Privacy Policy

Effective date: August 23, 2026

This Privacy Policy explains how However We Got Here, LLC ("HWGH," "we," "us") collects, uses, and shares information when you use StashGrade — our website, web application, and related services (the "Service"). StashGrade is a business tool for contractors; it is designed to process your company's business data, not consumer data.

If you have questions, email mike@howeverwegothere.com.

1. Information We Collect

Account information. Name, email address, password (stored as a hash), company name, and role, collected when you sign up.

Unfinished signups. If you enter an email address on the signup form but do not finish creating an account, we keep that address, along with any name or company name you entered and the company name we looked up from your email domain, so we can recognize you if you come back. We do not add these addresses to any mailing list or automated email. You can ask us to delete them at any time by emailing mike@howeverwegothere.com.

Company profile. Information you provide about your business, such as trade/industry, fiscal year, revenue context, and profit goals.

Financial and operational data from Connected Services. When you connect a third-party account such as QuickBooks Online or Jobber, we retrieve data you authorize through that connection — for example invoices, expenses, profit and loss reports, accounts, customers, vendors, jobs, and quotes. We receive this data through the provider's official API after you complete their authorization (OAuth) flow. We store the access tokens needed to maintain the connection.

Payment information. Payments are processed by Stripe. We receive subscription status and limited billing metadata (such as the last four digits of your card). We do not store full card numbers.

Usage and device data. Log data such as IP address, browser type, pages viewed, and actions taken in the Service, used for security, debugging, and product improvement.

Product usage measurement. While you are signed in, we record which page of the Service you opened, how many seconds that page was actually visible to you, which account you were using, and the time — together with a short list of named actions we care about, such as connecting QuickBooks, running an analysis, downloading an export, or opening the subscription page. We use this to see which parts of the product are actually used and which are not. We do not record anything you type, anything shown on the page, or any figure from your books. This is our own measurement, stored in our own database; no third-party analytics service is involved. Nothing is recorded from a session where our staff are viewing your account through "Login as." How long we keep it is set out in "Data Retention and Deletion" below.

Website visits by people we already know. If we already know who you are — for example, you have an account, you started signing up, or we emailed you a link — we may recognize your visits to our websites (stashgrade.com and howeverwegothere.com) and note which pages you viewed, so our team knows you are interested and can follow up. This works through a first-party cookie and tagged links in our own emails; it involves no advertising networks and no advertising cookies. We may also use a service that estimates which company an anonymous visitor is from, based on their network address. You can ask us to delete visit records tied to you at any time by emailing mike@howeverwegothere.com.

Identifying business visitors to our marketing site. On our marketing website (stashgrade.com) we use a third-party visitor-identification service, Swan, that attempts to recognize business visitors even if they have never contacted us. It works two ways. Where it can match signals from your visit against identity data held by that provider and its own suppliers (one of which is RB2B), it tells us a person's name, employer, job title, work email address, and professional profile, together with the pages that person viewed. Where it cannot identify a person, it may instead estimate only which company you are visiting from, based on your network address. We use this only to know that a contractor is evaluating StashGrade so a human on our team can follow up; we do not use it for advertising, we do not sell it, and it is never applied to your financial data or to anything inside the signed-in application. This matching relies on the provider's third-party data sources and on your network address rather than on anything you gave us. To opt out, email mike@howeverwegothere.com and we will suppress and delete records tied to you; blocking third-party scripts or using a privacy-focused browser extension prevents the match from being attempted at all.

2. Cookies and Similar Technologies

We use a small number of first-party cookies, all functional — none are used for advertising. They are: a session cookie that keeps you signed in (set through our authentication provider, Supabase); short-lived security cookies that protect the account-connection (OAuth) flows while you link a service like QuickBooks Online; preference cookies that remember which company or business entities you are viewing; if you arrive through a referral link, a cookie recording that referral; and, if you arrive through a link in one of our own emails or fill in the signup form, a cookie that lets us recognize your later visits, as described in "Website visits by people we already know" above; and, if you click one of our "connect your accounting software" buttons, a cookie recording which page and which button that was, kept for 30 days, so we can tell which parts of our site actually help people get started. That last cookie records the page and the button only — no name, no email, nothing about you — and it is set whether or not we already know who you are. We do not use advertising cookies, and we do not use a third-party analytics suite to measure the product. The visitor-identification script described in "Identifying business visitors to our marketing site" above is a third-party script that runs on our marketing pages only and may store its own identifiers in your browser there; it never runs inside the signed-in application. Our anonymous marketing-site pageview counter is cookieless: it identifies nothing and sets nothing in your browser.

At checkout, our payment processor Stripe sets its own cookies for payment processing and fraud prevention. Stripe describes them in its privacy policy at stripe.com/privacy.

Most browsers let you block or delete cookies. Blocking the sign-in cookie will prevent the web application from working.

3. How We Use Information

We use the information above to operate the Service: to analyze your business data and generate insights, scores, and reports; to maintain your Connected Service integrations; to process payments and manage subscriptions; to send transactional emails (such as alerts, digests, and account notices); to provide support; to monitor for fraud, abuse, and security issues; and to improve the Service.

AI processing. To generate insights, we send relevant portions of your financial data to our AI provider, Anthropic, through its API. This processing happens on our behalf to provide the Service to you. Under our arrangement with Anthropic, API inputs and outputs are not used to train their models. We send only the data needed for the specific analysis.

Aggregated benchmarks. We may aggregate and de-identify data across many companies to produce industry benchmarks (for example, typical material-cost percentages for fencing contractors). Aggregated data does not identify you or your company. We do not attempt to re-identify anyone from de-identified data, and we publish benchmarks only when they are aggregated across enough companies that no individual company's data can reasonably be reverse-engineered.

We do not sell your personal information, and we do not use your financial data for advertising.

4. How We Share Information

Service providers. We share information with vendors that process it on our behalf to run the Service: Supabase (database and authentication), Vercel (hosting), Stripe (payments), Anthropic (AI processing), Intuit (QuickBooks Online connection), Jobber and other integration providers you connect, and Resend (transactional email). Each is bound by its own contractual and legal obligations regarding data handling.

Partners — only with your consent. The Service may recommend third-party products or service providers. We do not share your financial data with any partner unless you explicitly consent to that specific sharing.

Legal. We may disclose information if required by law, subpoena, or legal process, or to protect the rights, safety, or property of HWGH, our users, or others.

Business transfers. If HWGH is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We will notify you of any change in ownership or use of your information.

5. Connected Services and Revoking Access

You control your Connected Service integrations. You can disconnect any integration in the Service settings, or revoke access from the third party's side (for example, in your Intuit account settings). When you disconnect, we stop retrieving new data and delete the stored access tokens. Data already retrieved remains in your account until you delete it or your account, as described below.

6. Security

We take security seriously because the Service holds financial data. Measures include encryption of data in transit and at rest, tenant isolation enforced at the database level (row-level security) so one company cannot access another's data, restricted server-side handling of credentials and tokens, and least-privilege access controls. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you without undue delay, and within the timelines Colorado law requires.

7. Data Retention and Deletion

We keep your information while your account is active. If you delete your account, or ask us to at mike@howeverwegothere.com, we will delete your account information and Customer Data within 30 days, except where we must retain records for legal, tax, or accounting compliance, and except for residual copies in encrypted backups, which expire on a rolling basis. Aggregated, de-identified data may be retained.

Product usage measurement has its own, shorter schedule, and it runs automatically rather than on request:

• The visit-by-visit record — one row per page opened, with its timestamp — is deleted after 90 days.
• A daily summary per person (pages opened and active time that day) is kept for 13 months, which is what lets us compare a month to the same month a year earlier.
• After that, only a monthly total per person remains — pages opened, active time, and how many days they were active. It carries no record of individual visits and we keep it indefinitely.

Deleting your account removes this along with everything else.

8. Your Choices and Rights

You can access and update your account and company profile in the Service settings, disconnect integrations at any time, export your data by contacting us, opt out of non-essential emails using the unsubscribe link, and delete your account.

To exercise any right, email mike@howeverwegothere.com. We will respond within the time required by applicable law and may need to verify your identity first. We will not discriminate against you for exercising privacy rights.

Universal opt-out signals. We honor opt-out preference signals such as Global Privacy Control (GPC) where the law requires it. Because we do not sell personal information or use it for targeted advertising, there is generally no sale or targeted advertising to opt out of.

9. State Privacy Rights

If you are a resident of a state with a comprehensive privacy law (such as Colorado, Virginia, Connecticut, Texas, or California), you may have the right to know what personal information we collect, use, and disclose; access a copy of it; correct inaccurate information; delete personal information; and opt out of the sale or sharing of personal information and of targeted advertising.

For clarity: we do not sell personal information, we do not share personal information for cross-context behavioral advertising, and we do not use sensitive personal information for purposes requiring an opt-out under the CCPA/CPRA.

The categories of personal information we collect are described in Section 1: identifiers (name, email, IP address), commercial information (subscription and billing metadata), professional information (company, role), financial data you connect, and internet activity (usage logs). We collect it from you and from the Connected Services you authorize, for the business purposes in Section 3, and disclose it to the service providers in Section 4.

Appeals. We respond to privacy rights requests within 45 days (extendable once by a further 45 days where the law allows; we will tell you if we need the extension). If we decline to act on your request and you are a resident of a state whose privacy law provides an appeal right — including Colorado, Virginia, and Connecticut — you may appeal by replying to our decision or emailing mike@howeverwegothere.com with "Privacy appeal" in the subject line. We will decide your appeal within 60 days and explain our reasons. If we deny your appeal and you are a Colorado resident, you may contact the Colorado Attorney General at coag.gov.

California residents may also designate an authorized agent to make requests on their behalf. Contact mike@howeverwegothere.com to exercise any of these rights.

10. Children

The Service is for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

11. Data Location

The Service is operated from the United States, and information is stored and processed in the United States. If you use the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email or in the Service before the change takes effect. The effective date at the top shows when it was last revised.

13. Contact

However We Got Here, LLC
1500 N Grant St, STE R, Denver, CO 80203, USA
Email: mike@howeverwegothere.com