Privacy and Consumer Data Rights Policy
Epiglass operates Ops OS at app.epiglass.ai, a service that reads a business's existing systems — its accounting books, bank and card accounts, mail and files, point of sale — into one place, and writes back to the books only when a member of that business approves. This policy explains what information we handle, where it comes from, how we use and share it, how long we keep it, and the rights you have over it.
Version 1.7, effective October 15, 2026. Questions and requests: privacy@epiglass.com.
1. Who this covers, and our two roles
- Members are the people who sign in to Ops OS on behalf of a business. For your account information we decide how it is used, and this policy applies to you directly.
- People who appear in a business's records — its vendors, customers, employees, landlords, and counterparties — are in Ops OS because the business connected systems that already hold that information. For those records we act on the business's instructions as its service provider. The business remains responsible for that information; we help it honor your requests (Section 11).
- Visitors to our public pages are covered by Section 3 only.
2. What we collect
Account information. Your name and email address, and the sign-in your identity provider (Clerk) manages. We never see your password. Which business you belong to and your role in it (owner, operator, controller, bookkeeper, CPA, attorney, viewer).
If you are on a business's team, the business may connect its payroll or HR system or upload its roster, which places your name, role, location, hire date, employment type, and date of birth in Ops OS so the business can see its team and mark birthdays and work anniversaries. Your birthday is shown as month and day only, never with your age. Pay and identity numbers are never requested.
Your mobile number and text messages, if you turn on texting. The mobile number you verify, the date, time, and wording of the consent you gave, and the messages and photos you send to and receive from our text number. See Section 8.
Business records, only from systems a member connects.
| Source | What we receive | What we do not take |
|---|---|---|
| Accounting system (QuickBooks Online) | The general ledger, chart of accounts, vendors, customers, bills and invoices, and the changes a member approves us to make | Nothing beyond the books themselves |
| Bank and card accounts, through Plaid | Account names, types, and last four digits; balances; transactions with dates, amounts, descriptions, and merchant names | Bank login credentials — those are entered on Plaid's screens and never reach us |
| Mail (Google Workspace, read only) | Message headers and labels; redacted bodies of messages a business needs to remember; copies of attachments a task identifies as business documents: contracts, invoices and credit memos, insurance certificates, agency notices | Unredacted bodies and snippets; bodies of personal, internal, marketing, or other messages not selected to keep |
| Files (Google Drive, read only) | Folder and file names; copies of business documents | Anything a task did not classify as a business document |
| Point of sale | Orders, payments, and line items | Customer or patient names — orders carry an opaque reference only |
| Payroll or HR system (connected through Finch, or its export uploaded) | The team roster: names, work email and phone, role, department and location, hire and end dates, employment type, date of birth | Pay, tax, bank, and identity numbers — never requested |
Technical information. Server logs carrying the account and business identifiers needed to operate and secure the service. Logs never contain credentials, message content, or document content.
Cookies. A sign-in session cookie set by Clerk; a cookie remembering which business you last viewed; a browser setting remembering whether the assistant panel is open. We set no advertising or cross-site tracking cookies.
3. Where it comes from
Everything in Section 2 comes either from you (your account, your actions) or from a system a member of your business connected on purpose: through QuickBooks' authorization screen, Google's authorization screen with read-only permissions, or Plaid Link, where you choose your bank and consent on Plaid's own screens. Nothing is connected on anyone's behalf, and members can see what is connected and disconnect it at any time under Connections.
4. How we use it
- To provide the service: the overview of the business, its obligations calendar, its exceptions inbox, its vendors and contracts, its payables and bank activity, and the review queues where members decide what to record.
- To create or change records in the business's accounting system, only when a member approves each change, with the state before the change kept so it can be reconstructed.
- To suggest: decision and language models, including SubQ, read extracted document text and mail headers and candidate message bodies to label threads, decide which business messages to keep, read invoices, and propose categories. Their outputs are suggestions until a member accepts them. We do not use your data to train models.
- To keep the service secure and working: authentication, audit trails, error diagnosis.
- To communicate with members about the service, including by text message to members who opted in (Section 8).
We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for advertising of any kind.
5. Who we share it with
We share information only with providers that operate parts of the service under agreements limiting what they may do with it, and only what each needs.
| Provider | Purpose | What it handles |
|---|---|---|
| Neon | Database hosting | The business's records, encrypted at rest |
| Vercel and Fly.io | Application and background-job hosting | Data while it is being processed |
| Amazon Web Services | Encryption keys; document storage | Keys; encrypted copies of business documents |
| Clerk | Sign-in and sessions | Member identities |
| Plaid | Bank and card connections, read only | Account and transaction data; the access token, which we encrypt |
| Intuit | The accounting system of record | The books; approved changes |
| Mail and files, read only | Message headers; the documents a task classifies | |
| Finch | Payroll and HR connections, read only | The roster; the access token, which we encrypt |
| Inngest | Scheduling background jobs | Job identifiers only, never credentials |
| Telnyx | Sending and receiving text messages | Your mobile number and the messages and photos exchanged with our text number |
| SubQ, TypeSafe, and Anthropic | Decision and language models | Extracted document text, mail headers, and candidate message bodies for the task at hand, never credentials |
We may also disclose information when the law requires it, to protect the rights and safety of Epiglass, our customers, or others, or as part of a merger or acquisition, in which case this policy continues to apply to the information transferred.
6. Bank connections through Plaid
When a member connects a bank, Plaid collects the information needed to do so from the bank and provides it to us. Plaid's handling of that information is governed by Plaid's End User Privacy Policy. Our access is read only; we do not move money. You can disconnect a bank in Ops OS at any time, which revokes and deletes our stored access, and you can manage Plaid connections across all apps at my.plaid.com.
7. Google user data
When a member connects Google, Ops OS asks Google for read-only access to Gmail (gmail.readonly) and Google Drive (drive.readonly), plus the email address of the connecting account. We use that access to find the business's contracts, invoices, insurance certificates, notices, and deadlines and to show them in Ops OS. We never send, change, or delete mail or files.
Ops OS no longer reads Google Calendar. Accounts connected before October 12, 2026 may still list Calendar access for Epiglass in their Google account; Ops OS does not use it, and disconnecting Google in Ops OS revokes it.
If the company's owner turns on filing, Ops OS also asks for access to the Drive files it creates (drive.file), and files key business documents that exist only in mail (signed contracts, insurance certificates, agency notices) into an "Epiglass" folder in the connected account's Drive. With that access Ops OS can see and change only the files it created there, never the rest of the Drive. The owner can turn filing off at any time; what was filed stays in the account's Drive.
Epiglass's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the features a member can see in Ops OS, as described in this policy.
- We transfer it to others only as needed to provide those features (the providers in Section 5), to comply with law, for security, or as part of a merger or acquisition with the user's notice.
- People at Epiglass do not read it unless the member asks us to (for example, for support), it is needed for security or to comply with law, or it has been aggregated and anonymized for internal operations.
- We do not use it for advertising, do not sell it, and do not use it to develop, improve, or train generalized artificial intelligence or machine learning models.
A member can disconnect Google in Ops OS under Connections, or remove Epiglass's access at myaccount.google.com/permissions. Either revokes our access and deletes the stored credential.
8. Text messages
Members can choose to text Ops OS: to ask about their business, send a photo of a receipt, and receive alerts about their business such as a missing receipt or a filing coming due. Texting is off until you turn it on. You opt in by entering your mobile number in Ops OS, confirming the code we send it, and checking the box that says you agree to receive texts. Consent to texts is never a condition of using Ops OS or of any purchase.
- No sharing for marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
- What we will not text. We never send passwords, sign-in codes other than the one confirming your number, bank or card account numbers, or identity numbers by text. Where an answer would include them, we send a link that requires you to sign in.
- Texts do not approve changes. A text cannot approve a change to your books. Approvals happen only after signing in to Ops OS.
- Stopping. Reply STOP to our number at any time, or turn texting off in Ops OS; we confirm once and send nothing more. Reply HELP for help, or email support@epiglass.ai. Message and data rates may apply. Message frequency varies with your business's activity.
9. How long we keep it
- Connected systems. While the connection is active. Disconnecting revokes and deletes the stored credential immediately.
- Mail. Headers, labels, and sensitive-data-redacted bodies of messages selected as useful to the business while the mail connection is active. Other message bodies and snippets are not kept. Document copies stay in the business's library until the business deletes them or leaves.
- Books, bank records, and documents. While the business remains a customer, because they are the business's own history.
- Leaving. When a business ends its relationship with us, its database and stored documents are deleted within 30 days of the request and its credentials are revoked at once. Deleted data can persist in the database provider's recovery window, not exceeding 30 days, after which it is unrecoverable.
- Text messages. Message wording for 90 days. A receipt photo you text becomes a document in the business's library and is kept like any other. The record of your consent and of any opt-out, for four years after texting ends, as proof of consent.
- Logs. 90 days. Audit trails of approvals and changes, for the life of the customer relationship.
10. How we protect it
Each business's records live in their own isolated database. Every credential that grants access to a business's systems is encrypted by the application with keys held in a managed key service before it is stored, and is never logged or shown. All connections use TLS 1.2 or better. Every change to a business's books requires a member's approval and is recorded in an audit log that cannot be altered. Our Information Security Policy describes these controls in detail; ask for it at security@epiglass.com. Report a suspected security problem to the same address.
11. Your rights
You may ask us to:
- Tell you what personal information we hold about you and how it is used.
- Correct information that is inaccurate.
- Delete your information.
- Give you a copy in a portable form.
- Restrict or object to a use of your information.
- Not be discriminated against for exercising any of these rights.
We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of on that front; we honor Global Privacy Control signals as an opt-out request regardless.
How to ask. Email privacy@epiglass.com. Members can also correct their own account details and disconnect systems in the application. We will verify that a request comes from the person it concerns, or an authorized agent, using your account or the email on file. We respond within 45 days, and tell you if we need up to 45 more.
If you appear in a business's records. We process that information for the business, so we may direct your request to the business, and we will help it respond within the time the law requires.
Appeals. If we decline a request, we will tell you why. You may appeal by replying to our decision within 30 days; a different person will review it and answer within 45 days. Residents of states whose privacy laws provide for it may also contact their state Attorney General.
State-specific notice. For residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with consumer privacy laws: the categories of personal information we collect are identifiers and contact details (members), professional information (your role), commercial and financial information (the business records in Section 2), and internet activity (Section 2, technical information). Sources, purposes, and recipients are in Sections 3 through 5. We have not sold or shared personal information in the preceding twelve months.
12. Children
Ops OS is for businesses and is not directed to anyone under 18. We do not knowingly collect information from children under 13; if you believe we have, contact privacy@epiglass.com and we will delete it.
13. Where data is processed
We host and process data in the United States. If you use the service from elsewhere, your information is transferred to and processed in the United States.
14. Changes to this policy
We will post any revision here with a new version number and effective date, and tell members by email before a material change takes effect. Earlier versions are available on request.
15. Contact
Privacy questions and requests: privacy@epiglass.com. Security matters: security@epiglass.com.
Version 1.7 · effective October 15, 2026 · Epiglass