Privacy policy
RetainageBack is operated by Masab AI HUB (“we”, “us”). This policy explains what we collect when you use retainageback.com, why we collect it, who processes it for us, and how you can have it deleted.
Account data
When you sign up we collect your name, work email address, password, and your company name. Your password is stored only as a salted hash. If you invite teammates, we store their names, email addresses and roles.
We use account data to sign you in, keep your company's data separate from every other company, send you the emails you ask for (such as release reminders and the owner digest), and contact you about your account. We do not sell your data and we do not use it for advertising.
Uploaded pay-app PDFs
You can upload pay applications (for example G702/G703 forms or your general contractors' own forms) and related documents. We store each file so you can see it beside the figures taken from it, and we keep a link from every extracted figure back to the document and page it came from.
These files often contain project names, contract sums, billing amounts and contact details for your general contractors. We use them only to provide the service to your company.
QuickBooks Online data
If you connect QuickBooks Online, you authorize the connection through Intuit's OAuth sign-in. We never see your QuickBooks password. The connection is read-only: RetainageBack cannot create, change or delete anything in your QuickBooks company.
We read customers and received payments so we can match payments to pay apps and show short payments. We store the access tokens needed to keep the connection working, along with the records we read. You can disconnect at any time from Settings or from your Intuit account, and we stop reading data as soon as you do.
AI processing by Anthropic
To read figures from uploaded pay apps, we send the document contents to Anthropic, PBC through its API. Anthropic processes the content to return the extracted figures and acts as our service provider. Under Anthropic's commercial terms, content sent through its API is not used to train its models.
Every extracted figure is stored with a confidence score and a link to its source page. Totals such as retainage held and amounts due are calculated from the figures you confirm, never taken directly from the AI output.
Payment processing by Paddle
Subscriptions are sold through Paddle.com, which acts as the merchant of record. Paddle collects and processes your payment details, billing address and tax information under its own privacy policy. We never receive your full card number. Paddle shares with us your subscription status, plan, billing email and country so we can turn the right features on.
Other service providers
We use a small number of providers to run RetainageBack. Each processes data only to provide its service to us:
- Supabase, for our database, sign-in and file storage
- Vercel, for hosting the website and application
- Resend, for sending email
- Anthropic, for reading uploaded pay apps, as described above
- Paddle, for payments, as described above
These providers may store and process data in the United States. We may also disclose information if the law requires it.
Cookies
We use cookies that are needed to keep you signed in and to keep the service secure. We do not use advertising or cross-site tracking cookies.
Data deletion on request
You can ask us to delete your account, your company's data, or specific uploaded documents at any time by emailing support@retainageback.com from the email address on the account. We confirm the request and delete the data from our active systems within 30 days. Copies in backups are removed when those backups expire on their normal schedule.
We may keep a limited record of transactions where the law requires it, for example for tax purposes. Paddle keeps its own payment records as merchant of record.
You can also ask for a copy of your data or ask us to correct it, using the same address.
Security
Data is encrypted in transit. Access to each company's data is restricted to that company's users by database-level access rules. No system is perfectly secure, and we will tell affected customers without undue delay if we learn of a breach affecting their data.
Children
RetainageBack is a business tool and is not intended for anyone under 18.
Changes to this policy
If we make a material change, we will update the date at the top of this page and email account owners before the change takes effect.
Contact
Questions about privacy go to support@retainageback.com. See also our terms of service.