Portal Privacy Policy

GSC Estimating Portal — Privacy Policy

Effective date: October 14, 2026.

1. Who we are

Growth State Consulting ("GSC," "we," or "us") provides GSC Estimating Portal to authorized businesses. Contact marco@growthstateconsulting.com or write to 182 Willow St, Stoughton, MA 02072-1029.

This policy covers information processed through the portal and its enabled integrations. It does not replace the privacy policies of QuickBooks, HighLevel, OpenAI, or a contractor's own website. Client businesses determine the purposes of their customer-record processing; GSC processes those records to deliver the agreed service. GSC also manages portal access, support, and security information for its own operations.

2. Information processed

Depending on the enabled features, we process:

• Account and access information, such as your name, email, sign-in identifiers, and authorized business environment.

• Customer and job information, including names, email addresses, phone numbers, property addresses, lead and opportunity stages, project descriptions, and instructions you submit.

• Estimate and billing information, including line descriptions, amounts, dates, allowances, payment schedules, document identifiers, status, and linked customer records.

• Integration authorization information, including company identifiers and access or refresh tokens where an integration uses them. These allow the Service to communicate with authorized systems; they are not intended for customer-facing output.

• Operational information, such as timestamps, action receipts, error information, and technical request information handled by our hosting and service providers.

QuickBooks integration is being prepared. Until a company authorizes and enables that integration, the portal does not have direct access to that company's QuickBooks data through the new connection. Once enabled, relevant accounting records will be accessed to support the disclosed estimate and billing features. We do not need your banking password or full payment-card information for estimate drafting. Do not put passwords, government identifiers, or unnecessary sensitive information into assistant messages.

3. Sources and purposes

Information comes from authorized users, connected business systems, and service operation. We use it to authenticate and limit access, retrieve the correct customer and job, prepare and save reviewed records, track approved actions, synchronize enabled integrations, provide support, and troubleshoot and protect the Service.

AI services process assistant instructions and estimate text to interpret requests, ask follow-up questions, translate content, and produce company-approved scope wording. Names and contact details may be present in assistant requests; scope text may include property addresses and pricing. You should submit only information needed for the task.

4. Service providers and disclosures

The current pilot uses HighLevel for CRM and estimate/billing records, OpenAI for AI processing and the Sites/sign-in experience, and Cloudflare infrastructure for application hosting and database storage. If enabled and authorized, Intuit QuickBooks Online will receive or supply relevant customer, estimate, and accounting information.

These providers receive information needed to perform their part of the Service. Provider policies govern their own processing and retention. The portal's current AI requests use the API with response storage disabled; this does not mean providers keep no logs or retain no data under their policies.

Authorized GSC personnel and authorized users of the client business may access information needed to administer and use the Service. We may disclose information when legally required, to protect security or rights, or as part of a business transfer subject to appropriate protections and applicable notice requirements.

The portal does not currently implement advertising trackers or advertising sales of customer records. Any future material change to data use will require updated disclosures and any legally required permissions.

5. Storage and retention

Customer and document records can remain in HighLevel or QuickBooks under the client's settings and those providers' policies. The portal also stores action-tracking records in its database to help prevent duplicates and reconcile billing operations. Assistant conversation state currently resides in the active browser interface; it is sent to the AI service when you submit a message, but the application does not currently maintain a separate persistent chat-history database.

GSC retains information only as needed for service delivery, reconciliation, security, and applicable recordkeeping obligations. Retention depends on the type of record and the connected system. A specific automated deletion schedule has not yet been established for this pilot. Contact GSC to request deletion; we will verify authority, identify relevant application-held records, and explain any records that must be retained and the reason. Provider logs and backups may follow separate retention schedules.

6. Disconnecting and deleting information

You can revoke a QuickBooks connection through the connected-app controls available in your QuickBooks account. You can also contact GSC to request disconnection of the portal's integrations, termination of portal access, or deletion of information held by GSC. Revocation and deletion are different: disconnecting does not delete estimates, contacts, or invoices already saved in HighLevel or QuickBooks.

GSC will securely delete applicable user data upon a verified request, subject to lawful recordkeeping obligations. To remove records held independently in a connected system, the authorized business administrator may need to use that system's controls or submit a request to that provider. We will help identify the relevant records. We may need to retain limited evidence of a completed deletion request or transaction where law requires it.

7. Security

The current portal uses signed-in access, an authorized-user allowlist, server-side integration secrets, and review steps for supported write actions. Security is an ongoing responsibility; no online service can promise absolute protection. Report suspected unauthorized access to marco@growthstateconsulting.com. Do not send credentials in a support email.

8. Your choices and applicable rights

Depending on applicable law, you may have rights to access, correct, obtain a copy of, or delete personal information, or to object to or restrict certain processing. Submit requests to the contact above. GSC may verify identity and authority. If your information was supplied by a client business, we may coordinate your request with that business. We will handle requests within applicable legal requirements.

9. International processing and children

Our providers may process information in the United States and other locations where they operate. The portal is intended for authorized adult business users, not children. It is not designed to collect children's information.

10. Changes and contact

We will update this policy when the Service's data practices materially change and provide notice where required. The effective date will identify the published version.

Questions, privacy requests, and disconnection requests:

Growth State Consulting — marco@growthstateconsulting.com

182 Willow St, Stoughton, MA 02072-1029