Privacy policy
This covers sterlingesolutions.com, BackOffice, OfficeKit, and the Windows tools. Flipit works differently and has its own privacy policy. This page says what is collected, why, and who else touches it. It is written to be read.
The short version
Sterling sells software. It does not sell you. There are no advertisers and no data brokers, your customers card details never touch us, and you can export everything you have stored at any time.
This website collects nothing
The site you are reading sets no cookies, runs no analytics, and loads no third-party trackers. No cookie banner appears because there is nothing to consent to. Nobody is counting your visit.
The Windows tools collect nothing either
QuickFill, PhotoStamp, Job Clock and FormFill run entirely on your own computer. No account, no sign-in, no phoning home.
- What you put into QuickFill — your EIN, licence numbers, addresses — is stored encrypted on your machine and never sent anywhere.
- Photos stamped by PhotoStamp, hours logged in Job Clock and PDFs signed in FormFill stay on your computer.
- Nothing is uploaded, and none of it is visible to us.
If your computer dies, so does that data. Keep your own backups.
What BackOffice and OfficeKit collect
- Account details. Your email address, an optional Google sign-in identity, and the business profile you enter — business name, owner name, trade, phone, address, logo, tax settings. Passwords are handled by the hosting platform and we never see them in plain text.
- The business records you create. Clients and their contact details, jobs including photos, videos, checklists and e-signatures, estimates, invoices, payments received, expenses and receipt images, mileage logs, time entries, contracts, vendors, equipment, work-layer records such as inspection checklists and chemical application logs, and the daily sync archives between your field devices and the office.
- Contractor tax IDs, if you use 1099 tracking. Contractor SSNs and EINs are stored encrypted with AES-256-GCM. The app shows only the last four digits, and the full value is decrypted for one purpose only: generating your 1099 report.
- Receipt images you photograph. These are processed by an AI service through the hosting platform to pull out vendor, amount and date.
- Bank transactions, only if you connect a feed. See below.
- Addresses you type into the mileage estimator. Sent to OpenStreetMap to work out the distance.
- Feedback you send. Your message, reply email, business name, which screen and version you were on, and whether you marked it as blocking your work. Used to fix the software, never for marketing. Untick the reply box and you will not get a reply.
- Device pairing records. A timestamp and the pairing IP address, as a fraud and audit trail. Device sessions store hashed tokens only.
Bank feeds, and who holds your bank login
This is the most sensitive thing in the product, so it gets its own section.
If you connect a bank account, that connection runs through Plaid. When you connect, you enter your online banking credentials into Plaid, not into Sterling. Plaid holds those credentials and Sterling never sees them. What comes back to us is a connection token and your transactions, which get sorted onto Schedule C lines.
Connecting a bank is optional. You can bring transactions in by file instead — OFX, QFX, CSV or QuickBooks exports — and nothing leaves your account or reaches Plaid at all. Plaid has its own end user privacy policy.
What is never collected
- Card and bank account numbers. Payments run through Stripe and never touch our systems.
- Your customers bank credentials. Plaid holds those, not us.
- Your location. There is no GPS tracking in Sterling, of you or of your crew. Job photos are stored as photos, not as a trail of where you have been.
- Advertising identifiers. There is no advertising.
Who else handles it
Only the services that make features work, and only what each one needs:
| Service | What it receives | Why |
|---|---|---|
| Base44 | All application data | Hosts the apps, database and file storage |
| Stripe | Purchase details. Invoice payments go to your own connected Stripe account | Payments |
| Plaid | Bank connection tokens. Your bank credentials stay with Plaid | Bank feeds |
| Resend | Email address and content of invoices, receipts and reports you send | Transactional email |
| Twilio | Recipient phone number and message content, fixed templates only | SMS reminders |
| OpenStreetMap | Start and end addresses you type into the mileage estimator | Distance estimates |
| PayPal | Payment notifications for invoices you accept PayPal on | Payment reconciliation |
Nobody else. We do not sell personal information, and we do not share data for advertising.
Your customers data is yours to answer for
Your customers names, phone numbers, addresses, job photos and signatures are your business records. You decide what to store; we process it so the software works. If one of your customers asks you about their data, that request goes to you, and we will help you answer it with exports, corrections or deletion of the records you control.
Where it lives, and how it is protected
Data is hosted on the Base44 platform. The protections that actually exist in the product, rather than the ones that sound good: encrypted contractor tax IDs, hashed and rotating device tokens, one-time pairing codes that expire and are logged, owner-scoped database access rules on every record, cryptographically verified payment webhooks, checksummed sync between field and office with server-side scope verification, and automatic versioned backups that restore in one click. No system is perfectly secure, and we notify affected users of breaches as the law requires.
Offline and on-device data
OfficeKit is offline-first. Records captured with no signal are stored on the device and sync when you are back in range. Some features keep data on the device with server backup snapshots. Clearing your browser data or uninstalling can remove device-local data, so use the built-in backup and export tools.
How long it is kept
Your records last as long as your account does — that is the product, since it is your business history and your tax trail. Backups keep the most recent twenty snapshots. Refunding a work layer never deletes the records you made with it. Accounts that never complete a purchase are deleted after twelve months.
Your choices
- Export. Full CSV export of your records, any time, from inside the app.
- Correct. Edit your records in the app.
- Delete. Email us from the address you signed up with and your account data is removed within 30 days.
- SMS opt-out. Every SMS carries opt-out wording, and STOP is honored automatically and permanently.
- Email. Transactional only. There is no marketing list, so there is nothing to unsubscribe from.
Children
This is software for running a business, meant for adults of 18 and over. We do not knowingly collect data about children.
Changes
If this policy changes in a way that matters, it is announced in the app or by email 30 days before it takes effect, and the date at the top changes.
Contact
Sterling E Solutions, Pennsylvania, United States
sterlingesolutions@gmail.com