receipts, and security notices).
  • To respond to support requests.
  • To detect, investigate, and prevent abuse, fraud, and security incidents.

We do not sell your personal information, and we do not use your data for third-party advertising.

Cookies

We use only cookies necessary to operate the service: your login session, your two-factor verification state, and your selected company. We do not use third-party advertising or cross-site tracking cookies.

Where your data lives and who processes it

We rely on a small number of service providers to run AYS Operations:

  • Supabase — database, authentication, and file storage.
  • Vercel — application hosting.
  • Stripe — subscription payment processing.
  • Google / Microsoft / Apple — optional sign-in providers (Google, Microsoft) and, if you connect the Calendar Sync add-on, the calendar provider you choose to link.
  • Anthropic — optional AI features. When you actively use an AI feature, the content it works on is sent to Anthropic for processing: documents and images you upload for reading (such as receipts, invoices, and odometer photos, including the values on them), and — for QuickBooks matching suggestions — customer, vendor, and item names only, never their contact details. Anthropic is a US processor; it does not train on this data, and retains it only briefly for abuse monitoring before deletion.
  • Intuit (QuickBooks Online) — only if you connect the QuickBooks Sync add-on to your own QuickBooks company. Syncing is two-way for the data the feature covers: customer, vendor, item and tax-rate records, and the invoices, payments and expenses you choose to send, are exchanged between AYS Operations and your QuickBooks company. This only ever involves the QuickBooks company you authorize, and you can disconnect it at any time.

If you connect your own email account (SMTP) to send invoices and documents, those emails are sent through your configured email provider; your email credentials are stored encrypted.

Your customers' data

The customer records, invoices, and other business data you enter may contain personal information about your own customers. You control that data: you decide what to enter, and you are responsible for having the right to store it. We process it only to provide the service to you and never use it for our own purposes.

Data retention and deletion

Your data is retained while your account is active. If you delete records in the app they are removed or marked deleted (some records, such as deleted work orders, are retained in a recoverable state so our support team can restore them at your request). If you close your account, we delete your data within a reasonable period, except where we must keep records to meet legal, tax, or accounting obligations. Backups expire on a rolling schedule.

Security

All traffic is encrypted in transit (HTTPS). Data access is enforced per account at the database level, uploaded files are scanned against unsafe file types, two-factor authentication is required on every account, and security-relevant events are logged.

Your rights

You may access, correct, export, or delete your personal information. Most of this is available directly in the app; for anything else, contact us at [email protected] and we will respond within 30 days. Depending on where you live, you may have additional rights under local privacy law (such as PIPEDA in Canada or the GDPR in the EU).

Children

AYS Operations is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy as the service evolves. Material changes will be announced in the app or by email before they take effect, and the effective date above will be updated.

Contact

Questions about this policy or your data: [email protected]