AuditBurst is operated by Jake Saliani. This notice explains how we handle information when you use AuditBurst to organize subcontractor records, insurance documents, and audit work.
Account information and optional Google sign-in
Clerk provides account creation, sign-in, and session management. You can use email and password; Google sign-in is optional.
If you choose Google, we request only the openid, email, and profile permissions. Google may provide your name, email address and verification status, Google account identifier, and profile photo if available. Clerk processes this information to authenticate you and maintain your account. AuditBurst uses account identity and company membership information to give you access to the correct workspace.
Google sign-in does not give AuditBurst access to Gmail messages, Google Drive files, contacts, or calendars. We do not request those permissions.
Workspace records
We store information you add to your company workspace, including company and subcontractor details, certificates of insurance, W-9s, policies, audit correspondence, review notes, and related records. These records and files are stored privately using Cloudflare services and are made available according to workspace membership and permissions. Authorized people in your company may view and manage the company’s records.
Services that process information
We use Cloudflare to host AuditBurst and store workspace data, and Clerk to manage identity and account sessions. Stripe processes paid subscriptions, payment details, and invoices. AuditBurst stores billing identifiers and subscription status; full payment card details are handled by Stripe.
When you explicitly request an AI document review, the document or documents you select are sent to OpenAI to generate suggested information. Uploading a document alone does not request an AI review. Review the suggestions against the source before saving or relying on them.
Information is shared with these providers as needed for the features you use. We may also process information to troubleshoot problems, protect accounts, respond to support requests, and meet applicable legal obligations. Sign-in cookies and similar session storage keep you authenticated.
Optional bank and QuickBooks connections
When these integrations are available, connecting or renewing access requires an explicit consent notice for your company. Plaid handles bank authorization and Intuit handles QuickBooks authorization. We retain the version and text of the notice, the accepting user and company, and the time and connection attempt so that we can document what was authorized.
AuditBurst requests Plaid Transactions for selected US checking accounts. Initial history may include up to 730 days when available. Imported information includes incoming and outgoing transaction dates, amounts, currency, descriptions, check numbers, pending or removed status, provider identifiers, account display names, and masked last four digits. This can reveal sensitive financial activity even though the connection does not move money.
AuditBurst does not request Plaid Auth, Transfer, Identity, or processor tokens. It does not store bank login credentials, full account-number or routing-number fields, or account balances. Some account responses can contain balances that are discarded instead of saved. Known labelled sensitive identifiers in freeform payment text are redacted before storage; this cannot identify every possible sensitive detail in unlabelled source text. Original financial CSV files you choose to upload are stored privately and may contain additional fields from your export.
The QuickBooks connection reads bank-account names and identifiers and bank-funded Purchase and BillPayment evidence, including dates, amounts, currency, payee labels and identifiers, references, linked bill identifiers, and void status. Intuit’s accounting OAuth permission is broader than read-only. AuditBurst enforces a restricted request policy within the application and does not create, change, or delete QuickBooks entries or pay bills.
We use these records to compare company payments with subcontractor records and prepare evidence you review. Plaid or Intuit processes the connection you choose, and Cloudflare hosts the application and its private storage. Authorization tokens are encrypted on the server. These connections do not send financial feeds or provider tokens to an AI model. An authorized user can separately download an audit packet or payment export and choose whom to share it with.
Company owners and administrators can disconnect provider access from Connections, including after paid workspace access ends. A confirmed disconnect revokes authorization and stops future synchronization while retaining imported evidence and review history. If revocation cannot be confirmed, the app shows a pending or uncertain result and does not claim that access was removed.
Deleting imported financial data
The company owner can use Manage imported financial data in Connections or the Payment inbox to preview and confirm permanent deletion. The preview identifies the company and the records affected. Deletion revokes both provider connections and removes imported bank and QuickBooks records, original financial CSVs, account matching and review details, linked work/payment entries and their revisions, related activity and previews, and identified stored backups containing those records.
Linked work/payment entries are removed in full, including manually added job details or notes on those entries. Independent manual work records, subcontractors, certificates, W-9s, and company policies are kept. Where saved email reminder bodies cannot be traced to individual payments, the preview explains the affected email bodies and queued messages before confirmation. Recipient consent, preferences, and delivery-status metadata are retained.
Financial imports, edits, and exports pause while deletion is pending. Provider or storage failures leave the request pending for a safe retry; they do not produce a completed-deletion receipt. We retain minimal consent and deletion evidence without the deleted transaction details to honor revocation and prevent old data from being restored or recreated.
Cloudflare database recovery history can retain earlier database versions for up to 30 days. An independent deletion marker blocks financial access if a restored database is inconsistent with the deletion record, until the deletion is reconciled. Completion means the required provider revocations and deletion of the application’s active managed copies have been verified; it does not mean immediate physical erasure of every provider backup.
Files you downloaded, information copied elsewhere, and reminders already delivered outside AuditBurst cannot be recalled. This control does not delete transactions held by your bank or accounting records in QuickBooks. For information retained by Plaid, you can also use Plaid’s privacy request form. Contact us if you need assistance with a deletion or a request that extends beyond the company’s imported financial data.
Optional email and text reminders
When reminder delivery is available, an authorized company owner or administrator can separately enroll their own verified account email or verify and consent to their own phone number. Preview contacts and imported subcontractor contacts are not automatically enrolled. You choose reminder categories, and company settings control the sending window and quiet hours.
Resend processes reminder email addresses and email content. Twilio processes phone numbers, verification texts, reminder texts, and delivery or opt-out responses. AuditBurst records consent, verification status, delivery identifiers and outcomes, and opt-out status so that it can deliver requested reminders and honor your choices. Reminder texts contain a short summary and a sign-in link rather than private insurance or banking details.
You can disable an enrolled destination in Reminder delivery, use an email reminder’s unsubscribe link, or reply STOP to stop texts. Reply HELP for assistance. Message and data rates may apply; enrollment is optional. Disabling reminders does not delete company audit records or prior delivery history.
Limited use of Google information
AuditBurst’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google information is used for the account and sign-in features described here, with sharing limited to providing those features, security, or legal requirements.
If you separately enroll your verified account email for reminders, that address is also used to deliver the messages you request, as described above.
We do not sell Google user data, use it for advertising or ad targeting, or use it to train general-purpose AI models. Google account information is not sent to OpenAI as part of the sign-in process.
Retention and your choices
Workspace records are retained to support your company’s ongoing work and record history. Archiving a subcontractor or other record keeps its documents and history; archiving is not deletion.
The company owner reviews the ongoing need for retained audit evidence at least every 365 days. New bank/QuickBooks connections, synchronization, and financial CSV imports pause until a current review is recorded. The review does not prevent access to existing records, exports, disconnect, or deletion. It does not create a legal requirement to keep records.
For completed, failed, canceled, or blocked reminders with no unresolved send, message content is cleared after 30 days. The submitted routing envelope and provider delivery identifier remain so that a valid late complaint, bounce, or opt-out can still be honored. Detailed provider status and error diagnostics are cleared after 365 days; minimal delivery outcomes and duplicate-prevention identifiers remain with the enrolled service. Expired verification challenges and settled, non-recoverable connection attempts are removed after 30 days; unused deletion previews after one day. Unresolved sends, authorization-removal recovery, and necessary suppression records are handled separately rather than reported as deleted.
Retention checks run daily, in bounded batches if a backlog needs more than one pass. Sanitized cleanup records are retained for 365 days, and superseded owner retention reviews for three years. Current authorization/consent proof and minimal deletion markers are retained while needed to demonstrate authorized use, honor withdrawal, and prevent erased data from being restored. Provider billing records and copies you downloaded follow their separate purpose and deletion process.
To request access, correction, or deletion of your information, email jake@carolinawaterdamage.com. We verify your identity and, when relevant, your authority to act for a company before making changes. Imported financial data follows the deletion process above; we do not retain deleted financial records merely because they might be useful for a future audit. Where retention of particular information is required by applicable law, we will explain the information, reason, and applicable limit. Separate billing records and minimal consent, security, and deletion evidence may remain for those purposes.
You can revoke Google access through your Google Account’s third-party connections settings. Revoking Google access does not automatically delete your AuditBurst account or company workspace. Contact us for deletion or help keeping an alternative sign-in method available.
Questions and updates
For privacy questions, contact Jake Saliani at jake@carolinawaterdamage.com. We will update this page when our practices change and provide additional notice or request consent when required before using Google information for a new purpose.