Privacy policy

1. Who we are

Sontairo DBA Kerfstead operates Kerfstead. This policy covers our website, accounts, workspaces, billing, and optional integrations. For privacy questions or requests, contact dom@menchistholdings.com.

We manage account and service information to operate Kerfstead. When a business stores its customers’ information in a workspace, that business determines why it is collected and used; we process it to provide the workspace. If your information was entered by a Kerfstead customer, contact that business first. We can help route a request where appropriate.

2. Information we handle

• Account information: name, email, account identifiers, authentication status, connected identities, sessions, and account preferences. WorkOS handles sign-in and authentication credentials.
• Workspace information: business details, member identities and roles, invitation email addresses, customers, job notes, drawings, dimensions, quotes, pricing, and settings. Saved revisions may retain earlier versions.
• Billing information: Stripe customer and subscription identifiers, plan, seat count, payment status, and billing-period information. Stripe collects payment details; Kerfstead does not receive or store your full card number.
• Service information: requests, device/browser and network information processed by hosting or authentication providers, security events, error information, and support correspondence.
• Optional connections: provider account identifiers, authorization tokens, connection status, and information you authorize through an available integration workflow.

3. How we use information

We use information to authenticate you, operate and save workspaces, enforce permissions and seat limits, calculate estimates, process subscriptions, provide notifications and support, investigate errors or abuse, and meet legal obligations. We do not sell personal information or use workspace content for targeted advertising. Kerfstead does not use connected Google data to train generalized AI or machine-learning models.

Where a legal basis is required, we rely on performing our agreement, legitimate interests in operating and securing the service, legal obligations, and consent where applicable. You can withdraw consent for optional connections by disconnecting them; this does not affect processing already lawfully carried out.

4. Who receives information

We share information as needed with service providers: Cloudflare for hosting, delivery, and network protection; Neon for the workspace database; WorkOS for authentication and optional connection management; Stripe for payments and subscriptions; and Sanity for public blog content. Providers process information for their services under their own terms and applicable data-protection arrangements. Published blog content is public; private quotes are not published to the blog.

Workspace members can access information allowed by their role. If you choose an integration action, relevant information goes to that provider. We may disclose information when legally required, to protect the service or others’ rights, or as part of a business transfer subject to appropriate protections and notice where required.

5. Google Drive data

Google Drive access is optional. The requested drive.file permission covers files you select for or create through Kerfstead; it does not give blanket access to all files in your Drive. WorkOS manages the connection and authorization tokens. Connecting alone does not import or upload files; a file workflow must be available and initiated by you.

We use authorized Google data only to deliver the file features you request. We do not use it for advertising, sell it, or allow people to read it except with your specific consent, when necessary for security or legal compliance, or as otherwise permitted by Google’s Limited Use rules. Transfers are limited to what is needed to provide the requested feature, protect security, comply with law, or handle a permitted business transfer.

Kerfstead’s use and transfer of Google API data comply with the Google API Services User Data Policy, including its Limited Use requirements. Disconnect in Account settings → Integrations, or revoke access in your Google Account’s third-party connections. Contact us to request deletion of any retained connection data.

6. QuickBooks Online data

The optional QuickBooks connection requests the accounting permission, which can permit reading and writing accounting data after your consent. It does not request payment-processing permissions. WorkOS manages the connection. Connecting alone does not import records or modify your company’s books; accounting workflows are available only when explicitly offered in the product. You may disconnect in Account settings → Integrations or through Intuit. We use authorized accounting information only for the workflow you request and service operation, not for advertising or sale.

7. Cookies, local storage, and security

Essential cookies keep you signed in and protect authentication. Browser storage holds demo work, interface preferences, and temporary recovery copies of pending edits. Demo work stays in that browser unless you intentionally export or import it. Clearing browser storage can remove it. Local recovery copies are not encrypted by Kerfstead; use trusted devices and protect device access.

We use HTTPS, protected session cookies, server-side permission checks, and database access controls. No system is completely secure. Production database and Worker placement target the United States, while content delivery and providers may process information in other countries. This placement is not a guarantee that all processing stays in one region. We use applicable contractual and other safeguards where legally required for international transfers.

8. Retention and deletion

We retain account and workspace information while needed to provide the service. Canceling a subscription preserves saved work for viewing and export and does not delete it. You may export a workspace backup and request account or workspace deletion by contacting us. We verify identity and authority before fulfilling requests; deleting a personal account does not necessarily delete a business workspace controlled by another owner.

We retain information as necessary for tax and accounting obligations, security, dispute resolution, and enforcing agreements. Deleted data may remain temporarily in protected backups or revision records until those copies are removed through retention and deletion processes; it is not used for new business purposes. Disconnecting a provider stops future access through that connection but does not itself delete files or records already created in that provider.

9. Your choices and rights

You can edit available profile details, manage sessions and connections, change in-app notification preferences, and export workspace data. Depending on your location, you may have rights to access, correct, delete, or receive a portable copy of personal information, restrict or object to processing, withdraw consent, or complain to a privacy regulator.

Send requests to dom@menchistholdings.com. We may verify your identity and authority, respond within applicable legal time limits, and explain any lawful restriction. We do not discriminate against people for exercising privacy rights. The service is for adults and business use and is not directed to children under 18.

10. Policy updates

We will update this page when our practices change, revise the date below the title, and provide additional notice for material changes where appropriate or required. For questions about this policy or a data concern, email dom@menchistholdings.com.