Privacy Policy

Information we collect

Information you provide directly

Account information: name, business name, email address, password (stored hashed), phone number, billing address.
Business information: your service catalog, pricing, hours, resources, staff, branding, custom domains, and other operational details you enter.
Customer data: information about your own customers that you enter into Intake, including names, contact details, appointment history, and purchase history. You are responsible for collecting this data lawfully and for providing your customers any notices required by law.
Payment information: when you subscribe, Stripe collects and processes your payment details on our behalf. We receive transaction confirmations but not full payment card numbers.
Support communications: when you contact us, we collect the content of your message and any attachments.

Information collected automatically

Log data: IP address, browser type and version, operating system, referring page, pages visited, time and date of requests, and similar diagnostic information.
Usage data: features accessed, actions taken, and aggregate performance metrics.
Cookies: see the Cookie Policy at /cookies for details.

Information from third parties

When you connect a third-party service to Intake (such as Stripe for payments), we receive certain information from that service to enable the integration, such as confirmation of payment status. The information we receive is governed by both this Privacy Policy and the third party privacy policy.

How we use information

We use the information we collect to:

Provide, operate, and improve the Service.
Process subscription payments and send billing-related communications.
Respond to your support requests and communicate with you about your account.
Send transactional emails (booking confirmations, password resets, security alerts).
Send product updates and marketing communications, which you can unsubscribe from at any time.
Detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms.
Comply with legal obligations and enforce our agreements.
Analyze aggregate usage patterns to improve performance and develop new features.

How we share information

We do not sell your personal information. We share information only as described below.

Service providers (sub-processors)

We use trusted third parties to operate the Service. These sub-processors are bound by contracts requiring them to protect your information and use it only for the purposes we specify. A current list is maintained at /sub-processors.

Legal requirements

We may disclose information if required by law, court order, or government request, or if we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud.

Business transfers

If Intake is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you (via email and a prominent notice on our website) of any change in ownership or use of your information.

With your consent

We share information with third parties when you direct us to do so, such as when you connect a third-party integration.

Your customers data

When you use Intake to manage your own business, you may enter information about your customers ("Customer Data"). With respect to Customer Data:

You are the data controller for Customer Data. Intake processes Customer Data on your behalf as a data processor.
You are responsible for obtaining any consents and providing any notices required by law before entering Customer Data into Intake.
You are responsible for responding to your customers data subject rights requests (access, deletion, etc.). We will assist you with reasonable requests.
We do not use Customer Data for our own marketing or to train algorithms outside of providing the Service.

Data retention

We retain your information for as long as your account is active and as needed to provide the Service. After account closure, we retain your data for 90 days for potential reactivation, then permanently delete it unless a longer retention period is required by law or for legitimate business purposes (such as fraud prevention, dispute resolution, or financial record-keeping).

You may request earlier deletion by emailing privacy@intake.works. We will honor verified deletion requests within 30 days.

Security

We implement administrative, technical, and physical safeguards to protect information, including encryption in transit (TLS), encryption at rest for sensitive data, access controls, regular security reviews, and offsite backups. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If we become aware of a security breach that affects your information, we will notify you and applicable authorities as required by law.

Your rights

Depending on your location, you may have the following rights regarding your personal information:

Access — request a copy of the personal information we hold about you.
Correction — request that we correct inaccurate or incomplete information.
Deletion — request that we delete your personal information, subject to legal retention requirements.
Portability — request a copy of your personal information in a structured, machine-readable format.
Opt-out of marketing — unsubscribe from marketing emails using the link in any marketing message or by emailing privacy@intake.works.
Restriction — request that we limit how we process your information.
Objection — object to certain types of processing.

To exercise these rights, email privacy@intake.works. We will respond within 30 days. We may need to verify your identity before processing your request. We will not discriminate against you for exercising your rights.

California residents: under the California Consumer Privacy Act (CCPA), you have additional rights including the right to know what categories of personal information we collect and the right to opt out of any "sale" of personal information. We do not sell personal information.

Children

Intake is a business tool intended for use by adults. We do not knowingly collect personal information from anyone under the age of 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us with personal information, contact privacy@intake.works.

International transfers

Intake currently stores and processes data only in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, which may have different data protection laws than your country.

Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice via email or in-app notification at least 30 days before the change takes effect. The "Effective" date at the top of this page indicates when the current version became effective. Continued use of the Service after changes take effect constitutes acceptance.

Contact

Questions about this Privacy Policy or how we handle your information? Contact us at privacy@intake.works or write to Intake, 2935 W Dean, Spokane, WA 99201.