Privacy Policy

Effective date: October 15, 2026

This Privacy Policy explains how Gabriel Gudino, operating as Noisy AI (“Noisy,” “we,” “us”) handles information collected through our marketing website at noisyco.com (the “Site”) and through the Noisy application at app.noisyco.com (the “App”), including information from integrations you authorize in the App. Each section says whether it applies to the Site, the App, or both. For privacy questions and requests, email support@noisycrm.com.

The Site (noisyco.com)

What we collect on the Site

The only personal information we collect on the Site is what you submit through our contact form:

• Name and company name
• Email address and phone number
• Role / job title and inquiry type
• Your message
• Your browser's user-agent string (collected automatically with the submission, for basic spam and abuse troubleshooting)

We also collect aggregate usage measurements through Vercel Web Analytics. For each visit that means:

• Which pages were viewed, and when
• Which of a short list of buttons were clicked (today: the pricing plan buttons, with the plan and billing cycle chosen)
• The referring site or campaign that sent you to us
• Approximate location, at country and region level only — never a street address or precise coordinates
• Operating system, browser, and device class (desktop, mobile, tablet)
• A hash computed from your IP address and browser user-agent, used to count unique visitors. The hash rotates daily and the IP address itself is not stored.

These measurements are cookieless: nothing is written to your device and nothing follows you to other websites. We never receive your name, email, or an advertising profile alongside them, and we don't try to identify you from them. We won't overclaim beyond that — a daily hash of IP and user-agent is pseudonymous rather than anonymous, so a single visitor's same-day activity is grouped together, and technical data of this kind can in principle be correlated with other records. Because the hash changes every day and we hold nothing to correlate it against, we have no practical way to link it to a person.

We don't collect anything else on the Site. There's no account creation and no checkout on the marketing pages — those happen in the App, described below.

How we store and use Site information

Contact form submissions are stored in our database (Supabase), hosted in the United States (us-east-1 region). Access is limited to the Noisy team members who need it to respond to inquiries.

We use the information you submit only to respond to your inquiry — by email, SMS/text, or phone, consistent with what the contact form states when you submit it — to route your request to the right person on our team, and to keep basic records of who has reached out to us. We do not use contact-form submissions for advertising, profiling, or any purpose beyond responding to you, unless you separately opt in to something else.

What we don't do on the Site

• No advertising or cross-site tracking. The Site runs no ad pixels, no retargeting tags, and no third-party trackers. The one measurement tool we do run (Vercel Web Analytics — the full list of what it records is above) reports in aggregate, builds no advertising profile, and cannot follow you to other sites.
• No tracking cookies. We don't set cookies to track you across visits or across other sites — and as of the effective date, the Site sets no cookies at all. (The App is different: see “Providers, access and security” below.)
• No selling data. We never sell, rent, or trade Site information to data brokers or third parties, and we do not share it with third parties for their own marketing or advertising purposes. The same promise covers the App — see “We don't sell your data” below.
• No newsletter without consent. We won't add you to a marketing list unless you clearly opt in.

Who sees Site information

Your contact-form submission is visible to Noisy team members handling sales and support inquiries. We also rely on infrastructure providers that process data only as needed to run the Site: Supabase (database hosting, US us-east-1) and Vercel (website hosting and the aggregate analytics described above).

Site data retention

We retain contact-form submissions for up to 24 months, or until you ask us to delete them — whichever comes first. This 24-month rule applies to contact-form submissions only; it is not a retention period for App data.

The App (app.noisyco.com)

Gabriel Gudino, operating as Noisy AI provides the application at app.noisyco.com. This section explains the App's data practices, including integrations you authorize.

Information we process in the App

We process account and organization information, including email addresses, company details, roles and settings. We also process information you enter or authorize integrations to provide. Depending on the features you use, this can include jobs, leads, customer/contact details, job addresses, appointments, financial records and performance measurements.

We retain connection settings and credentials needed for authorized integrations, along with synchronization status, errors and other operational records. Stripe processes payment details through its payment interface; Noisy stores identifiers and billing-status information used to administer subscriptions and access.

The App measures aggregate product usage through Vercel Web Analytics — for example, when signup, checkout, an integration connection or a KPI entry happens, and which App screens and features are opened.

Connected tools

An owner or administrator of your organization chooses which tools to connect. Each connection reads only what the App needs for the feature described here:

• QuickBooks Online — connects with Intuit's accounting permission. The App reads invoices, payments, bills and purchases to calculate finance measurements such as revenue, collections and costs.
• Jobber — reads jobs, including job number, status, total, dates, the client's name and the service address, and calculates job measurements from them.
• JobNimbus and AccuLynx — connect with an API key you provide. The App reads jobs, including status, customer name and job address.
• Google Calendar — read-only calendar permission plus your Google account email. The App reads upcoming events (the next 14 days) on the calendars configured for your organization and stores counts of them, such as appointments today and in the next 7 and 14 days.
• Google Analytics — read-only Analytics permission plus your Google account email. The App reads aggregate website reports for the property you choose (for example sessions, users, page views and sessions by channel). It does not read information about individual visitors.
• Google Sheets — described in detail below.

Connected services remain subject to their own terms and privacy policies. We store the credentials an integration needs to keep syncing, encrypted in our database.

Google Sheets

Connecting Google Sheets requests permission to read spreadsheets and identify your Google account, including its email address. The spreadsheet permission can cover more files than the one you select. Noisy's current Sheets feature reads the spreadsheet and tab you configure to calculate marketing measurements, such as canvassing counts, leads, costs and conversion rates. It does not edit your spreadsheet.

The sync reads values from columns A through Z of the selected tab, even when calculations use only some of those columns. Configure a tab containing information appropriate for this feature. We store calculated indicators, spreadsheet/tab and mapping settings, synchronization records, your Google account identifier/email, and encrypted access and refresh credentials. Refresh credentials allow authorized syncing without asking you to sign in each time.

Organization members see information according to their permissions. Synced business measurements may also become inputs to reports or AI features, as described below.

AI features and reports

AI features are off unless an owner or administrator of your organization turns them on. When an owner or administrator turns them on, Noisy uses Anthropic to generate dashboard explanations, answers and report narratives. Relevant performance indicators and business context are sent to Anthropic. Questions you submit and recent conversation context are included when generating answers. The App stores conversations and generated insights.

Report narratives may include report detail rows as input; identifying fields are replaced with positional labels in that report-generation path. This does not make every AI input anonymous: questions can contain personal information, and business figures may remain sensitive. Avoid including sensitive information unnecessary for the feature. We make no blanket claim here about AI-provider training or retention settings.

Generated PDFs are stored and provided through authorized App actions. Download links currently expire after one hour. Where report delivery is enabled, the organization owner and configured additional recipients can receive report links. Anyone holding a valid link may be able to download the report before it expires, and recipients can retain downloaded copies.

Providers, access and security

The App uses Supabase for authentication, database and report storage; Vercel for hosting and aggregate usage analytics; Stripe for payments; Anthropic for AI processing when AI features are turned on; and Resend for supported email delivery. Connected services process requests you authorize. This list describes the named providers used by these features, rather than promising no other processing arrangements exist.

We maintain encrypted recovery copies of application database information and stored reports. Our recovery workflow runs on GitHub Actions and stores encrypted archives in a private Google Drive folder. These recovery copies are separate from a customer's Google Sheets connection. GitHub processes the backup task, and Google Drive stores the encrypted archives. Access to backup credentials and recovery material is limited to authorized operators and the configured recovery workflow.

The App uses membership and permission controls and encrypts integration credentials stored in its database. These safeguards do not guarantee absolute security. The App also uses session cookies and organization-selection state; the Site's statements about having no cookies do not apply to the App.

Google API data

Noisy's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Disconnecting an integration

Owners and administrators can disconnect an integration in the App's integration settings. This removes the organization's connection record and stored credentials from the App. For Google services, you can also withdraw Noisy's access through your Google account's third-party connections settings. An already-running request may finish during disconnection.

When you disconnect a tool, we remove the connection and its stored credentials right away. Data that tool already imported stays in your workspace so your history and reports keep working. You can ask us to delete it at any time by emailing support@noisycrm.com.

Disconnecting a tool does not cancel your subscription.

Both the Site and the App

We don't sell your data

We never sell, rent, or trade information from the Site or the App — including data your connected tools import into the App — to data brokers or third parties, and we do not share it with third parties for their own marketing or advertising purposes.

Your choices: access, correction and deletion

To request access, correction or deletion, email support@noisycrm.com. We review requests to verify your identity and authority for the organization, identify the affected records and explain any information that needs to remain. Deletion review covers active records, logs, generated content and recovery copies. Copies already downloaded by recipients are outside that deletion process.

Deleting an active App record or disconnecting an integration does not immediately remove every historical recovery copy. This policy does not promise an automatic purge or a fixed App-wide retention period.

Children's privacy

The Site and the App are intended for business use by adults in the roofing and construction trades. They are not directed at children, and we do not knowingly collect information from anyone under 18.

Changes to this policy

We may update this Privacy Policy from time to time. Before a material change takes effect, we'll email App customers at the email address on their account and update the effective date above. If you keep using the Site or the App after the updated policy takes effect, you accept the updated policy.

Contact us

Questions about this policy, or want to exercise your data rights? Email support@noisycrm.com.