Privacy Policy

1. Scope

This policy explains what Mongoose Business (an app for running a trade business, roofing first: jobs from the first call to the care plan, the schedule, an Inbox, records of the money each job expects and receives, and Mongoose, an AI operator that does the routine work for you) collects, why, and what you can do about it. It covers business.mongooselabs.app. Other Mongoose Labs products have their own policies.

2. What we collect

Your account: your email address, your password, and the name you give your workspace. Your password never leaves your browser in readable form: it is stretched on your device first, and the result is stretched again with a unique salt before it is stored. We cannot see or recover it.

Your workspace: the customers and their contact details, jobs and their stages, notes, the schedule, the messages that come in and go out, records of expected and received payments, care-plan steps, and your conversation with Mongoose that you enter. Each change is kept in the record’s history (what changed, when, and by which account) so your records stay trustworthy.

Abuse prevention: the network (IP) address of requests, held only in short-window rate-limit counters used to stop automated abuse such as password guessing.

3. What we don’t collect or do

• We don’t sell your data or share it for advertising.
• We don’t sell your workspace data or use it to train AI models.
• Mongoose Business does not charge cards, collect payments or move money.
• Mongoose Business does not file insurance claims or deal with insurers for you.
• Mongoose Business does not message anyone who has asked to stop.
• We don’t use advertising or cross-site tracking cookies.

4. Signing in with Mongoose ID (optional)

If you choose “Continue with Mongoose,” you approve the connection on mongooselabs.app. Mongoose Business then receives a random identifier that is unique to Mongoose Business, your Mongoose account’s email address, and the list of permissions you approved. If you approve showing your Business numbers in your Mongoose wallet, a summary of those numbers is shared with your Mongoose account. Mongoose Business never receives your Mongoose password. Accounts are never linked by email address alone. You can disconnect Mongoose Business from your Mongoose account’s Connected apps settings.

5. Mongoose, the AI operator

Mongoose, the AI operator, reads your workspace to do what you ask it and to write the messages for the workflows you switch on. It works through Mongoose on mongooselabs.app, which uses an AI model provider; the provider receives the parts of your workspace needed for the task, not your password.

6. Team members and invite links

A workspace owner can invite colleagues with a private invite link made for one email address. It works once, for seven days, and only for someone signed in with that email. Everyone in a workspace can see and change its jobs, customers and records and sees each other’s email addresses; each change stays on the job’s timeline with the account that made it. If a member leaves, is removed, or deletes their account, what they entered stays in the team’s workspace (it is the team’s record); if they delete their account, their email address is replaced in that history.

7. Documents, signatures and your letterhead

Documents you make (proposals, contracts, certificates, invoices) are stored in your workspace with your branding: the business name, phone, registration number, colour, review link and logo you give us, printed as your letterhead. When you send one, your customer gets a private link to read it. When they sign, we record the name they type, the time, their network (IP) address and browser, and a fingerprint of the exact document, so the signature can be shown later.

8. Messages to your customers

When you, or Mongoose on your behalf, send a customer an email or text, we send it to the address or number you saved, keep a copy in your workspace, and log replies that come back. Every email names your business and carries a link to stop; a text reply of STOP, or that link, stops all automatic messages to that person. Follow-ups that sell (like a referral ask) only go to customers you have marked as having agreed.

9. Information about other people

Your workspace may hold details about your customers, suppliers or contacts. You decide what to enter and are responsible for having the right to store it. We process it only to run Mongoose Business for you and never contact those people ourselves, except the messages your workspace sends them (see "Messages to your customers").

10. Who else handles your data

Mongoose Business runs on Cloudflare, which hosts the application and its database and delivers it over encrypted connections (HTTPS/TLS). Emails your workspace sends go through Resend (our email provider). Texts go through your own Twilio account, if you connect one; we store its access token encrypted. Mongoose ID sign-in, if you use it, is handled by Mongoose on mongooselabs.app. These providers process data only to provide their service to us. We may disclose information if the law requires it.

11. Cookies and local storage

We use one essential sign-in cookie (secure, HTTP-only, first-party, valid for up to 30 days or until you sign out). Mongoose Business does not store data in your browser’s local storage. Our host may measure aggregate, cookieless page-performance statistics.

12. Data retention

Your account and workspace are kept until you ask us to delete them. Record history is kept as long as the record it belongs to. Rate-limit counters are overwritten each short window.

13. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information and to object to certain processing. You can download all of your workspace data at any time with “Download all workspace data” in the app. You can delete your account and workspace yourself at any time with “Delete account” in the app; it takes effect immediately and can’t be undone. You can also email privacy@mongooselabs.app from the address on the account. We respond to verified requests within the time the law requires.

14. Security

Passwords are stretched twice and never stored in a recoverable form. Sessions are protected against cross-site request forgery, every workspace is isolated from every other, and all traffic is encrypted in transit. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you as the law requires.

15. International transfers

Our providers may process and store data in countries other than your own. Where the law requires it, we rely on appropriate safeguards for those transfers.

16. Children

Mongoose Business is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 13 (or the higher age some jurisdictions set). If you believe a child has given us information, contact us and we will delete it.

17. Changes to this policy

We may update this policy as the product changes. We will post the new version here with a new effective date, and tell account holders about material changes before they take effect.

18. Contact

Questions can be sent to privacy@mongooselabs.app.

Mongoose Athanor LLC
1001 S. Main St., STE 600, Kalispell, MT 59901, USA