# Privacy Policy — Covision

Last updated: April 13, 2026

This policy explains what data Covision collects, how we use it, and your rights. We do not sell your data, and we do not use your business data to train AI models.

## Who We Are

Covision Consultants, 330 Town Center Dr, Suite 330, Dearborn, MI 48126, US. Privacy contact: info@covisionconsultants.com.

## Information We Collect

**You provide:** Account data (name, email, phone, organization, role), billing data (via Stripe), business data (goals, meeting notes, scorecards, clients, invoices, documents, messages), and communication data (support forms, email, SMS).

**Collected automatically:** IP address, browser/device type, OS, referrer, pages visited, features used (via PostHog), crash reports (via Sentry), cookies.

**From integrations:** QuickBooks (expenses, accounts, vendors), Plaid (bank transactions, balances), Google Calendar (events, availability), Stripe (payments, subscriptions).

## How We Use Your Information

- Provide and operate the platform
- Authenticate and secure your account
- Send transactional and marketing communications (opt-out available)
- Improve product via aggregated analytics
- Comply with legal obligations

## QuickBooks Data Handling

QuickBooks data is never used to train AI models, never sold or shared. Encrypted with TLS 1.2+ in transit, AES-256 at rest. Disconnect anytime to revoke access.

## SMS (Twilio A2P 10DLC)

Opt-in via unchecked-by-default checkbox at signup. Opt-out: reply STOP. Up to 10 messages/month. Message and data rates may apply. See [SMS Terms](https://covisionperformance.com/sms-terms).

## Cookies

- Essential: session, authentication, CSRF (cannot disable)
- Analytics: PostHog (anonymized, opt-out via banner)
- Error tracking: Sentry (no PII)
- No advertising cookies

## Data Sharing

We do not sell personal data. We share only with necessary service providers: Cloudflare, Convex (infrastructure), Stripe (payments), Resend (email), Twilio (SMS), PostHog, Sentry (analytics), Plaid, QuickBooks, Google, OpenAI (integrations).

## Data Retention

Account/business data: retained while active, then 30 days, then deleted. Financial records: 7 years (legal compliance).

## Your Rights

Access, correct, delete, export, restrict, or object to processing of your personal data. Withdraw consent anytime. Contact: info@covisionconsultants.com or [Data Deletion](https://covisionperformance.com/data-deletion).

## GDPR

Legal bases: contract performance, legitimate interest, consent, legal obligation. Covision acts as data controller (account data) and processor (customer business data).

## CCPA

We do not sell/share personal data for behavioral advertising. California residents may exercise their rights by contacting us.

## Security

TLS 1.2+ in transit, AES-256 at rest, role-based access, audit logs, regular third-party reviews, documented incident response plan.

## Contact

Email: info@covisionconsultants.com | Mail: Covision Consultants, 330 Town Center Dr, Suite 330, Dearborn, MI 48126, US