Privacy Policy
GoodStand ("we", "us") is a compliance workspace for U.S. business owners, operated by VentureFactory. This policy explains what we collect, why, and the choices you have. The short version: your documents are yours, we encrypt them, we don't sell data, and access is controlled by you.
What we collect
- Account data — email address, name, phone (optional), password hash (managed by our authentication provider, Supabase).
- Business data you add — company details (legal name, state, EIN if you provide it), licenses, properties, workers, tasks.
- Documents and letters you upload — files, their extracted fields, dates, and AI-generated summaries.
- Personal compliance data you choose to add — e.g. residence state, immigration status category, tax-ID type, for your personal deadline tracking.
- Usage and audit data — sign-ins, document opens, downloads and changes (kept in an append-only audit log so you can see who accessed what), IP address and browser info for security.
How we use it
- To run the product: track deadlines, classify documents, build filing packets, send reminders you enabled.
- AI processing: uploaded documents and government letters are processed by AI models to classify them and extract dates and fields. Extractions the AI is not confident about are routed to you for confirmation, not saved silently.
- To secure the service: rate limiting, abuse and fraud prevention, audit logging.
- To communicate service messages (deadline reminders, security notices).
How your data is protected
- All traffic is encrypted in transit (TLS; plain HTTP is disabled with HSTS).
- Uploaded files are encrypted at rest (AES-256-GCM) with the encryption key stored separately from the data.
- Two-factor authentication is available for every account.
- Role-scoped access: an accountant you invite sees only the companies and scopes you grant — never your personal vault. You can revoke access in one click.
- Document share links (SecureLinks) expire, can be view-limited, and can be revoked instantly; every access is logged.
Sharing
We do not sell or rent your data. Data is shared only: (a) with people you explicitly grant access to (e.g. your accountant); (b) with the infrastructure providers we use to run GoodStand (hosting, authentication, AI processing), bound to process it only for us; (c) if the law requires it.
Retention and deletion
Your data is kept while your account is active. You can delete documents, companies, and shares yourself in the app. To delete your account and its data entirely, email hello@getgoodstand.com — we will confirm and complete deletion within 30 days, except records we must keep for legal or security reasons.
Your choices
- Export or download your documents at any time.
- Revoke any member's or accountant's access at any time.
- Disable reminders/notifications in settings.
- Request a copy or deletion of your data by email.
Children
GoodStand is for business use and not directed to children under 13.
Changes
We will post any changes here and update the date above. Material changes will be announced in the product.
Contact
VentureFactory · GoodStand · hello@getgoodstand.com