PointRover Privacy Policy
Effective: November 3, 2026
What we collect
(a) Account information: your name, email address, and sign-in credentials (managed by our identity provider; we never see your password). You sign up with an email address and a password, verified by email, or with your Google account. (b) Workspace records: the businesses your workspace names and the boards derived for them — derived from public sources, not from data you upload. A build reads each business's name, its public map listing, and the text of its public website. (c) Usage and audit records: actions taken in the Service (who did what, when), and standard technical logs. (d) Billing records: a new organization starts a 14-day trial, card required, through Stripe Checkout. We store the Stripe customer and subscription identifiers and the billing status; we never see or store your card number. (e) Support requests: when you use "Something's wrong" in the console, we store the message you type, your email address, and the page's context (the workspace, the business, the page address, and your browser), and the request is sent to us.
What we deliberately do not collect
The Service is built on publicly available data. We do not require, and do not ask for, your clients' internal business data — no books, no point-of-sale, no payroll.
How we use it
To operate and secure the Service, authenticate you, maintain workspace isolation, respond to requests, and understand usage in aggregate. We do not sell personal information, and we do not display third-party advertising.
Sharing
The Service uses these providers, which process data on our behalf:
- Google Cloud hosts the Service and stores its data, and Firebase Authentication (part of Google Cloud) holds your sign-in and sends the verification and password-reset emails.
- Google's Gemini models receive the names of the businesses a workspace adds, the text of their public websites, and other public text a build reads, and may search Google with them, to plan each board; Google Maps Platform receives what you type to find a business.
- To identify a business, what you type is also searched in public registries (SEC EDGAR and GLEIF), and the address found is matched with the U.S. Census Bureau's geocoder.
- Stripe receives your organization's name, your email address, and the card and billing details you enter at Stripe Checkout, and holds your invoices and subscription.
- Google Fonts serves the typefaces these pages use, and receives your browser's request.
We do not share personal information with other third parties except as required by law.
Retention and deletion
When a workspace offboards a client, that client's derived records are deleted from the Service; the public data they were derived from remains public at its source. Minimal audit metadata (identifiers, actors, actions, timestamps — never board content) is retained, because a deletion that erases its own record is not accountable. Closing your account removes your personal information from active systems within 30 days, subject to the same audit-metadata exception and legal requirements. When an organization is deleted, its activity records are deleted 30 days later. Support requests you send are kept, and are not removed when you close your account; you may ask us to delete them.
Where your data is kept
In Google Cloud data centres in the United States.
Browser storage
Sign-in state is kept in your browser's storage, as is a business you are adding while you complete Stripe Checkout. We set no advertising or third-party analytics cookies.
Security
Access is authenticated; per-workspace isolation is enforced at the platform level; secrets are held in a managed secret store; production access is limited to the operator.
Your choices
In the console, you can offboard a business, delete your organization (by typing its name to confirm), or delete your account; each deletes as Retention and deletion describes. You may also request access to, correction of, or deletion of your personal information at mike@pointrover.com.
Children
The Service is not directed to anyone under 18 and we do not knowingly collect their information.
Changes
We post changes on this page with a new effective date; continued use after the effective date is acceptance.