Privacy policy

Tools As Intended is a line of business tools built and operated by Work As Intended LLC, based in South Lake Tahoe, California. The platform is white-label: we sell wholesale to consultancies and IT service providers ("Providers"), who resell the tools under their own brand to their own small business clients ("Tenants"). If you use the tools through a Provider, that Provider controls your relationship, pricing and branding. We maintain the products and have no direct commercial relationship with a Provider's clients.

This policy covers the Tools As Intended platform at toolsasintended.com, app.toolsasintended.com, sign.toolsasintended.com, Provider subdomains and custom domains, and the Seiche desktop application.

Contact for any privacy question or request: toby@workasintended.com.

• We collect the minimum needed to run the tools: your Google sign-in identity, the business data you put into the tools, and billing details handled by Stripe.
• We never sell personal data, never use it for advertising, and never use customer data to train AI models.
• Outbound email always requires human approval before anything sends. Nothing sends automatically.
• Data lives on AWS in the United States, encrypted in transit and at rest, with per-tenant isolation.
• You can disconnect Google and request deletion of your data at any time.

Account and identity data. Sign-in is through Google (OpenID Connect). We receive your verified email address, name and profile basics, and use the email to match you against an invite-only allowlist. There is no self-service account creation outside the signup flow.

Business data you put into the tools. Depending on which tools a Provider has enabled, this can include:

• Client Portal: client and company records, time entries, work logs, and report content.
• Seiche Time Tracking: clients, projects, hours and billable amounts synced from the macOS app.
• Document Signer: uploaded PDF/Word documents, signer names and email addresses, signature events, and the resulting certified PDFs and audit trails. Signature recipients do not need an account.
• Client Finder: prospect and lead data sourced on your behalf, outreach drafts, send logs and suppression lists.
• Social Publishing (in development): connected social account tokens, drafted posts and publish history.

Google user data. When you connect a Google account, we request only the scopes each feature needs. Details and our commitments are in the Google section below.

Billing data. Payments are processed by Stripe. We never see or store full card numbers; we receive subscription status and billing identifiers only.

Technical data. Session cookies (signed, 7-day expiry), standard server logs, and usage counters used to enforce plan limits. We do not run third-party advertising or analytics trackers on the application.

Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google tokens are stored encrypted with AES-256-GCM. You can disconnect Google at any time from the portal (which revokes our access) or from your Google account settings. We do not use Google user data for advertising, profiling, or model training, and we do not transfer it to third parties except as required to provide the feature you used.

• Provide, operate and support the tools for Providers and their Tenants
• Generate the documents, reports, drafts and records you ask for
• Process billing through Stripe
• Enforce plan limits and prevent abuse
• Meet legal obligations and keep security and audit records

Client Finder uses third-party search and AI providers to source and draft prospects. Prospect queries and lead data may pass through those providers to produce results, under their own data processing terms. We do not permit them to use your data to train their models where the provider offers that commitment.

Every external communication the platform produces, outreach email or social post, requires a human to review and approve it before it sends or publishes. There is no autonomous sending.

• Data is stored in AWS data centers in the United States, encrypted in transit (TLS) and at rest (SSE-S3 for files, AWS-managed encryption for the database).
• Access tokens for connected services (Google, Notion, social accounts) are encrypted with AES-256-GCM.
• Tenant data is isolated by application-level scoping: every record is keyed to its Tenant, and services authenticate to each other with signed, tenant-bound tokens.
• Backups run daily with point-in-time recovery, and signed documents replicate to a second AWS region.
• We retain data for as long as the Tenant's account is active. Signed documents and their audit trails are kept as legal records. Backups expire within 35 days of deletion from live systems.

Any user can ask to export or delete their data, and any Tenant can disconnect integrated services at any time. We honor deletion requests within 30 days, and backups cycle out within the retention window above. California residents have the rights described by the CCPA/CPRA, including the right to know, delete and correct personal information, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those laws define it.

If you are an end user of a Provider, the fastest path is usually to ask your Provider, since they control the relationship, but you can always contact us directly.

The tools are business products and are not directed at anyone under 18. We do not knowingly collect data from children.

If we change this policy materially, we will post the new version at toolsasintended.com/privacy and update the effective date. Continued use after that date constitutes acceptance.

Work As Intended LLC, South Lake Tahoe, CA. Privacy questions and requests: toby@workasintended.com. See also our terms of use.