Legal

Privacy Policy

Effective October 7, 2026

1. Introduction

This Privacy Policy describes how StoneFrame Labs, LLC (“CurbsideOps,” “we,” “us,” or “our”) collects, uses, and shares information when you use the CurbsideOps service, including our website at curbsideops.com, our admin portal, and the CurbsideOps Telegram bot (together, the “Service”).

If you connect a Google account, section 12 explains exactly what we access from Google, how we use it, and how to remove it. By using the Service, you agree to the collection and use of information in accordance with this Policy.

2. Information We Collect

Information you provide

  • Account data. When you sign up, we collect your name, email address, and password (handled by our authentication provider, Clerk). For business accounts, we also collect your business name, city, state, phone number, and timezone.
  • Staff data. When you invite crew members, you provide their names, phone numbers, emails, and Telegram handles so the Service can reach them.
  • Customer and operational data. Brands, trucks, events, customers, leads, proposals, invoices, warehouse locations, Event Report responses, and photos you or your staff submit.
  • Billing data. Handled by Stripe. We store your Stripe customer and subscription identifiers; we do not store full payment card numbers.

Information from integrations

When you connect a third-party account, we receive data from that service on your behalf. Depending on what you connect, this may include: Google Calendar events and Gmail messages (described in detail in section 12); Square sales, orders, tips, invoices, and location data; Bouncie GPS telemetry (vehicle location, trips, IMEI); Telegram chat and message metadata; Quo (OpenPhone) text messages and call events; HubSpot contacts and companies; social account details and post results from Zernio; and bank account names from OnlineCheckWriter.

Information collected automatically

  • Usage and telemetry. AI model identifiers, request sizes, execution duration, and error traces, so we can meter AI Credit usage and diagnose issues.
  • Cookies and analytics. Our authentication provider (Clerk) sets session cookies to keep you signed in. We use Google Analytics and Vercel Web Analytics to understand how visitors use our website and portal (pages viewed, device and browser type, approximate location). Google Analytics sets cookies for this purpose. We do not use advertising cookies, and we never send data received from Google APIs to Google Analytics.

3. How We Use Information

  • To provide, operate, and improve the Service.
  • To deliver automated briefings, reminders, weather alerts, sales summaries, and other messages to you and your crew over Telegram, SMS, or email.
  • To send email to your customers that you write, approve, or schedule (for example proposals, deposit reminders, event reminders, and review requests).
  • To process payments, manage subscriptions, and meter AI usage in AI Credits.
  • To respond to support requests and communicate about the Service.
  • To detect, prevent, and address security issues, abuse, or violations of our Terms.
  • To comply with legal obligations.

4. AI Processing

The Service uses AI models to answer questions, read and sort inquiry emails, draft replies and messages, parse event details, write briefings, and create marketing images. The providers we use are:

  • Anthropic Claude, through Amazon Web Services Bedrock, for the assistant, email sorting and drafting, event parsing, and briefings. Inputs may include staff names, calendar events, the content of inquiry emails, sales figures, event locations, and messages your crew sends through the Telegram bot.
  • Google Gemini API, to turn voice notes into text and to read the assistant’s replies aloud when you use voice. A spoken reply can include the same schedule or sales details as the written reply.
  • fal.ai (including OpenAI image models hosted on fal.ai), to create marketing images from your event details, brand assets, and photos you upload.

These providers process data as our subprocessors under terms that do not allow them to train their models on it. We do not use your data, or any data received from Google APIs, to train generalized AI or machine learning models. AI outputs can be inaccurate, so always verify important information before acting on it.

5. Sharing and Subprocessors

We do not sell your personal information. We share information only with the service providers we rely on to run CurbsideOps, and only as needed to provide the Service:

  • Clerk: authentication and identity.
  • Render: application hosting, PostgreSQL database, and Redis queue.
  • Vercel: hosting for our website and portal, and Web Analytics.
  • Cloudflare: R2 object storage for media and documents you upload.
  • Amazon Web Services: Bedrock (AI inference) and AgentCore Memory.
  • Anthropic: AI model inference (through Bedrock).
  • Google: Calendar and Gmail integrations you authorize, Gemini API (voice), and Google Analytics.
  • fal.ai and OpenAI: marketing image generation.
  • SerpApi: web search for public information about your events, used when the Service researches an event for a marketing post.
  • Stripe: subscription billing and payment processing.
  • Resend: delivery of account and notification emails sent from CurbsideOps addresses.
  • Square: POS, invoicing, and payments integration you authorize.
  • Bouncie: GPS fleet tracking you authorize.
  • Telegram: messaging transport for the crew bot.
  • Quo (OpenPhone): text messages and calls you connect.
  • HubSpot: CRM sync you authorize.
  • Zernio: social media publishing you authorize.
  • OnlineCheckWriter: check payments you authorize.
  • ZipTax: sales tax rates for event addresses.
  • Microsoft Azure: maps, address lookup, and drive times.
  • OpenWeatherMap: weather forecasts for event locations.
  • Sentry: error monitoring.

We may also disclose information if required to do so by law, to enforce our Terms, or to protect the rights, property, or safety of CurbsideOps, our users, or others. If we undergo a merger, acquisition, or asset sale, your information may be transferred as part of that transaction, and we will notify you before Google user data becomes subject to a different privacy policy.

6. Data Retention

We retain your account data for as long as your account is active. Operational data (events, conversations, logs) is retained to support the Service and for reasonable audit and billing purposes. Section 12 describes what happens to Google data when you disconnect Google.

When you close your account, we delete your account’s records (including staff, customers, credentials, synced Google data, and Event Reports) within 30 days. Copies in encrypted database backups are removed as those backups expire, and we keep billing records as long as tax and accounting law requires.

7. Security

All traffic to and from the Service is encrypted in transit with TLS. Third-party credentials, OAuth tokens, and bot tokens are additionally encrypted with AES-256 at the application layer, and our database and file storage are encrypted at rest by our hosting providers. Tenant data is isolated using PostgreSQL row-level security so one customer’s data cannot be accessed by another. Access to production systems is restricted to authorized personnel. No system is perfectly secure; we cannot guarantee absolute security, but we work to protect your information with appropriate technical and organizational measures.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You may also withdraw consent for an integration at any time by disconnecting it in the portal. To exercise these rights, email support@curbsideops.com. We will respond within the time required by applicable law.

9. International Users

CurbsideOps is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. and other jurisdictions where our subprocessors operate.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify you through the Service or by email. Continued use of the Service after the effective date of an updated Policy constitutes your acceptance of the changes.

12. Google User Data

CurbsideOps’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

You connect Google Calendar and Gmail separately, and you can connect one without the other. We only request the permissions listed here.

Google Calendar

  • What we access. The list of calendars you can see (scope calendar.calendarlist.readonly), and the events on those calendars (scope calendar.events): titles, times, locations, descriptions, and attendees. We never create or delete a calendar, and never change calendar sharing or settings.
  • How we use it. To show your schedule in the portal and to your crew, plan trucks and staff for each event, write morning briefings, check weather and drive times for event locations, and parse booking details out of event descriptions. If you use AI Marketing, we also use your events to suggest posts and short videos about them, and the areas where your events take place to suggest nearby organizations you could serve; nothing is posted or sent to anyone without your approval. When you or your team create, edit, reschedule, assign, or cancel an event in CurbsideOps, we create, update, or delete that event in your Google Calendar.
  • How we store it. We keep a copy of your events so the Service works quickly and keeps your booking history when an event changes in Google.

Gmail

  • What we read (scope gmail.readonly). Messages you receive, starting with the seven days before you connect, and the earlier messages in those conversations, including each message’s sender, recipients, subject, body, and the names and sizes of attachments (we do not download attachment contents). We also read your Gmail address and your “send mail as” addresses so replies leave from an address you are allowed to use.
  • How we use it. AI sorts each message to find catering and booking inquiries, pulls out the details (customer, date, location, headcount) to create leads in your Catering Inbox, and drafts replies based on your menu, prices, and availability. Messages that are not inquiries are labeled and kept out of your work queue.
  • What we write and send (scope gmail.compose). We create draft replies in your Gmail for you to review. We send email from your Gmail address only when you press Send, or when you turn on an automation that emails your customers on your behalf (for example proposals, deposit and event reminders, e-signature requests, and review requests). You can turn each automation off at any time.
  • How we store it. We keep copies of the messages we read and the drafts we create so your Catering Inbox shows the full conversation. For email that was clearly not an inquiry, we may delete the copied text after 30 days and keep only the sender, subject, and date; you can bring the text back from Gmail at any time, and anything you mark as an inquiry is kept.

Who else receives Google data

We transfer Google user data only as needed to provide the features above: to Amazon Web Services Bedrock (Anthropic Claude) for sorting, extraction, drafting, and briefings; to Google Gemini when you use voice; to Microsoft Azure and OpenWeatherMap for the addresses of your events; to SerpApi for event names, places, and the areas where your events take place when AI Marketing researches an event or suggests nearby organizations; to fal.ai (the image, video, and sound models it hosts) for event names and places when you create a marketing image or video about an event; to Telegram, to deliver previews and briefings to you and your crew; and to Render, Cloudflare, and Sentry, which host and monitor the Service. If you connect HubSpot, customer contact details, including ones taken from inquiry emails, sync to your HubSpot account.

Aggregated and anonymized data

From your Google data we derive only two kinds of aggregated data. First, totals shown to you in your own account, such as how many events or how much in sales you had at a location or in a month. Second, service metrics with no content in them, such as how many messages were processed or how long a request took, which we use to run, meter, and fix the Service. Aggregated or anonymized data derived from Google user data follows the same rules as the raw data: it is never sold, never shared with advertisers or data brokers, never used for advertising, and never used to train AI or machine learning models.

How we protect Google data

  • Google data travels encrypted (TLS) between Google and us, and between us and the providers listed above.
  • Google access and refresh tokens are encrypted with AES-256 at the application layer before they are stored, and are never sent to your browser.
  • Our database and file storage are encrypted at rest, and each business’s data is isolated with database row-level security so no other customer can reach it.
  • CurbsideOps staff can view your Google data only as described under “How we limit use” below, and every such access is logged.
  • Email content is removed from our error reports before they leave our systems.

How we limit use

  • We use Google user data only to provide and improve the user-facing features described above. We never use it for advertising, never sell it, and never use it to determine credit-worthiness or for lending.
  • We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models.
  • We do not transfer Google user data to others except as described above, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.
  • No person at CurbsideOps reads your Google data unless you ask us to (for example, when you turn on support access so we can help with a problem), it is needed for security purposes or to comply with applicable law, or the data has been aggregated and anonymized for internal operations. Every time our staff view your Gmail or Calendar content, the access is logged.

Disconnecting and deleting

  • You can disconnect Google Calendar or Gmail at any time from the Integrations page in the portal. When you do, we delete the stored OAuth tokens for it, and when no other CurbsideOps connection uses the same Google account, we also revoke our access with Google. Closing your account revokes every Google connection.
  • When you disconnect Gmail, we delete the email content we copied from Gmail (message bodies, quoted text, and attachment details). The leads, customers, and proposals you created from those emails stay in your account until you delete them.
  • When you disconnect Google Calendar, the events already in CurbsideOps stay as your booking records, with their sales and staffing, until you delete them or close your account. We stop reading and writing your Google Calendar.
  • You can also remove our access from your Google Account permissions page, and ask us to delete any Google data by emailing support@curbsideops.com. When you close your account, all Google data is deleted as described in section 6.

13. Contact

StoneFrame Labs, LLC d/b/a CurbsideOps
Questions, requests, or privacy concerns: support@curbsideops.com