Privacy Policy

1.Who We Are

All In One Building LLC is a licensed and insured general contractor based in Milford, Pike County, Pennsylvania, serving the tri-state area. We are the publisher, operator, and data controller responsible for the App and for the information processed within it.

You can reach us at any time:

• Email: contact@allinonebuilding-llc.com
• Phone: 570-243-1011
• Location: Milford & Pike County, Pennsylvania, USA

2.Scope of This Policy

This policy governs the All In One Building CRM and the information it processes, including data exchanged with our QuickBooks Online account. It applies to our authorized staff who use the App and explains how we handle information about the customers we serve in the ordinary course of our contracting business.

Because the App is an internal tool, most "users" of the App are our own staff. References below to information "about customers" mean information about the homeowners and clients we provide contracting services to, which we store in order to run our business.

3.Information We Collect

The App stores the following categories of information. This data is entered by our staff or, in the case of QuickBooks data, synchronized from our own QuickBooks Online account.

Customer information

• Contact details: customer name, street address, city, state, ZIP code, phone number, and email address.
• Lead source: how the customer found us or was referred.
• Notes: free-text notes that our staff record about the customer or project.

Job and project information

• Job type and description, status, quoted and final amounts, and relevant dates.
• Interaction history (a record of contacts and activity related to the customer or job).
• Reminders and tasks created by staff.

Communications

• Two-way SMS text messages exchanged with customers, including message content and timestamps, and the customer’s opt-out (STOP) status.

Staff account information

• Internal staff user accounts, consisting of a username, a salted password hash (we do not store plaintext passwords), and an assigned role.

We do not collect this information from the general public, we do not run advertising or behavioral-tracking systems, and we do not buy or enrich customer data from data brokers.

4.QuickBooks Online / Intuit Data

The App connects to our own QuickBooks Online (QBO) company account using Intuit’s OAuth 2.0 authorization. An administrator initiates this connection, and the App requests a single accounting scope: com.intuit.quickbooks.accounting. We request only this scope because it is the minimum required for the features described below; we do not request payments, payroll, or identity/profile scopes that the App does not use.

Within that scope, the App accesses our QuickBooks Online company data as follows:

The OAuth access tokens and refresh tokens issued by Intuit are stored only in the App’s database on our own private server (see Section 8). They are used solely by the App on the server to call the QuickBooks API on behalf of our company. These tokens are never exposed to a web browser, never printed to browser console logs, and are never shared with any third party.

5.How We Use Information

We use the information in the App strictly to operate our contracting business and to power the QuickBooks integration, specifically to:

• Manage customer relationships, leads, jobs, schedules, reminders, and tasks.
• Communicate with customers about their projects, including by SMS.
• Prepare and send estimates and invoices, and keep our customer records consistent between the CRM and QuickBooks Online.
• Authenticate staff and control who can access the App.
• Maintain, back up, secure, and troubleshoot the App.

We do not use the information for advertising, profiling, automated decision-making with legal effects, or any purpose unrelated to running our business and serving our customers.

6.SMS / Text Messaging

The App supports two-way SMS text messaging with customers so that our staff can coordinate scheduling, project updates, and service follow-ups. Message content and timestamps are stored in the App.

Customers can opt out of text messages at any time by replying STOP to a message from us. When a customer opts out, we record that preference and stop sending non-essential texts to that number. Standard message and data rates from the customer’s mobile carrier may apply. SMS opt-out requests can also be made by contacting us directly using the details in Section 15.

7.Cookies & Sessions

Because the App is login-gated, it uses a session cookie to keep a staff member signed in and to maintain the security of their session. This cookie is strictly necessary for the App to function. The App does not use advertising cookies, cross-site tracking cookies, or third-party analytics/marketing trackers.

Website analytics

We count visits to allinonebuilding-llc.com using our own software running on our own server. We do not use cookies for this, we do not store your IP address, and we do not share this information with anyone. Each visit is recorded as an anonymous code that is scrambled with a secret value we replace every night and then delete, so the counts cannot be traced back to you or linked across days. We use this only to see which pages people find useful. If your browser sends a “Do Not Track” signal, we do not count the visit at all.

8.How We Store & Secure Data

We take reasonable measures to protect the information in the App. Our actual security posture is as follows:

• Self-hosted, on-premise. The App runs on our own office server (Linux + Docker). It is not hosted on a public cloud provider such as AWS, Azure, or Google Cloud.
• Local database. Application data is stored in a local SQLite database file on that server.
• Encryption in transit. All web traffic is served over HTTPS using a Caddy reverse proxy with automatic certificates from Let’s Encrypt, using TLS 1.2 or higher. Traffic between the App and the QuickBooks API is likewise over TLS 1.2+.
• Access controls. The App is login-gated and limited to authorized staff accounts, with role-based access. The home page redirects unauthenticated visitors to the login page.
• Credential protection. Staff passwords are stored only as salted password hashes, never in plaintext.
• Token security. QuickBooks OAuth access and refresh tokens, and the App’s Intuit client credentials, are stored securely server-side on our own private server and are never exposed to the browser or to third parties.
• Backups. The server performs automated nightly local backups of the application data so that records can be recovered if needed.

9.Sharing & Disclosure to Third Parties

We do not sell, rent, or trade the information in the App. We limit disclosure as follows:

• QuickBooks / Intuit data is not sold, not shared, and not disclosed to any third party. It is exchanged only between the App and our own QuickBooks Online account to provide the integration described in Section 4, and it is visible only to our authorized staff.
• SMS gateway (sub-processor). To send and receive text messages, the App relies on a third-party SMS/messaging gateway. This is our only sub-processor, and its access is scoped strictly to delivering and receiving SMS messages (phone number and message content). The SMS gateway has no access to QuickBooks/Intuit data. We will identify the current SMS provider on request using the contact details below.
• Legal compliance. We may disclose information if required to do so by law, regulation, subpoena, or other valid legal process, or to protect the rights, property, or safety of our company, our customers, or others.

We do not share information with advertisers, data brokers, or analytics companies.

10.Data Retention & Deletion

We keep customer, job, communication, and account records for as long as we maintain an active business relationship with the customer and for as long as needed to operate our business and meet legal, tax, accounting, warranty, and recordkeeping obligations. When information is no longer needed for these purposes, we delete or anonymize it. We also honor verified deletion requests as described in Section 11, subject to records we are legally required to retain.

QuickBooks data and OAuth tokens

QuickBooks-derived data within the CRM (such as linked customer records) is retained only as needed to provide the service. When the QuickBooks connection is disconnected, the App calls Intuit’s token-revocation endpoint to revoke the connection and stops accessing QuickBooks data, and the stored OAuth access and refresh tokens for that connection are deleted from the App’s database. Records that already exist in our own QuickBooks Online account (for example, estimates and invoices we created) remain in QuickBooks and are governed by Intuit’s own terms.

11.Your Rights & Choices — Access, Correction, Deletion, Opt-Out

If you are a customer of All In One Building LLC, you may ask us to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or out of date;
• Delete your personal information, subject to records we must keep for legal, tax, or accounting reasons; and
• Opt out of text messages — reply STOP to any text from us, or contact us directly.

To make any of these requests, contact us at contact@allinonebuilding-llc.com or 570-243-1011. We may need to verify your identity before acting on a request, and we will respond within a reasonable timeframe.

12.Children’s Privacy

The App is an internal business tool and is not directed to children. We do not knowingly collect personal information from children under the age of 13. If we learn that we have inadvertently collected such information, we will delete it.

13.Third-Party Services

The App is governed by this Privacy Policy. QuickBooks Online (Intuit) is a connected third-party service. When information is sent to or retrieved from QuickBooks, Intuit’s own terms and privacy statement also apply to how Intuit handles that data. We encourage you to review Intuit’s privacy practices at intuit.com/privacy. Likewise, the third-party SMS gateway we use to deliver text messages processes message data under its own terms. We are not responsible for the independent practices of these third parties beyond the scope of the integration described here.

14.Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the App, our practices, or legal requirements. When we make changes, we will revise the "Last Updated" date at the top of this page and post the updated policy at this URL. We review this policy at least annually to keep it current. Material changes will take effect when the revised policy is posted.

15.How to Contact Us

If you have questions or requests about this Privacy Policy or your information, please contact us: