Privacy policy

What data we use

• Your sign-in identity. When you sign in with Google or Microsoft we receive your account identifier and your verified email address (the openid and email scopes). We do not request access to your mail, calendar, files or contacts.
• Your company membership. Your company administrator invites you with your email and assigns you a role, or you open your company’s account with your work email. We store that membership and its status.
• Your Quickbase token. We use it to query Quickbase on your behalf. It is stored encrypted with Google Cloud KMS; only the service that runs the queries can decrypt it.
• The authorizations you grant to an assistant. Which assistant you connected, when, and until when. They last 30 days at most and you can revoke them.
• The changes you ask to make in Quickbase. If your company enables writing, the assistant prepares a plan with the records and values to be created, updated or deleted. That plan is stored encrypted with Google Cloud KMS, using a key reserved for plans and tied to you and your company, so your company administrator can review and approve it in the dashboard before it is applied, or so it can be applied directly if your company set it up that way. We also store, encrypted and for a short time, the selection of records from a query that will be used in a change. Only the service that runs the queries and the dashboard can decrypt them.
• A usage log. Which tool was used, when, and whether it worked, for security, to measure the service and for monthly billing. Apart from the change plans described above, we do not store the content of your Quickbase records or the questions you ask the assistant.

What we don’t do

• We do not sell or rent personal data.
• We do not use your Quickbase data or your Google or Microsoft information for advertising or to train artificial intelligence models.
• We never see more than you do: every query uses your own Quickbase permissions.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Quickbase data and your assistant

When you ask your assistant something, Quickbase MCP reads what it needs from Quickbase to answer and hands it to the assistant you chose. That assistant handles the information under its own terms (Anthropic, OpenAI or Google). We recommend using the business account your company has approved.

Where data is stored and who we share it with

Data is stored in Google Cloud in the United States (us-central1), encrypted at rest. We share it only with the providers that run the service: Google Cloud (hosting, database, encryption), Google or Microsoft (sign-in), Quickbase (the queries you request) and Google Workspace (service emails). We may also disclose it when required by law.

How long we keep it

• Assistant access tokens expire after one hour; authorizations after 30 days at most.
• Revoked or expired authorizations are deleted after 90 days.
• Your Quickbase token is kept while your access is active and revoked when you are removed. If your company’s free trial ends without activating the subscription, tokens are revoked 30 days after the trial ends.
• Record selections are deleted one day after they expire. Change plans that were never applied are deleted 30 days after they expire. Applied plans are kept, encrypted, as a change history for as long as your company has the service.
• The query log is kept for 13 months (monthly billing needs it) and the rest of the security and administration log for 2 years.

Your rights

You can revoke an assistant’s access at any time, from the assistant or by asking your company administrator. You can ask us to access, correct or delete your data by writing to aarrea@smartstrategyapps.com. If your company subscribed to the service, we will coordinate the request with it.

Changes and contact

If we change this policy we will publish the new version on this page with its date. Questions: aarrea@smartstrategyapps.com.

Terms of service →