Privacy Policy

1. Information we collect

• Account information. Your name, email address, password, shop or company name, and plan. If you sign in with Google, Google shares your name and email address with us.
• Business data you enter or upload. Your customers' names, email addresses, phone numbers and mailing addresses; orders, quotes, line items, notes, artwork, proofs and other files; your product catalog, prices and supplier connections; shipments; and the content of your shop's website.
• Supplier information. If you use the supplier portal, your company details and the product catalog you upload.
• Data from accounts you connect. If you connect another service, we retrieve data from it on your behalf. See section 4.
• Billing information. Your plan, subscription status and payment history. Card numbers are entered on Stripe's own payment pages and never reach our servers.
• Sign-up and security checks. When you start a free trial we record the network block your sign-up came from (for example 203.0.113.0/24, not your full IP address) and the domain of your email address, to stop automated sign-ups. Our hosting and sign-in providers see your IP address and browser details when you connect, as every website's do, and we use your IP address briefly to limit repeated requests.

2. How we use information

We use your information to run AJ-Hub for you: to show and manage your orders, customers, quotes, catalog and website; to sync with services you connect; to send the messages you send or set up; to run your subscription and send account emails (for example about your trial or a failed payment); to keep the service secure and stop abuse; and to answer support requests. We do not sell your information, we do not show you advertising, and we do not use your business data or your customers' data to train AI models.

3. AI features

Five features use Claude, an AI model made by Anthropic. They run only when you use them:

• reading an invoice PDF you upload, to fill in an order;
• drafting the headline, tagline and about text for your website;
• building your website from a one-sentence description, including picking products from suppliers you have connected;
• the website assistant, which answers questions and makes the changes you ask for;
• writing marketing posts for a platform and occasion you choose.

When you use one, we send Anthropic what that feature needs: the file or text you provide, plus the shop details involved (such as your shop name, what you sell, and the products concerned). AJ-Hub does not save your conversations with the website assistant. Anthropic's commercial terms say it does not train its models on data sent through its API.

4. Connected accounts

AJ-Hub only accesses another service after you connect it, and only for the purposes below. You can disconnect any of them at any time from Integrations in your dashboard (the social accounts from Marketing).

Where the keys to those accounts are kept. For QuickBooks, Twilio and Etsy, the credentials are stored in AJ-Hub's own database, locked so that only our server can read them: they are never sent to a browser, not even to your own signed-in session. For Gmail, Google Calendar, Drive, Sheets and Docs, Zoho Books, Shippo, Facebook, Instagram, LinkedIn and Pinterest, the credentials are held by Composio, our integration provider, and are not in our database.

• QuickBooks Online (Intuit). We read your customers, products and services, estimates and invoices, and each invoice's PDF. Estimates appear in AJ-Hub as quotes and invoices as jobs on your order board, and we keep checking QuickBooks for changes. AJ-Hub only reads from QuickBooks; it does not create or change anything in your books. When you disconnect, we delete the stored credentials and ask Intuit to revoke AJ-Hub's access.
• Zoho Books. We read your invoices and their PDFs. AJ-Hub does not create or change anything in Zoho Books.
• Gmail. Used only to send email you write or trigger in AJ-Hub, from your own address. We do not read your inbox.
• Google Calendar, Drive, Sheets and Docs. Optional, on the Pro plan, and each connected separately. Calendar: we create one calendar called “AJ-Hub Orders” and keep your order due dates on it. Drive: we create an AJ-Hub folder and copy your order files into it. Sheets: we create spreadsheets of your orders and customers. Docs: we create a document when you save a quote to Google Docs. We only touch what AJ-Hub created — we do not read your other events, files, spreadsheets or documents — and we never delete your own events, files, spreadsheets or documents: the only thing AJ-Hub removes is an order event it put on its own “AJ-Hub Orders” calendar, when that order is archived, deleted or loses its due date. When you disconnect, what we created stays yours.
• Twilio. Your own Twilio account, used to send the texts you send your customers (for example a quote, or a ready-for-pickup or shipped notice). The recipient's phone number and the message go to Twilio, which bills your account. Disconnecting deletes your Twilio credentials from our database.
• Shippo. Your own Shippo account, used to get rates and buy shipping labels; the addresses and parcel details for that shipment go to Shippo. Separately, we register tracking numbers with Shippo under AJ-Hub's own account so that we can show shipment status, including for tracking numbers you type in yourself.
• Etsy. Creates draft listings in your Etsy shop from the products you choose (title, description, price and photos). It never publishes them; you do that on Etsy. Disconnecting deletes your Etsy credentials from our database.
• Facebook, Instagram, LinkedIn and Pinterest. Used to publish the posts you choose to publish from Marketing. We read the list of your pages, boards or profile details only so you can pick where a post goes.
• Stripe (payments on your website). If you connect your own Stripe account, your website's buyers pay you through Stripe. We store only your Stripe account ID.

5. Service providers

We share information with these providers only so they can do their part of running AJ-Hub:

• Supabase — our database, file storage and sign-in system, including the sign-in and password-reset emails.
• Vercel — hosts AJ-Hub and the shop websites, and connects the domains shops bring.
• Stripe — AJ-Hub subscription billing, and payments on shop websites through each shop's own Stripe account.
• Resend — sends AJ-Hub's own emails: account, trial and billing emails, order and enquiry notices, and proof emails for shops that have not connected Gmail.
• Sentry — error monitoring. Before a report leaves our servers we remove the private links customers use to view quotes, proofs and orders, and personal details in log lines; we do not record your screen.
• Cloudflare Turnstile — the automated-sign-up check on our sign-up, sign-in, password-reset and supplier-invite forms. It runs in your browser and its answer is checked by Supabase.
• Composio — the integration layer that holds credentials for, and passes requests to, the accounts section 4 lists as held by Composio.
• Anthropic — the AI features in section 3.
• Intuit, Zoho, Google, Twilio, Shippo, Etsy, Meta (Facebook and Instagram), LinkedIn and Pinterest — only when you connect them, as described in section 4.

We may also disclose information if the law requires it, or as part of a merger or sale of the business, in which case we will tell you.

6. Cookies and browser storage

AJ-Hub uses no advertising cookies and no third-party tracking. What it does use:

• Sign-in cookies from Supabase, which keep you signed in. AJ-Hub does not work without them.
• aj-act-as, a cookie set only for Award Junkies staff when they open an account to give support. It does nothing for anyone else.
• aj-theme, a cookie and browser-storage entry that remembers whether you chose the light or dark look, and a browser-storage entry that remembers whether you collapsed the dashboard menu.
• The cart on shop websites, kept in the visitor's own browser storage. Nothing in it reaches us until the visitor checks out or sends an enquiry.
• Visit counts on shop websites use no cookie. We turn the visitor's IP address and browser details, together with a secret that changes every day, into a one-way code and store only that code, so a shop can see how many people visited without anyone being identifiable. The same visitor gets a different code the next day. Browsers that send Do Not Track or Global Privacy Control are not counted.

7. How long we keep data, and deleting it

• We keep your business data for as long as your account exists. If your trial ends or your subscription stops, your account is paused, not deleted: your data stays, and it is all there again if you choose a plan.
• You can delete orders, quotes, notes, attachments and the products you added yourself from inside AJ-Hub. Customers cannot yet be deleted from the dashboard; email us and we will remove them.
• Disconnecting a service deletes its stored credentials (or, for an account held by Composio, our connection to it) straight away. Data already brought into AJ-Hub stays, so your order history stays intact.
• Artwork a customer uploads on a shop website is deleted after 7 days if it never reaches an order. Once it has been copied onto a job, the upload itself is deleted a day later and the job keeps its copy.
• To delete your whole account, email support@awardjunkies.com. There is no self-serve button for this yet. We will delete your data within 30 days, except records we must keep by law (for example billing records for tax).

8. Getting a copy of your data

Shops on the Pro plan can connect Google Sheets, which keeps a spreadsheet of their orders and customers in their own Google account. Suppliers can download their catalog as a CSV file from the supplier portal. For anything else, or a full copy of your data, email support@awardjunkies.com and we will send it to you.

9. Security

Data is encrypted in transit and at rest. Each shop's records are walled off at the database level, so one shop's data cannot be reached from another shop's account. The QuickBooks, Twilio and Etsy credentials we store can only be read by our server, never by a browser. Notifications that Stripe, Intuit and Shippo send us are checked for authenticity before we act on them. Award Junkies staff can open a shop's or supplier's account to give support, and every time they do, it is recorded in an internal log. No system is perfectly secure, and we cannot guarantee absolute security.

10. Your rights

You can see and correct most of your information inside AJ-Hub. To get a copy of it or have it deleted, see sections 7 and 8, or email us. Depending on where you live, you may have further rights, such as to object to certain processing or to complain to a data protection authority. We will not treat you differently for using them.

11. Your customers' information

Much of the data in AJ-Hub is about your customers rather than you: their contact details and orders, the quotes and proofs you send them, enquiries and orders from your website, and the artwork they upload. For that information your shop is the controller and we are the processor: we handle it on your behalf and for no other purpose. You are responsible for having a lawful basis to collect it and for answering your customers' requests about it. We will help you do so.

12. Children

AJ-Hub is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.

13. Changes

If we make a material change to this policy, we will update the date above and notify account holders by email before the change takes effect.

14. Contact

Questions, requests, or complaints about privacy: mike@awardjunkies.com. Requests for a copy of your data or to delete your account: support@awardjunkies.com.

Award Junkies is a sole proprietorship registered in Arizona, United States.