Calvera Software LLC Privacy Policy

Effective date: 10-13-2026

Calvera Software LLC ("Calvera," "we," "us," or "our") provides business management and financial software, including Calvera Ink and Calvera Books. This Privacy Policy explains how we collect, use, disclose, and retain personal information through our websites, mobile applications, forms, and related services that link to this policy (the "Services").

This is the privacy policy of Calvera Software LLC. It describes Calvera's handling of information through its Services; it is not the privacy policy, consent agreement, or regulatory compliance notice of an individual business that subscribes to Calvera. This policy applies to account holders, business owners, staff, service providers, website visitors, and individuals whose information is submitted through the Services. The information collected depends on the product, features, permissions, and integrations used.

1. Our role and business customer records

We manage information used to operate our own business, including account registration, subscriptions, support, and website activity. Businesses using our software also submit and manage information about their clients, employees, and service providers. For those business records, we generally process information on the business's behalf and under its instructions.

Subscriber responsibilities. Each subscribing business determines the information it collects about its clients, the forms and notices it uses, who may access its records, and how long those records must be retained. The subscriber is responsible for identifying and complying with the laws and professional requirements applicable to its services and jurisdictions, including requirements for service eligibility, identity and age verification, client and parent or guardian consent, privacy disclosures, recordkeeping, and retention.

Calvera provides software tools to support the subscriber's workflows. Calvera does not determine the subscriber's legally required forms or retention periods, certify that a form or workflow complies with local law, or guarantee compliance based on a template, default setting, reminder, or software-generated result. Subscribers must review the available controls, configure their workflows appropriately, and maintain or export records as needed to meet their obligations.

Calvera responsibilities. Calvera remains responsible for its own handling of information, security practices, contractual commitments, and legal obligations applicable to Calvera. Assigning responsibilities to subscribers does not waive individuals' applicable privacy rights or remove obligations that the law independently imposes on Calvera.

If your request concerns a subscribing business's appointment, consent form, identification record, service record, or message conversation, contact that business first. Its privacy notices and client agreements may also apply. You may contact us for assistance routing your request or for questions about Calvera's processing of information.

2. Information we collect

Account and business information. Names, email addresses, telephone numbers, business names and addresses, account identifiers, roles, provider profiles, subscription details, and information needed to authenticate users and manage permissions.

Client and service records. Client contact details, addresses, dates of birth, appointments, service history, notes, photographs, consent forms, signatures, aftercare records, and communications. The Services are not intended for collecting health information. Subscribers must not enter health information in custom fields, notes, messages, or uploads. We receive this information from users, their businesses, and individuals completing forms.

Identification information. Where requested by a business, uploaded identification images and associated information, such as name, date of birth, identification type, expiration date, and staff verification records. An identification image may contain additional information visible on the document.

Payment and financial information. Subscription and transaction records, amounts, tips, deposits, refunds, payment status, receipts, bookkeeping categories, balances, and connected financial account information. Payment processors and bank connection providers handle information under their own policies. The information Calvera receives depends on the integration and may include transaction identifiers, payment tokens, and limited payment method details.

Location and mileage information. When you enable mileage tracking and grant the necessary device permissions, Calvera Books may collect precise location, including in the background, to identify trips, calculate distance, and create mileage records. Records may include routes, start and end locations, addresses, timestamps, saved location names, and trip classifications.

In-person payment device information. When you use Square-powered payments in Calvera Ink, Square may access the device's current location, device identifiers, transaction information, and technical or diagnostic information to confirm a supported payment region, identify the payment device, process payments, and protect against fraud. Location permission for payments is separate from Calvera Books' background mileage tracking. The Square integration may request Bluetooth access for card readers and, on Android, phone-state access to identify the device and microphone access for compatible magstripe readers. Microphone permission for this purpose supports reader data; it is not a Calvera voice-recording feature. Square processes information under its applicable terms and privacy notices.

Device and usage information. IP address, browser and device information, operating system, app version, access times, feature activity, error reports, security logs, and notification tokens. Websites and applications use cookies, browser storage, or similar technologies for authentication, preferences, and operation. Our public website is hosted by GoDaddy and uses its website technology, visitor identifiers, and, where applicable, referral or campaign identifiers to measure traffic and referrals. It displays a GoDaddy-provided cookie notice.

Messages and support information. Requests, feedback, attachments, and communications with us or through the Services. Connected messaging channels may provide messages, sender identifiers, and related metadata as described below.

3. How we use information

We use information to provide the features you request; manage accounts and subscriptions; schedule appointments; deliver forms and aftercare; maintain client and business records; facilitate payments and refunds; produce financial reports; create mileage records; and receive, organize, and respond to business messages.

We also use information to deliver service messages and configured notifications, respond to support requests, maintain and improve reliability, troubleshoot errors, protect accounts, prevent fraud and misuse, and meet legal and contractual obligations.

Human identification verification. Authorized service providers visually review identification and record their verification. A business may request a replacement identification image without resending an entire form packet. Calvera does not authenticate identification documents or replace the business's required identity and age checks. Identification images remain subject to the access, storage, retention, and deletion practices described in this policy.

For client records processed on a subscriber's behalf, the subscriber is responsible for providing appropriate notices and obtaining any required consent or other lawful authorization to collect, use, and submit the information through Calvera, including sensitive information and information about minors. Calvera processes those records to provide the requested Services, subject to applicable law and its agreements. For optional features controlled by an account holder or device user, the relevant connection authorization or device permission may also be required. This policy does not itself obtain consent for a subscriber's services or replace any consent required from an individual.

Advertising and sale of app data. Calvera does not sell personal or sensitive user data collected through Calvera Ink or Calvera Books, and does not use client identification images, bookkeeping records, or mileage routes for targeted advertising. Third-party payment and bank-connection services may process technical, fraud-prevention, or service-usage information under their own notices; this policy does not describe those services as collecting no data.

4. Facebook Messenger and Instagram messaging

Optional account connections

A business may choose to connect a Facebook Page and its linked Instagram professional account to Calvera's unified inbox. Connection requires authorization through Meta. Access depends on the permissions granted, the accounts selected, and Meta's availability and approval requirements. Calvera receives authorization credentials from Meta; you do not provide your Facebook or Instagram password to Calvera.

Information received and stored

When an authorized channel is connected, Calvera may receive and store:

The information available depends on the messaging channel and the permissions Meta provides. Connecting an account does not automatically import its entire historical inbox.

How social messaging information is used and disclosed

We use this information to display incoming conversations, send replies at the business's direction, organize and assign conversations, link conversations to client records or appointments, deliver configured notifications, and troubleshoot or secure the integration. Authorized business users can access conversations according to the Services' access controls. Replies and the identifiers necessary to deliver them are transmitted to Meta.

Social messaging information is processed on the connected business's behalf for these functions. We do not use the social messaging integration to publish private conversations publicly. Messages may contain personal or sensitive information that a sender chooses to include; avoid sending information that is unnecessary for the conversation.

Disconnecting, revoking access, and deleting information

A shop owner can disconnect an account through Messages → Connect Channels in Calvera. Disconnecting stops Calvera from receiving new messages or sending replies through that disconnected account and removes its stored connection credentials. Existing conversations remain in Calvera unless separately deleted.

You can also revoke Calvera's access through the applicable Facebook or Instagram account settings. Revocation can affect every business account authorized through that connection. Calvera processes verified deauthorization and data-deletion notifications received from Meta for integration records still linked to that authorization. For conversations retained after an account has already been disconnected, contact our support team to request deletion and identify the previously connected account. Removing integration data does not automatically delete separately maintained client records, appointments, or financial records.

To request deletion of social messaging information held in Calvera, contact support@calverasoftware.com with the subject "Social Messaging Data Deletion" and identify the relevant business and connected account. We may verify your identity and authority and coordinate with the business responsible for the records. Do not include passwords or access tokens. Restricted backup copies are handled as described in the retention section below.

Disconnecting or deleting information in Calvera does not delete copies held by Meta, message participants, or another service. Facebook and Instagram also process information under Meta's Privacy Policy and their applicable terms.

5. How information is disclosed

Your business and authorized users. Business records are available to the business and users with the applicable access permissions. Businesses are responsible for configuring access and managing their staff accounts.

Service providers. We disclose information needed for hosting, storage, authentication, payment processing, bank connections, email and text delivery, push notifications, location and mapping functions, security, and support. Providers include Supabase for database, authentication, and file storage; Cloudflare R2 for encrypted uploaded-file backups and independent deletion records; GitHub Actions for backup processing; Vercel for application hosting; GoDaddy for the public website and enabled website features, including Google reCAPTCHA for contact-form security, TrustedSite website certification, and GoDaddy-provided chat through Reamaze when enabled; Square for merchant payments; Helcim for subscription billing; Plaid for connected bank information in Calvera Books; Meta for connected social messaging; Resend for service email delivery; and Apple or Google for applicable platform and notification functions. The providers receiving information depend on the features used. Other providers may be used for specific functions.

Provider safeguards. We use service-provider agreements and data-processing terms, where applicable, that address confidentiality, security, permitted processing, and assistance with deletion or privacy requests. Providers handling information on our behalf must use it for the agreed services and applicable lawful purposes. Independent payment processors, banks, and social platforms may also have their own legal obligations and account relationships with you. Those roles do not remove Calvera's responsibilities for the information it processes.

Connected services and your instructions. When you connect a third-party account, send a form or message, share a report, or otherwise direct a disclosure, information is exchanged as needed for that action. Disconnecting an integration limits future access but may not delete information already received by either service.

Legal and safety purposes. We may disclose information when required by law, court order, or lawful request, or when reasonably necessary to protect rights, investigate misuse, prevent fraud, or address security incidents.

Business transactions. Information may be disclosed in connection with a merger, acquisition, financing, reorganization, or sale of business assets, subject to applicable legal protections.

6. Mobile permissions and your choices

Camera and photos. These permissions support features such as identification images, receipt capture, and photo uploads. You may decline or revoke access in device settings; features requiring that access may then be unavailable.

Payment permissions. Square-powered in-person payments may require foreground location access and device or reader permissions described in Section 2. You can revoke these permissions in device settings, which may prevent in-person card acceptance on that device. Other Calvera functions do not require you to enable background mileage tracking. Review the permission explanation displayed when setting up payments.

Location. Mileage tracking requires the appropriate location permissions, which may include background access. You can turn tracking off in the app or revoke location permissions in device settings. Turning tracking off does not automatically delete previously saved trips.

Notifications. You can manage available notification preferences in the Services and disable push notifications in device settings. Essential account or security communications may still be sent through other channels.

Marketing and text messages. Where offered, you can unsubscribe from marketing email through its unsubscribe link. For supported text messaging, follow the opt-out instructions provided, such as replying STOP. Message and data rates may apply.

Public website cookies and tracking. Our public website is hosted by GoDaddy and displays an Accept and Decline cookie banner. According to GoDaddy's documented configuration, optional cookie tracking controlled by that banner is enabled only when a visitor selects Accept. Selecting Decline leaves that tracking disabled and closes the banner. We currently have no Google Analytics, Facebook/Meta Pixel, or Google AdSense identifiers configured in the website's integration settings. The banner does not control every website service: essential cookies, server logs, security features, and GoDaddy's separate aggregated analytics may still operate. GoDaddy and enabled website services process information under their applicable policies as well as the practices described here.

Calvera Ink and Calvera Books app storage. Our applications use browser or device storage for functional purposes, including maintaining sign-in sessions, saving preferences and selected workspaces, and supporting temporary data and cached records. Calvera Books may also use a functional cookie to remember whether its sidebar is open. We do not currently install advertising trackers or separate optional analytics integrations in the core application interface. Integrated payment, bank-connection, notification, and platform services may process service-usage and diagnostic information as described in this policy and their applicable notices. The applications do not display a separate optional-tracking consent banner, and the public website's GoDaddy cookie choices do not control application storage. Browser and device controls may allow you to reject or delete cookies, local storage, and application data; doing so can affect sign-in, preferences, and functionality. Applications may retain cached business records, forms, conversations, authentication information, and preferences on the device to support their operation. Use trusted devices and protect access to them.

7. Retention and deletion

Subscriber-managed business records. The subscriber determines the retention periods applicable to its client records, completed forms, identification records, ink records, sterilization logs, and other business records. Requirements can vary by jurisdiction and service. Calvera does not automatically determine the legally correct retention period for these records. Subscribers are responsible for using the available retention and deletion controls, requesting assistance where needed, and keeping required copies outside Calvera when necessary. Any software default is an operational setting, not a statement of the subscriber's legal retention obligations.

Calvera's own records. Our operating retention schedule generally keeps Calvera's own closed subscription accounting for seven years after closure, and longer when necessary for a more recent payment or applicable obligation. Agreement acceptance evidence is kept while the agreement applies and generally for seven years after closure or the applicable older acceptance. Closed support correspondence is generally kept for two years, privacy-request verification and outcome records for three years, and routine security evidence retained by Calvera for 90 days. These periods may be extended for a documented legal, accounting, dispute, or security need. Cleanup of support correspondence and separately retained security evidence includes manual review; independent service providers may apply their own retention periods. We minimize unnecessary attachments and temporary exports. These rules do not preserve the closed subscriber's client records, forms, IDs, or bookkeeping history in the active application.

Calvera Ink account and shop deletion. You can initiate deletion in User Settings → Delete my account, or in Account Settings → Data & Account. The confirmation screen identifies affected shops and requires your current password and an explicit confirmation. If you are the last owner, the affected shops close and future Ink subscription renewals are cancelled before data cleanup. Closure deletes those shops' client records, completed forms, identification records, photos, messages, appointments, shop payment and checkout history, compliance records, and uploaded files from active Calvera systems. The subscriber must export and securely retain any records it is required to keep before confirming deletion; a shop-selected retention period does not preserve records after confirmed closure. Provider and front-desk account deletion removes that user's access and personal account information without closing another owner's shop. Records maintained by that continuing business may retain necessary historical attribution.

Calvera Books account deletion. In Books Settings, select Delete my account. The confirmation lists all businesses owned by the account and requires your current password and an explicit confirmation. Deletion cancels future Books subscription renewals, disconnects bank feeds, and deletes the account's businesses, bookkeeping transactions, uploaded receipts and other files, categories and rules, mileage records and saved locations, vault information, notification settings, and personal account profile from active Calvera systems. Export and securely retain any required records before confirming deletion.

Scope and completion. Ink and Books have separate account deletion controls; deleting an account in one product does not delete a separately maintained account in the other. Access is blocked when a deletion request is accepted. Cleanup may continue in the background and retry if a provider or storage operation is temporarily unavailable. Calvera retains limited records of its own subscription charges and related accounting, together with minimal deletion, legal, and security records where necessary for the purposes described above; this does not preserve the closed subscriber's client records, forms, IDs, or bookkeeping history in the active application. Deletion does not erase records independently held by Square, Helcim, Meta, banks, or other providers. You may request deletion without reinstalling or signing in to the app through our account-deletion request page, or by contacting support@calverasoftware.com. We verify your identity and authority. For social messaging, the specific choices in Section 4 also apply.

Deletion from active records does not necessarily remove every copy immediately. For Calvera Ink and Calvera Books, our current setup uses daily database backups with a seven-day recovery window and separate daily encrypted backups of uploaded files configured for seven-day retention. These backup copies have restricted access and are used for recovery and verification. Routine backup expiration is subject to the provider's processing and does not guarantee that every copy is erased at an exact time. Backup recovery windows do not determine how long active subscriber business records must be retained. Copies may also remain in security records, local device storage, or systems operated by other service providers, depending on the system and applicable requirements. Clearing application data or browser storage can remove locally retained copies. Information retained by Calvera for legal or security purposes remains subject to appropriate access restrictions.

Deletion safeguards during recovery. We keep an independent encrypted journal of minimal account and record identifiers to help exclude deleted information during supervised backup recovery. Journal entries are configured to expire after 30 days; non-content coverage checkpoints remain to identify when independent deletion history began. These safeguards do not retain deleted client forms, identification images, receipts, or message contents. Backups from before independently verified coverage require separate reconciliation before recovery.

8. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including HTTPS for application communications, authenticated access controls for business records, restricted file access, and encrypted recovery backups and deletion-journal records. No system or transmission method can be guaranteed completely secure. Keep your credentials private, use available account protections, and notify us promptly of suspected unauthorized access.

9. Your privacy rights

Depending on where you live and which laws apply, you may have rights to access personal information, correct inaccuracies, request deletion, obtain a portable copy, withdraw consent, or opt out of certain sales, advertising uses, or profiling. These rights may be subject to exceptions and may differ for records maintained on a business customer's behalf.

Send requests to support@calverasoftware.com with the subject "Privacy Request." Describe the request and identify the relevant product or business. Do not email a complete identification document, banking credentials, or other unnecessary sensitive information. We may request information reasonably necessary to verify your identity and authority.

We respond within the time required by applicable law and explain any denial. If applicable law provides an appeal right, reply with the subject "Privacy Appeal." You may also contact your state attorney general or other appropriate privacy regulator. We will not unlawfully discriminate against you for exercising your rights.

10. Children and records about minors

Calvera's business account tools are intended for adult business users and are not directed to children under 13. A subscribing business may submit or arrange collection of records about minors only when lawful and supported by any required parent or guardian involvement. The business is responsible for determining whether it may provide the service, selecting appropriate forms, and obtaining any required notices and consent. This allocation does not remove obligations independently applicable to Calvera when it processes information about children.

If you believe a child has provided information without required authorization, contact us at support@calverasoftware.com.

11. Processing locations and third parties

Calvera is based in the United States. Information may be processed where Calvera or its service providers operate. Privacy laws in those locations may differ from those where you live.

Third-party websites, banks, payment processors, social platforms, and other connected services have their own privacy practices. Review their policies before connecting an account or submitting information directly to them.

12. Changes to this policy

We may update this policy as our Services, practices, or legal obligations change. We will post the updated policy with a new effective date and provide additional notice or obtain consent when required by law.

13. Contact us

Calvera Software LLC
Privacy inquiries and requests: support@calverasoftware.com
Website: www.calverasoftware.com