Privacy and data
Updated November 1, 2026. This notice describes the current Oaklatch beta.
Your account and workspace
Oaklatch uses your verified email to sign you in and associate your saved workspace with your account. Supabase handles email authentication. Customer records, estimates, reusable services and support tickets are stored in the hosted application database on Cloudflare. Access to workspace records requires authentication. The support operator can review submitted support tickets; submit only the details needed to investigate your issue.
Quote and invoice links
In Pro, the contractor can create a private review link containing a frozen copy of selected quote details. Anyone with that link can view the quote and submit a typed name and consent statement. The record stores that name, the exact consent text, a server timestamp and the quote fingerprint. Identity and email are not verified. Review pages do not load advertising measurement or first-party traffic tracking. Links expire and can be revoked; saved snapshots and acceptance records remain available to the contractor for export. Contact the contractor about access, paper copies, changes or deletion requests. Do not forward a quote link.
Document email and reminders
Resend sends quote and invoice emails after the contractor reviews the saved recipient. Messages include private document links and a preference link to stop future messages from that contractor. Reminder payloads are encrypted at rest. Delivery and failure events are verified using provider signatures. Replies go to the contractor’s verified sign-in email. Text drafts open in the contractor’s messaging app and require them to send.
Customer invoice payments
Contractors onboard their own Stripe merchant account through Stripe-hosted pages. Customer invoice payments use Stripe-hosted Checkout and go to that contractor. Oaklatch stores account references, verified receipt and refund summaries, and limited reconciliation records; it does not store full card or bank account details. Public invoice pages do not load advertising or traffic tracking. Anyone holding a private link can view it until expiry or revocation.
Billing
Stripe processes paid subscriptions, payment methods, invoices and billing portal requests. Oaklatch stores Stripe customer references and event receipts to reconcile access; it does not store your full card number. Creating an account does not create a paid subscription. Existing beta grants do not become paid automatically.
Site activity
First-party traffic statistics use a browser-tab session identifier, page path, sanitized referral/campaign labels, visible time on the page, and fixed interaction categories (sample edits, preview opens, plan-button clicks and email sign-in steps). Interaction events do not include entered numbers, email addresses, verification codes or job content. Browser request steps are not confirmed sign-ups; verified account events are recorded separately. These statistics do not store names, email addresses or IP addresses. Traffic records are retained for up to 90 days. Hosting and authentication providers may separately process request, security and operational logs.
Optional Google Ads measurement
On the plans page and signed-in workspace, Google Ads measurement loads only after you choose Allow measurement. It can use advertising cookie and click identifiers. With your permission, Oaklatch reports a server-verified first paid subscription using its paid amount, currency and an opaque transaction identifier to avoid duplicate counting. Account creation, free access, page visits, upgrades and renewals are not paid conversions. Oaklatch does not include your name, email, customer records, estimate details or support messages in advertising measurement. Enhanced conversions and ad personalization signals are disabled. Declining measurement does not affect your access.
Review or change your ad measurement choice. Choosing No thanks prevents Google Ads measurement from loading on subsequent visits on this browser. Browser choices are separate across devices and site domains. Browser settings can clear existing cookies and local site data.
Optional Meta signup measurement
Meta (Facebook and Instagram) measurement requires its own opt-in, separate from Google Ads. Only a fresh, server-verified first email registration is eligible. It runs on a clean confirmation page, not the sign-in form, customer workspace or private document pages. Meta may receive browser/cookie identifiers, an opaque event identifier, a registration event and standard connection information such as IP address. We do not include typed email addresses, verification codes, job content or payment amounts. Automatic events and advanced matching are disabled. Do Not Track, owner and known test activity are excluded. Declining does not affect access.
Change your choice below. Turning it off prevents future dispatches; previously transmitted data cannot be recalled from Meta. Choices are browser-specific. A first-party one-time registration measurement ledger contains a hashed account key, random identifiers and timestamps for up to 90 days to prevent repeated dispatch attempts. An attempt is not proof of delivery or an attributed ad conversion.
Exports and requests
You can export your workspace records from the app. Existing records remain available to view and export after beta access expires. For questions about data access, deletion or billing, contact gjake0257@gmail.com or use Help & Support. Do not send passwords, payment card details or identity documents through support tickets.