Privacy Policy

Effective date: October 12, 2026

1. Who we are

Expense Control Hub (the "Service") is a product of SMB Strategy Consultants, operated by SMB Strategy Consultants, LLC ("SMBSC," "we," "us," or "our"). This policy explains what information we collect through the Service, how we use it, and the choices you have.

2. What this policy covers

This policy covers our website at expensecontrolhub.com and the Expense Control Hub web application at app.expensecontrolhub.com. It does not cover third-party sites or services we link to, such as our demo scheduling tool or Google Drive, which have their own privacy policies.

The Service is built for businesses. For financial information you upload about your company, your business decides what goes in and who sees it, and we handle it on your behalf to provide the Service.

3. Information we collect

Information you give us

• Account information: your name, email address, and sign-in details. You sign in with a one-time code sent to your email address; we do not store passwords. Access is by invitation only.
• Workspace information: company names, the people you invite, and their roles (owner, admin, editor, or viewer).
• Business financial information: files and data you upload or enter, such as summary profit & loss statements, balance sheets, cash flow statements, Excel or CSV files, expense lists, vendor and contract dates, debt details, and how profit is allocated across business channels. Uploaded files are stored in the company workspace they belong to.
• Information you create in the app: budgets, cut and review lists, checklists, notes, and reports.
• Messages: anything you send us when you email us or ask for support.
• Billing information (once paid plans are available): plan, billing history, and billing contact. Card details are collected and stored by our payment processor, PayPal, not by us.

Information collected automatically

• Sign-in session data so you stay signed in (see Section 9).
• Technical and log data that our hosting providers record when your browser connects, such as IP address, browser type, device information, pages or functions requested, and timestamps. We use this for security, troubleshooting, and keeping the Service running.

Information from Google (optional)

If you turn on the Google Sheets copy, your workspace data is written to a Google Sheet so you can work with it there. The Sheet is created in SMBSC's Google Drive and shared with the email address you choose. We do not ask for access to your Google account. If we later offer a direct connection to your own Google account, we will update this policy first and describe the permissions requested.

4. Information you should not upload

The Service is meant for summary-level business financials only. Please do not upload:

• Protected health information (PHI) or any health or medical information;
• Personal data about your patients, customers, clients, or employees, such as individual payroll records, Social Security numbers, or contact lists;
• Government ID numbers, bank login credentials, or full bank or payment card numbers.

We are not a HIPAA business associate, and the Service is not designed to protect regulated data of that kind. If we learn that this kind of information has been uploaded, we may delete it.

5. How we use information

• To provide the Service: store your files, run the Salary Cap budget calculations, and build your lists, checklists, and reports;
• To manage your account and workspaces, including sending invitations and enforcing roles;
• To respond to your questions and provide support;
• To keep the Service secure, prevent abuse, and fix problems;
• To process payments, once paid plans are available;
• To improve the Service, for example by understanding which features need work. We do this without selling your data or sharing it for advertising; and
• To comply with the law and enforce our Terms of Service.

6. What we don't do

• We don't sell your personal information or your business data, and we don't "share" it for cross-context behavioral advertising.
• We don't use your financial data for advertising. The app has no ad networks or tracking pixels.
• We don't send your financial data to AI services. Calculations are done by the app's own logic.
• We don't send marketing email from the app.

7. Who can see your data

• People in your workspace. Members you invite can see and change workspace data according to their role. The account holder and workspace owners are responsible for who they invite.
• Our team. A small number of SMBSC staff may access workspace data when needed to provide support you ask for, investigate a security issue or bug, or comply with the law. Access is limited to authorized SMBSC personnel using individual accounts.
• Service providers listed in Section 8, only to run the Service for us.
• Legal and safety reasons. We may disclose information if required by law, subpoena, or court order, or to protect the rights, safety, or property of our users, the public, or us.
• Business transfers. If SMBSC is involved in a merger, acquisition, or sale of assets, information may transfer as part of that deal, subject to this policy.

8. Service providers

We use a few trusted providers to run the Service:

• Convex — application backend, database, and file storage for app data and uploaded files.
• Netlify — hosting for our marketing website.
• Google Fonts — our website and app load fonts from Google, which means your browser connects to Google's servers and Google receives your IP address.
• Google Sheets / Google Drive — only if you choose to export there. The exported copy lives in your Google account.
• Motion — the scheduling tool behind our "Book a live demo" link. Information you enter when booking is collected by Motion under its own privacy policy.
• PayPal — payment processing, once paid plans are available.
• Resend — delivery of sign-in codes, invitations, and service emails.

9. Cookies and similar technology

The app uses cookies or browser storage only as needed to keep you signed in and to make the app work. Sign-in tokens are kept in your browser's local storage, and sessions expire after 30 days or when you sign out. We don't use advertising cookies or tracking pixels.

Our marketing website (expensecontrolhub.com) does not include analytics or advertising scripts. It does load fonts from Google Fonts, as described above. Our hosting provider may keep standard server logs.

10. Emails we send

The app sends only service emails, such as sign-in messages, workspace invitations, and important notices about your account or these policies. We don't send marketing email from the app. If SMBSC ever offers a newsletter, it will be opt-in, with a way to unsubscribe in every message.

11. Security

We take reasonable steps to protect your information, including:

• Data is encrypted in transit using HTTPS.
• Data is stored with our hosting providers, who encrypt data at rest.
• Access to company workspaces is limited by membership and role.

No system is perfectly secure, and we can't guarantee absolute security. Help us by using a strong, unique sign-in, keeping workspace membership up to date, and uploading summary data only. If we learn of a security breach affecting your personal information, we will notify you as required by law.

12. How long we keep data

• Active workspaces: we keep workspace data while the workspace exists and your account is active.
• Deleted companies: when an owner deletes a company workspace, it can be restored for 7 days. After that, it is permanently deleted from the live Service, including its uploaded files.
• Backups: periodic backups are retained for up to 30 days, after which deleted data is no longer present in them.
• Account information: kept while your account is open and deleted within 30 days after you close it, except where we need to keep some records (such as billing records) to meet legal, tax, or accounting obligations.
• Logs: kept by our hosting providers for their standard retention periods.

13. Your choices and rights

• Export: workspace owners can export a company's full data to Excel at any time.
• Correct: you can edit most information directly in the app.
• Delete: owners can delete a company workspace. To close your account or request deletion of your personal information, email corbin@smb-sc.com.
• Disconnect Google: you can remove our access at any time in your Google account's security settings.
• Access and other rights: depending on where you live, you may have the right to know what personal information we hold about you, get a copy, correct it, delete it, or opt out of its sale or sharing (we don't sell or share it). To make a request, email corbin@smb-sc.com. We may need to verify your identity, and we won't discriminate against you for exercising your rights.

If you were invited to a workspace by another business, that business controls the workspace's financial data. We may refer requests about that data to the workspace owner.

14. Children

The Service is for businesses and is not directed to anyone under 18. We don't knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

15. Where data is stored

We are based in the United States, and our service providers store and process data in the United States. If you use the Service from outside the U.S., your information will be transferred to and processed in the U.S.

16. Changes to this policy

We may update this policy from time to time. We'll change the effective date above, and for material changes we'll notify account holders by email or in the app before the changes take effect.

17. Contact us