Privacy Policy

This Privacy Policy describes how AOS ("we", "us", "our") collects, uses, and protects information when you visit startaos.com or use the AOS service at alpos.alpcontractorcircle.com (together, the "Service").

1. Who we are

AOS provides operating-system tooling for contracting businesses — vision/traction planning, quarterly rocks, scorecards, L10 meeting management, accountability charts, and related features. You can reach us at marshall@marshallwilkinson.com.

2. Information we collect

• Account information. When you sign up with email and password we collect your name, email address, and a hashed password. When you sign in with Google we receive your name, email address, and Google account ID.
• Workspace and company data. Information you and your team enter into the Service (companies, vision documents, rocks, scorecard metrics, meeting notes, to-dos, issues, team members, uploaded documents, and similar).
• Billing information. If you purchase a paid plan, additional workstations, or seats, our payment processor (Stripe) collects your payment details. We do not receive or store your full card number; we retain billing metadata such as your plan, quantity, subscription status, renewal dates, and the brand and last four digits of your card.
• AI feature inputs. Content you submit to optional AI features — for example workspace text used to generate suggestions, and meeting audio you record or upload for transcription.
• Usage and diagnostic data. Basic usage logs and error reports used to keep the Service reliable and secure.
• Communication data. Email addresses we send transactional emails to (sign-in, invitations, reminders, digests) and your unsubscribe preferences.

3. Google user data

When you choose "Continue with Google" we request only the standard email, profile, and openid scopes, and use them solely to create and authenticate your account and to display your name and email inside the Service. We do not sell or share your Google user data for advertising or any unrelated purpose, and we do not use it to build advertising profiles or to train AI models. You can revoke our access at any time from your Google account permissions page.

4. How we use your information

• To provide, maintain, and improve the Service.
• To authenticate you and keep your account secure.
• To send transactional emails (confirmations, password resets, invitations, meeting reminders, weekly digests).
• To process payments and manage subscriptions.
• To diagnose errors and prevent abuse, and to respond to support requests.

We do not sell your personal information and we do not use it for third-party advertising.

5. Payments and billing

Paid plans, additional workstations, and seats are billed through our payment processor, Stripe. When you subscribe, Stripe collects and processes your payment details directly — we never receive or store your full card number. We retain billing metadata (plan, quantity, subscription status, renewal dates, and the brand and last four digits of your card) to manage your subscription and provide receipts. Stripe's handling of your payment information is governed by Stripe's own privacy policy.

6. AI-powered features

Some optional features use AI to generate suggestions and content — for example suggested Rocks and milestones, Vision/Traction (V/TO) suggestions, SOP drafting, and transcription of meeting audio you record or upload. When you use one of these features, the relevant content you submit (workspace text, or the audio you provide for transcription) is sent to a third-party AI processing provider to produce the requested result, which is then returned to you.

This content is processed only to deliver the feature you requested. We do not use your workspace or account data to train our own models, and we do not sell it; we require our AI provider to process it solely to provide the service. AI features are optional and the core Service works without them. Because AI output can be imperfect, you remain responsible for reviewing any suggestion before relying on it.

7. Where your data is stored and international transfers

Data is stored in our managed cloud backend (Lovable Cloud, built on Supabase) with encryption at rest and in transit. Transactional email is delivered via our email provider.

Our infrastructure and sub-processors may store and process your data in the United States and other countries, which may have data-protection laws different from those in your own country. If you access the Service from outside those countries — including from Australia or Canada — your personal information will be transferred across borders. Where it is, we take reasonable steps to ensure it remains protected in line with this Policy and applicable law.

8. Sharing

We share data only with sub-processors that help us operate the Service (hosting and database, email delivery, error monitoring, payment processing, and AI processing), and only as necessary to provide the Service. We may also disclose information if required by law or to protect our rights or the safety of users. We do not sell your personal information.

9. Your rights and choices

• Access & export. You can export your workspace data from Settings → Export inside the app.
• Deletion. You can delete your account and associated data from Settings → Danger Zone, or by emailing us at marshall@marshallwilkinson.com.
• Email preferences. Every non-essential email includes an unsubscribe link.

10. Regional privacy rights

Depending on where you live, you may have additional rights over your personal information. You can exercise any of them by emailing us at marshall@marshallwilkinson.com, and we will not treat you differently for doing so.

• Canada (PIPEDA). You may request access to, and correction of, the personal information we hold about you, and you may withdraw consent subject to legal or contractual limits. If you have an unresolved concern, you may contact the Office of the Privacy Commissioner of Canada.
• Australia (Privacy Act 1988 and the Australian Privacy Principles). You may request access to, and correction of, your personal information and ask how it is handled. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner.

11. Data retention

We retain your data while your account is active and for a short period afterward to comply with legal obligations and resolve disputes. On deletion, your workspace data is removed from our active systems and purged from backups within a reasonable period.

12. Cookies

We use first-party cookies and similar storage strictly to keep you signed in and to remember basic preferences. The startaos.com marketing site uses minimal cookies, and we do not use third-party advertising cookies.

13. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or through an in-app notice before they take effect.

15. Contact

Questions about this Privacy Policy or your data? Email marshall@marshallwilkinson.com.