Privacy Policy

This Privacy Policy explains how Pearl Tech Inc. (“Kept,” “we,” or “us”) collects, uses, and shares personal information through Kept, the invoicing service at https://kept.pearltech.xyz, including the emails, invoice pages, and PDFs it sends (the “Service”).

Kept is software that independent contractors use to bill their own clients by milestone. A contractor describes a deal in a chat, our AI drafting assistant turns it into a milestone plan, and Kept makes an invoice for each milestone. The contractor sends each invoice by email through Kept or by sharing its link, and can attach proof of the work. The client reviews the invoice on a web page, can approve delivered work or say what's missing, and pays the contractor directly through the contractor's PayPal.me link. Kept never receives or handles those payments.

This Policy covers three groups of people:

• Contractors: people and businesses who have a Kept account.
• Clients: people and businesses a Contractor bills through Kept. Clients don't have accounts. They receive emails and use invoice links.
• Visitors: anyone who visits our website.

1. Summary

• We collect what Contractors give us to make and send invoices, what Clients do on their invoice pages, and technical data our providers log when anyone uses the Service.
• We use it to run the Service. We don't sell personal information, share it for targeted advertising, or show ads, and we don't use analytics or advertising cookies.
• A Contractor's chats with our AI drafting assistant, along with their clients' names, email addresses, and billing addresses, are sent to Anthropic to draft plans and notes. Anthropic doesn't train its models on them, and neither do we.
• Everything on a sent invoice, including the Contractor's tax ID if they add one, can be seen by anyone who has that invoice's link.
• We tell Contractors when an invoice link is first opened.
• Anyone can ask us to access, correct, or delete their information by emailing pearl@pearltech.xyz.

2. Information we collect

From Contractors

• Sign-in information: your email address. If you continue with Google, Google also gives us your name, your Google account ID, and a link to your profile picture (see section 3). Our sign-in provider records sign-in events, including the IP address and browser used.
• Your invoice details: your name, business name (optional), the email address clients reply to, your PayPal email address and PayPal.me username, and, if you add them, your business address and tax ID. These appear on every invoice you send.
• Your clients: each client's name, email address, and, if you add it, billing address.
• Chats and plans: what you type to our drafting assistant, its replies, the plans drafted from them (project title, milestone names, amounts, due dates, and “done means” items), and your edits.
• Invoices and their history: invoice numbers, amounts, due dates, and status, and when each invoice was sent, first opened, approved, flagged for a fix, said to be paid, and confirmed paid.
• Proof of delivery: the image and PDF files and the links you attach as proof, and the note you send with them.
• Messages to us: anything you send us when you contact us.

About Clients

• From the Contractor: your name, email address, and, if the Contractor adds it, your billing address, plus whatever the Contractor puts in the plan and invoice, such as the project and the work.
• From you, on your invoice page: when you approve a delivery, the items you say are missing and any note you add, and when you say you've paid (or undo that).
• When the invoice link is first opened: the date and time, which we show the Contractor. We don't record or show who opened it, though our providers' technical logs (below) include the IP address of each visit.
• Replies: emails we send for a Contractor set the Contractor's email address as the reply address, so when you reply, your reply goes to the Contractor, not to us.
• Payments: we receive nothing from PayPal. You pay on PayPal's site, and we only know about a payment when you or the Contractor tell us in the Service.

From everyone

• Technical data: when you use the Service, our hosting, database, and email providers log technical data such as your IP address, browser and device type, the pages and files requested, and the time.
• Cookies: see section 8.

Social Security numbers

We don't ask for Social Security numbers, and you shouldn't enter one. The tax ID field is for an EIN or a VAT number. Whatever you put there is printed in full on every invoice you send and shown on its invoice page, and it can't be removed from an invoice once that invoice is sent. If you don't have an EIN, leave the field empty. If you enter a Social Security number anyway, it's treated like any other tax ID: it's printed on your invoices and shown to your Clients and to anyone who has an invoice link, and it can't be removed from an invoice once that invoice is sent. Apart from that, we use it only to show it on your invoices, and we don't disclose it except to the providers who store and deliver your invoices (section 6) or as the law requires.

We don't ask for payment card or bank account numbers, government ID numbers other than a tax ID you choose to add, precise location, or health information.

3. Google sign-in

If you continue with Google, Google shares your name, email address, Google account ID, and a link to your profile picture with us. We ask only for basic profile and email access. We don't ask for access to your Gmail, Google Drive, Calendar, contacts, or any other Google data.

• How we use it: to create your account, sign you in, and fill in your name and email address when you first set up your invoice details. We don't use your profile picture.
• How we share it: it's stored by Supabase, our sign-in and database provider. We don't sell it, use it for advertising, or send it to AI providers, and we don't transfer it to anyone else except as needed to run the Service, to comply with the law, or as part of a business transfer described in section 6.
• How long we keep it: until your account is deleted. You can also remove Kept's access at any time from your Google Account's third-party connections page.

Kept's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

• To run the Service: sign Contractors in; save their chats, plans, and clients; create invoices and PDFs; send the emails Contractors ask us to send; show Clients their invoice pages and proof; and record approvals, fix requests, and payment status.
• To draft with AI: to draft milestone plans and delivery notes from what a Contractor types (section 5).
• To send service emails: sign-in links; invoice, delivery, and receipt emails to Clients when a Contractor sends an invoice or confirms a payment; and notices to Contractors when a Client asks for a fix or says they've paid. We don't send marketing email. If we start, we'll send it only to Contractors, and every marketing email will have an unsubscribe link.
• To show Contractors what happened: when an invoice link was first opened, and what the Client approved, flagged, or said they paid.
• To support you: answer questions and tell you about changes to the Service or these policies.
• To keep the Service safe: prevent and investigate fraud, phishing, abuse, and security problems, find and fix errors, and enforce our Terms of Service.
• To meet legal obligations and respond to lawful requests.

We don't use personal information for advertising, we don't use it to train AI models, and we don't make decisions about anyone based solely on automated processing that have legal or similarly significant effects.

5. AI drafting assistant

Kept uses Anthropic's Claude models, through Anthropic's API, in two places:

• Plan chat. Each time a Contractor sends a message, we send Anthropic the conversation so far, today's date, the current draft plan (which can include the client's name, email address, and billing address), and the names, email addresses, and billing addresses of the Contractor's clients who aren't archived, so the assistant can match the right client.
• Proof chat. Each time a Contractor sends a message, we send Anthropic the milestone's name and “done means” items, the conversation so far, the current note to the client, and, for each attached item, its type and a short label (a file name, or the name of the website a link points to). We don't send the files themselves.

The assistant only drafts. It doesn't send email, change records, or decide anything about a Contractor or a Client. The Contractor reviews and can edit every draft, and AI output reaches a Client only when the Contractor sends the invoice or copies its link.

Anthropic's commercial terms don't allow it to train its models on what we send. Under its current policies, Anthropic deletes API inputs and outputs within 30 days, but may keep content it flags for violating its usage policy longer, or as the law requires. We don't use your information to train or fine-tune AI models, and we'll ask for your permission before we ever do.

6. How we share information

We don't sell personal information, and we don't share it for cross-context behavioral advertising or targeted advertising. We share it only in these ways:

• Between a Contractor and their Client. A Client sees everything on the invoice and invoice page: the Contractor's name and business name, reply email address, PayPal email address and PayPal.me username, and any address and tax ID they added; the plan summary; and any proof and note the Contractor sent. The Contractor sees the Client's actions on the invoice page and when the link was first opened.
• With anyone who has an invoice link. Invoice links work without signing in. Anyone who has a link can see that invoice's page and PDF, including the details above, until the Contractor voids the invoice. We ask search engines not to index these pages, and proof files open through links that expire after 10 minutes.
• With our service providers, which process information on our behalf to provide their services to us:

  Provider	What it does for us
  Supabase	Database, sign-in, file storage, and the server functions that send email and call our AI provider
  Cloudflare	Hosting, content delivery, and security for the website
  Anthropic	AI drafting of plans and delivery notes (section 5)
  Resend	Sending email, including invoices and their PDFs
  Google Workspace	Our support email, including requests, reports, and other messages you send us

  We'll update this list before we add a provider that receives personal information.
• With services you choose. If you continue with Google, Google handles sign-in under its own privacy policy. When a Client selects Pay with PayPal, they leave Kept for PayPal's site, and the link carries only the Contractor's PayPal.me username and the amount. PayPal's privacy policy, not this one, covers what you give PayPal.
• For legal reasons: when we believe in good faith that disclosure is required by law or legal process, or is needed to protect the rights, property, or safety of Kept, our users, or others, including to investigate fraud or phishing.
• In a business transfer: if we're involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that deal. We'll tell Contractors before their information becomes subject to a different privacy policy.
• At your direction: when you ask us to share information with someone.

7. Our role for Clients' information

When a Contractor adds a client and sends invoices, we handle the Client's information on the Contractor's behalf, to provide the Service to that Contractor. The Contractor decides whom to bill, what their invoices say, and when to send them, and is responsible for having the right to use their Client's information that way. We're responsible for what we do ourselves: delivering the emails, showing the invoice page, recording when it was first opened, and keeping the information secure. If you're a Client, see section 11 for how to make a request.

8. Cookies and similar technologies

When a Contractor starts signing in, we set cookies, through our sign-in provider's software, that complete the sign-in and keep them signed in. These are necessary for the Service; if you block them, you can't sign in. Apart from these, we don't set cookies for Clients or Visitors. Our hosting provider, Cloudflare, may set a cookie to protect the site from bots and abuse.

We don't use analytics, advertising, or social media cookies, pixels, session recording, or other third-party tracking scripts, and we don't track you across other websites. Because we don't sell or share personal information or use it for targeted advertising, there's nothing for a Global Privacy Control signal to opt you out of. We don't respond to Do Not Track signals.

9. How long we keep information

When we delete an account, we delete everything in it, including sent invoices, client records, chats, and proof files, within 30 days of the request. Copies in backups we make before system changes are deleted within 90 days. Once an account is deleted, its invoice links stop working. We may keep a record of the request, and information we need to comply with the law, resolve a dispute, or deal with fraud or abuse.

10. Security

We protect information with measures that include: encryption in transit (HTTPS) for the website, invoice pages, and our connections to our providers; database rules that keep each Contractor's records separate from every other Contractor's; private file storage, where Clients open proof files only through links that expire after 10 minutes; invoice links built on long random codes that can't practically be guessed; and keeping our service keys on our servers, never in the browser. Our database and storage provider encrypts data at rest.

No system is perfectly secure, and we can't guarantee that information won't be accessed, changed, or lost. If a security breach affects your personal information, we'll notify you as the law requires. You can help: keep the email account you sign in with secure, share invoice links only with the people who should see them, and void an invoice to turn off its link.

11. Your choices and rights

In the app, Contractors can edit their invoice details, edit or archive clients, delete clients who have never been sent an invoice, delete chats and draft invoices, and void sent invoices.

By email, wherever you live, you can ask us to:

• tell you what personal information we have about you and give you a copy;
• correct information that's wrong;
• delete your information, including your whole account; or
• stop using your information for a particular purpose.

Email pearl@pearltech.xyz. Contractors should write from the email address they sign in with. We may need to confirm your identity before acting, and we'll respond within 30 days. We won't charge you or treat you differently for making a request. There's no delete button in the app yet, so account deletion is by email. Before you ask, download the PDFs of any invoices you need for your records: once an account is deleted, we can't restore it.

If you're a Client, the Contractor controls their invoices. Your details on an invoice that has been sent are a fixed record of that invoice: they can't be corrected or deleted while the Contractor's account exists. We can turn off the invoice's link, and we won't use your details for anything other than keeping that record and the purposes in section 4. Ask the Contractor first; you can reach them by replying to their email. You can also write to us, and we'll pass your request to the Contractor and handle the parts we control ourselves. If you didn't expect an invoice, or think one is fake or a phishing attempt, email pearl@pearltech.xyz with the invoice link. We'll look into it, and if it was sent improperly we can turn off its link and close the account that sent it.

12. U.S. state privacy laws

Several U.S. states give their residents privacy rights by law. We offer the rights in section 11 to everyone, whether or not a law requires it. We don't sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, so there is nothing to opt out of. California residents: we don't disclose personal information to third parties for their own direct marketing purposes.

13. People outside the United States

Kept is run from the United States and is for Contractors based there. Clients can be anywhere. Our providers store and process information in the United States and in other countries where they operate, and Cloudflare serves the website from data centers around the world. Privacy laws where you live may differ from U.S. law. Wherever you live, you can use the rights in section 11.

14. Children

Kept is for adults running a business, and Contractors must be 18 or older. The Service isn't directed to children, and we don't knowingly collect personal information from children under 13. If you believe a child has given us personal information, email pearl@pearltech.xyz and we'll delete it.

15. Changes to this Policy

When we change this Policy, we'll post the new version here and update the date at the top. If a change is material, we'll email Contractors before it takes effect. We won't use information we already have in a materially different way without asking you first. Earlier versions are available on request.

16. Contact us

Pearl Tech Inc.
415 Mission Street, Floor 37, San Francisco, CA 94105
Email: pearl@pearltech.xyz

See also our Terms of Service.