Legal · Hammerhead HQ

Privacy Policy

Effective: July 12, 2026

01Who we are

Hammerhead HQ LLC ("Hammerhead," "we," "us") provides business management and accounting software for small businesses at hammerheadhq.com and hammerheadhq.app. This policy explains what information we collect, how we use it, and the choices you have. Questions: security@hammerheadhq.com.

02Information we collect

Account information. Name, email address, company details, and login credentials when you or your employer create an account.

Business data you enter. The operational and financial records you keep in the platform — customers, jobs, quotes, invoices, bills, payroll records, and accounting entries. This data belongs to you.

Bank account data via Plaid. If you choose to connect a bank account, we use Plaid Inc. to access your account information — balances and transaction history (including merchant names and categories) — to power bank reconciliation and expense categorization in your books. You connect your bank through Plaid's own consent flow; we never see or store your banking username or password. Access credentials issued by Plaid are stored encrypted. Plaid's handling of your data is described in the Plaid End User Privacy Policy.

Usage and log data. Standard technical logs (IP address, browser type, pages viewed, errors) used to operate, secure, and improve the service.

03How we use information

We use your information only to provide and improve the service: displaying your business data back to you, keeping your books, importing and categorizing bank transactions you've connected, billing for subscriptions, providing support, and keeping the platform secure. We do not sell your data, and we do not use your financial data for advertising, lending decisions, or credit scoring.

04How we share information

We share data only with service providers needed to run the platform: DigitalOcean (hosting, United States), Plaid (bank connectivity), Stripe (payments and billing), and transactional email providers. Each processes data under its own security and privacy obligations. We may also disclose information when required by law. We never share one customer's business data with another customer.

05Security

All traffic is encrypted in transit (TLS). Databases are encrypted at rest. Bank access credentials receive additional application-layer encryption (AES-256-GCM). Access to production systems is restricted and protected with multi-factor authentication. Details are set out in our internal Information Security Policy. If we learn of a security breach affecting your information, we will notify you as required by applicable law.

06Data retention and deletion

We retain your data for as long as you have an account. If you close your account and request deletion, we delete your tenant data within 30 days, except records we are required to keep for legal or tax purposes. Some records have legally required retention periods — for example, tax-related records are generally retained at least three years and payroll records at least four years under IRS rules — and we retain those for the required period even after a deletion request. If you disconnect a linked bank account, we remove the connection at Plaid and destroy the stored access credential; transactions already imported into your books remain part of your records until you delete them.

07Your choices and rights

You can access and correct your business data in the app at any time, and request an export of your data whenever you need one. You can disconnect a linked bank account at any time in Settings. Depending on where you live, you may have additional rights over your personal information (such as access or deletion requests) — contact us and we will honor applicable requests.

08Changes to this policy

If we make material changes, we will update this page and note the new effective date. Continued use of the service after changes take effect constitutes acceptance.

09Contact