Maestro Privacy Policy
Effective date: October 8, 2026
The short version
- We collect your account details, the business and financial data you enter or sync from QuickBooks, your Ask Maestro questions, and basic technical data.
- We use it only to run Maestro for you, including calculating your score, generating insights, and sending your weekly brief. We don't sell it or use it for ads.
- Ask Maestro sends your question and relevant company facts to an AI provider. We use API terms under which that data isn't used to train their models.
- QuickBooks is optional and read-only. Disconnect at any time, and we delete the access tokens.
- You can ask to see, export, correct, or delete your data by emailing adrian@adderley.co.
1. Who we are
Adderley.co ("we", "us", "our") runs Maestro, a web app at https://maestro-two-nu.vercel.app that helps small-business owners assess their financial health. This policy explains what personal information we collect, how we use and share it, and the choices you have. It applies alongside our Terms of Service.
Contact: adrian@adderley.co.
2. What we collect
a. Account information (from you)
- Email address and password. Passwords are handled by our authentication provider (Supabase) and stored in hashed form, never in plain text.
- Account settings, such as notification and email digest preferences.
b. Business and financial information (from you)
- Business name, industry, stage, and revenue range.
- Revenue, expenses, cash balance, gross margin, and average monthly cash flow.
- Employee NPS (eNPS) and customer NPS (cNPS) scores. These are aggregate scores, and we don't ask for individual survey responses.
c. QuickBooks Online data (only if you connect it)
- With your authorization through Intuit's OAuth sign-in, we get read access to accounting data from your QuickBooks Online company, such as revenue, expenses, and cash, and the company identifier needed to sync it.
- OAuth access and refresh tokens that let us sync your data. We never receive your Intuit password.
d. Ask Maestro and in-app content (from you and generated for you)
- The questions you ask, the AI-generated answers, and your ask history.
- Your Business Health Score and pillar scores, benchmark comparisons, scenarios, saved insights, weekly briefs, and notifications.
e. Usage and technical data (collected automatically)
- IP address, browser and device type, pages and features used, timestamps, and error and security logs. Our hosting and database providers collect these as part of running the Service.
- Authentication cookies or local storage that keep you signed in (see Section 10).
f. Communications
- Messages you send us, such as support requests, feedback, and privacy requests.
We don't ask for Social Security numbers, bank or card numbers, or health information. Please don't enter them.
3. How we use it
We use your information to:
- provide Maestro: create and secure your account, calculate your Business Health Score, compare it with benchmarks, run scenarios, generate Ask Maestro answers, and produce your weekly brief, notifications, and saved items;
- sync QuickBooks, if you connect it, to fill in and update your metrics;
- communicate: send service emails (verification, password reset, security, and policy changes) and, if you opt in, the weekly email digest;
- support you and respond to requests;
- keep Maestro safe: prevent fraud and abuse, debug, and monitor performance and security;
- improve Maestro using aggregated, de-identified usage information, such as which features are used and where errors happen. This doesn't include QuickBooks data; and
- follow the law: meet legal obligations, enforce our Terms, and protect rights and safety.
What we don't do:
- We don't sell your personal information or business data.
- We don't "share" it for cross-context behavioral advertising, and we don't show ads.
- We don't add your data to the case study library that informs Ask Maestro, and we don't show your data to other users.
- Your score is not used to make decisions about you that have legal or similarly significant effects, such as credit, employment, or insurance decisions.
4. How Ask Maestro uses AI
- When you use Ask Maestro, we send your question and the company facts relevant to it to a third-party large language model (LLM) provider so it can generate an answer. Those facts can include your business profile, metrics (including any synced from QuickBooks), and scores. Today that provider is OpenAI. We may add or switch to xAI later and will update this policy before we do.
- Answers are grounded in an internal library of case studies. Your data is used to tailor the answer to you, not to build that library.
- Training: we use these providers through their business API services. Under those providers' current API terms, data sent through the API isn't used to train or improve their models unless the customer opts in, and we haven't opted in. The providers may keep prompts and outputs for a limited time (currently up to 30 days by default) to monitor for abuse, and then delete them, unless the law requires them to keep the data longer.
- AI output can be wrong. See Section 4 of our Terms.
5. QuickBooks data: use, storage, and deletion
This section explains how we handle data from Intuit's QuickBooks Online.
- Access: read-only access to accounting data needed to calculate your metrics. We don't write to or change your QuickBooks company.
- Use: we use QuickBooks data only to provide Maestro to you, which includes calculating your metrics and score, generating your insights, scenarios, and weekly brief, and answering your Ask Maestro questions.
- No selling or unrelated use: we never sell, rent, or trade QuickBooks data. We don't use it for advertising, don't show it to other users, don't use it to build benchmarks or datasets for anyone else, and don't use it to train AI models.
- Sharing: QuickBooks data is shared only with the service providers that help us deliver Maestro to you: our hosting provider, our database provider, and, when you use Ask Maestro, our LLM provider. All of them operate under contractual restrictions.
- Storage and security: QuickBooks data and tokens are stored in our database hosted by Supabase in the United States (AWS us-east-1). Data is encrypted in transit and at rest, OAuth tokens are encrypted, and access is limited to authorized personnel who need it.
- Disconnecting: you can disconnect at any time in Maestro or in your Intuit account's connected-apps settings. When you disconnect, we stop syncing, revoke and delete the access and refresh tokens, and delete the raw QuickBooks records we stored within 30 days. Metrics that already flowed into your Maestro profile, such as revenue for a past month, stay in your account so your score history keeps working, until you edit them, ask us to delete them, or delete your account.
- Account deletion: if you delete your Maestro account, we delete all QuickBooks-sourced data along with the rest of your data (see Section 8).
6. Who we share it with
We share personal information only with the service providers ("subprocessors") we need to run Maestro, when the law requires it, or with your direction.
| Provider | What they do | Data involved |
|---|---|---|
| Supabase | Database, authentication, storage (US, AWS us-east-1) | All account, business, QuickBooks, and in-app data |
| Vercel | Web hosting and serverless functions | Request data, logs, and data in transit to and from the app |
| OpenAI (and, in future, xAI) | LLM processing for Ask Maestro | Your question and relevant company facts |
| Intuit | QuickBooks Online connection (only if you connect) | OAuth authorization and the data you choose to sync |
| Resend | Sending service emails and the optional weekly digest | Email address, name or business name, and digest content |
These providers may process data only to provide services to us, under contracts and terms that limit their use of it. We may also disclose information:
- to follow the law, for example in response to a valid subpoena or court order, or to protect rights, safety, and security;
- in a business transfer, such as a merger, acquisition, or sale of assets. The recipient must honor this policy for data it receives; and
- with your consent or at your direction.
7. Security
We use reasonable administrative, technical, and physical safeguards for financial data. These include encryption in transit (HTTPS/TLS) and at rest, hashed passwords, encrypted OAuth tokens, per-user access controls in our database, secrets kept out of our code, and access limited to people who need it. No system is perfectly secure. Use a strong, unique password, and tell us right away at adrian@adderley.co if you suspect a problem. If a breach affects your personal information, we will notify you and regulators as the law requires.
8. How long we keep data
| Data | How long |
|---|---|
| Account, business, and in-app data (scores, scenarios, insights, ask history) | While your account is open. Deleted from active systems within 30 days of account deletion |
| QuickBooks tokens | Until you disconnect or delete your account, then deleted promptly |
| Raw QuickBooks records | While connected. Deleted within 30 days of disconnecting or deleting your account |
| Usage, security, and error logs | Kept for short periods set by our providers, generally up to 90 days unless needed to investigate abuse |
| AI provider copies of prompts and outputs | Up to 30 days under the providers' abuse-monitoring policies |
| Backups | Overwritten on a rolling schedule, generally within 30 days |
| Records we must keep by law, or to resolve disputes | As long as legally required |
9. Your choices and rights
Everyone, wherever they live, can:
- see and edit most of their data in the app;
- export a copy of their data in a common machine-readable format by emailing adrian@adderley.co;
- delete their account and data by emailing adrian@adderley.co or using account deletion in the app, if it is available;
- disconnect QuickBooks at any time; and
- turn off the weekly email digest in settings or with the unsubscribe link.
How to make a request: email adrian@adderley.co from your account email address. To protect your data, we will verify your identity, usually by confirming control of your account email. We respond within 45 days. If we need more time, we will tell you, as the law allows. You may use an authorized agent. We may ask for proof of the agent's authority and verify your identity directly. We won't discriminate against you for exercising your rights.
California residents (CCPA/CPRA)
If you live in California, you have the right to:
- know what personal information we collect, use, and disclose, including the specific pieces;
- delete personal information we collected from you, subject to legal exceptions;
- correct inaccurate personal information;
- opt out of the sale or sharing of personal information. We don't sell or share personal information, and we haven't done so in the past 12 months;
- limit the use of sensitive personal information. The only sensitive personal information we collect is your account login (email and password). We use it only to authenticate you and secure your account, so this right doesn't come into play; and
- non-discrimination for exercising these rights.
Categories we collected in the past 12 months:
| CCPA category | Examples | Source | Business purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Email, IP address, account ID | You, your device | Accounts, security, communications | Supabase, Vercel, email provider |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name or business name, email | You | Accounts, communications | Supabase, email provider |
| Commercial information | Business name, industry, stage, revenue range, revenue, expenses, cash, margin, cash flow, QuickBooks accounting data | You, Intuit (if connected) | Providing Maestro, scoring, insights | Supabase, Vercel, LLM provider |
| Internet or network activity | Pages and features used, logs | Your device | Security, debugging, improvement | Supabase, Vercel |
| Inferences | Business Health Score, pillar scores, AI insights | Generated by Maestro | Providing Maestro | Supabase, LLM provider |
| Sensitive personal information | Account login (email and password) | You | Authentication only | Supabase |
We retain each category as described in Section 8. We don't knowingly sell or share the personal information of consumers under 16. We honor Global Privacy Control signals as an opt-out request where applicable.
Other U.S. states
Residents of states with comprehensive privacy laws (for example Colorado, Connecticut, Virginia, Texas, Oregon, and others) may have similar rights to access, correct, delete, and port their data and to opt out of targeted advertising, sales, and certain profiling. We don't engage in targeted advertising, sales, or profiling with legal or similarly significant effects. To make a request, email adrian@adderley.co. If we deny your request, you can appeal by replying to our decision with "Appeal" in the subject line. We will respond within the time the law requires. If you're unhappy with the appeal result, you can contact your state attorney general.
10. Cookies and similar technology
We use only essential cookies and browser storage. They keep you signed in, protect your session, and remember basic preferences. We don't use advertising cookies or cross-site tracking. If we add analytics or other non-essential cookies, we will update this section first and offer choices where the law requires them.
Browser "Do Not Track" signals have no common standard, so we don't respond to them separately. However, we don't track you across other sites.
11. Children
Maestro is for adults running businesses. It is not for anyone under 18, and we don't knowingly collect personal information from anyone under 18, including children under 13. If you believe a minor has given us personal information, contact adrian@adderley.co and we will delete it.
12. Users outside the U.S. (GDPR and UK GDPR)
Maestro is designed for U.S. businesses. If you use it from the European Economic Area (EEA), the United Kingdom, or Switzerland:
- Controller: Adderley.co controls your personal data.
- Legal bases: we process your data to perform our contract with you (providing Maestro, including QuickBooks syncing and Ask Maestro); for our legitimate interests in securing and improving Maestro, in ways that don't override your rights; with your consent (the optional weekly email digest and connecting QuickBooks, which you can withdraw at any time); and to meet legal obligations.
- Your rights: you can access, correct, delete, restrict, or object to processing of your data, and you can ask for a portable copy. You can withdraw consent at any time, and you can complain to your local data protection authority (in the UK, the ICO). Use the contact details in Section 9 to make a request.
- International transfers: your data is stored and processed in the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.
13. Changes to this policy
We may update this policy as Maestro changes, for example when adding an AI provider or email provider. If the changes are material, we will tell you by email or in the app before they take effect. The "Effective date" at the top shows the latest version.
14. Contact
Questions or requests:
Adderley.co
Email: adrian@adderley.co