Quovec™ is a business operations platform operated by Stokeld Holdings LLC (Lake Charles, Louisiana). This Policy explains how we handle personal information in two distinct roles:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, business email, role, org, authentication events | You / your employer |
| Customer Data (processor role) | Sales/POS records, labor hours and schedules, inventory, lease and vendor documents, manager contact info | Connected systems & uploads by the customer |
| Usage & device data | Log data, IP address, browser/app version, feature usage | Automatic |
| Support & communications | Emails, support requests | You |
We do not collect data from consumers, do not run third-party advertising trackers in the product, and do not intentionally collect data about minors.
AI processing. The platform uses a large-language-model provider (currently Anthropic) solely to write plain-English narration of results computed by our own code. Providers processing data through our Service are contractually prohibited from using it to train their models. We do not use Customer Data to train foundation models.
No sale / no sharing for ads. We do not sell personal information and do not share it for cross-context behavioral advertising.
We disclose personal information only to: (a) the subprocessors listed in our DPA (hosting, database, content delivery, model narration, email delivery) under written data-protection terms; (b) professional advisors under confidentiality; (c) authorities when legally required (we will notify the customer unless prohibited); and (d) a successor in a merger or asset sale, under this Policy. Current core subprocessors: Supabase (database/auth, AWS us-east-1), Fly.io (application hosting, US), Cloudflare (delivery/security), Anthropic (narration), [email provider].
We apply layered, engineering-enforced controls: encryption in transit (TLS) and at rest; per-tenant isolation enforced at the database with row-level security; region-scoped access controls; least-privilege service credentials; signed asymmetric authentication tokens; human-approval gates on sensitive actions; and audit logging. No system is perfectly secure; we will notify affected customers of a personal-data breach without undue delay consistent with law and the DPA.
Account data is kept for the life of the account and up to [24] months after closure. Customer Data is retained while the customer subscription is active and deleted or returned per the DPA (export window, then deletion within [30] days). Logs are retained up to [12] months. We may retain data longer where required by law or for dispute defense, then delete it.
Depending on your jurisdiction, you may have rights to access, correct, delete, or port personal information, and to object to or restrict certain processing. For account data, contact privacy@quovec.com; we respond within the time required by law and do not discriminate for exercising rights. For Customer Data (e.g., you are an employee of a Quovec customer), contact your employer — we will assist them as processor. We honor authorized-agent requests as required by law.
The Service is hosted in the United States. If you access it from outside the U.S., you understand data is processed in the U.S. For customers subject to GDPR/UK GDPR, the DPA includes appropriate transfer safeguards (e.g., SCCs) where applicable.
We will post material changes here and notify customers at least [30] days before they take effect. Questions or requests: privacy@quovec.com · Stokeld Holdings LLC, [mailing address], Lake Charles, Louisiana.