Privacy Policy

The short version

This website is a static site. It runs no advertising trackers, sets no marketing cookies, and sells no data. The technology assessment processes your answers in your browser while you work through it, and nothing is transmitted to us until you press "Send to BSTS." When you press it, what you submitted is sent over an encrypted connection to a third-party form-delivery service, which forwards it to us.

Separately, BSTS builds and operates VaultIQ, client-vault software used by advisory firms, and the ActionCOACH Prospecting Engine, business-development software used by ActionCOACH Peachtree. Each can connect to a user's own Google account when that user chooses to. The section Google Workspace and Google API Data below states exactly what each requests, why, and what each never does with it.

Information we collect through this site

Assessment form. The multi-step technology assessment runs in your browser. Your answers are processed on your device as you work through the questions, and nothing is transmitted anywhere until you press "Send to BSTS."

When you press "Send to BSTS," the information you submitted is transmitted over HTTPS to Web3Forms, a third-party form-delivery service, which forwards the inquiry to us. That submission can include your name, email address, organization, your assessment responses, and anything you add in the optional note. We use it to respond to your inquiry. We do not add you to marketing lists without your consent.

Copying your summary or downloading it as a file stays entirely on your own device — the text is created locally in your browser and nothing is transmitted when you use those buttons.

Email you send us. If you email us, we receive what you send, and we use it to respond to you. We do not add you to marketing lists without your consent.

Hosting logs. Our hosting provider (Cloudflare Pages) may record standard technical request data — IP address, user-agent, requested URL — for security and operational purposes under its own policies. We do not enrich, resell, or use this data for advertising.

Cookies and local storage

We do not set advertising or analytics cookies, and we do not track you across sessions.

Sharing

We do not sell, rent, or trade personal information. We disclose information only if required by law, or to the service providers that make this site work — our hosting provider (Cloudflare Pages) and Web3Forms, which delivers assessment submissions to our inbox. Both act under their own published protections.

Google Workspace and Google API Data

This section applies to two pieces of software that BSTS builds and operates: VaultIQ, and the ActionCOACH Prospecting Engine. It does not describe the BSTS website, which requests no Google permissions of any kind.

Both use the same Google sign-in application, so Google's consent screen shows the name "VaultIQ" for each. Each has its own sign-in client and asks only for the permissions listed for it below. Connecting a Google account is always optional, and each person connects only their own account.

VaultIQ

What it requests. VaultIQ asks for one Google permission, and only when a coach chooses to connect:

• https://www.googleapis.com/auth/calendar.events.readonly — to read events on the connecting coach's own calendar, so VaultIQ can find the next session with a client.

VaultIQ never creates, changes, or deletes calendar events. It does not request access to Gmail, Google Drive, Google Contacts, Google Chat, or any other Google service, and it reads only the calendar of the person who connects.

How it uses the data. What VaultIQ reads from a coach's calendar is shown only to that coach, live, and is not saved. The Connections page lists the coach's own upcoming events, and the coach's own preparation view for a client can show a private note — labelled as visible only to them — with the date of the next event on their calendar that plainly belongs to that client (by its title, a name on the client's profile, or an invited address on that profile). Calendar events, including their titles, attendees, and descriptions, are not copied into VaultIQ's database.

Shared records do not use calendar data. Session agendas, weekly action sheets, and VaultIQ's audit trail use only the next-session date kept on the client's record, never a coach's calendar, so they show no coach's calendar information to other advisors or to the client.

Records from before 7 October 2026. An earlier version of VaultIQ, in use from 29 September to 7 October 2026, copied the date and time of a coach's next calendar event — the date and time only, never an event's title, attendees, or description — into some shared records: session agendas, weekly action sheets, and the audit entries for those sheets. Until 7 October, other advisors working with the same client could see those dates, and a weekly action sheet containing one could be shown to the client. On 7 October 2026 we removed those dates from the affected agendas and restricted the remaining records without altering them: those weekly action sheets can now be opened only by the coach whose calendar the date came from, and those audit entries by no user of the app. A copy of the original agenda entries is kept for recovery in storage that only BSTS's database administrators can access, and our database provider's backups contain the original records until those backups expire.

How it stores and protects the connection.

• Google authorization tokens are encrypted with AES-256-GCM before they are written to storage. They are never stored in plain text and never written to logs.
• Each stored authorization is readable only by the account that created it. That restriction is enforced by row-level security in the database, not by application code alone.
• Records are held in a managed PostgreSQL database operated by Supabase, with encryption in transit and at rest under that provider's published protections.
• BSTS keeps backups of VaultIQ's database. They include the encrypted authorizations.

Disconnecting. A coach can disconnect at any time from VaultIQ's Connections page, or from the Google Account permissions page at myaccount.google.com/permissions. When a coach disconnects in VaultIQ, VaultIQ asks Google to revoke the authorization and marks its stored copy revoked so VaultIQ can never use it again. The encrypted copy is kept, together with an audit-trail entry recording when the connection was made (with the permissions granted) and when it was revoked.

ActionCOACH Prospecting Engine

The Prospecting Engine is business-development software that BSTS builds and operates for ActionCOACH Peachtree.

What it requests. The Prospecting Engine asks for these Google permissions only, and only when a team member chooses to connect their own Google account:

• https://www.googleapis.com/auth/gmail.send — to send an email the team member has written and reviewed, from their own Gmail account, when they press Send.
• https://www.googleapis.com/auth/calendar.events — to create an appointment the team member sets up on their own calendar, and to invite the attendees they choose.
• openid and email — to show which Google account is connected.

What it never does. It does not read, search, list, modify, or delete email. It does not read, list, or change existing calendar events. It does not access Google Drive, Google Contacts, or any other Google service.

What it stores. For each connected team member, it stores the Google account's email address, the permissions that were granted, and the authorization tokens Google issues, so it can send or schedule on that member's behalf. That email address is kept with the member's own connection and shown only to them; records the rest of the team can see name the team member, not their Google address. Before 7 October 2026, the Prospecting Engine also wrote the connected Google address onto email and appointment records the rest of the team could see. On 7 October 2026 we replaced it on those records with the team member's name; a recovery copy of the original records is kept in storage that only BSTS's database administrators can access, and our database provider's backups contain the originals until they expire. Those tokens are held in its database, which is operated by Supabase with encryption at rest under that provider's published protections; the Prospecting Engine does not add its own encryption to them. Row-level security limits each signed-in team member to their own connection, and the server and BSTS's database administrators can also access it to operate the service.

For each email sent, it keeps a record of the recipient, subject, send time, the name of the team member who sent it in the Prospecting Engine, and Google's message identifiers. The recipient is recorded just before the email is handed to Google, so a failed attempt is recorded too. It does not keep the message body on its servers. If a team member has to reconnect Google while writing an email, the unsent draft is kept in that browser tab's temporary storage so it is not lost. It is cleared the next time the page loads or when the tab is closed, it is offered back only within 30 minutes, and it is not sent to our servers. For each appointment, it keeps the title, time, time zone, attendees, the name of the team member who created it, and Google's event identifiers and link. These records form part of the business's activity history, are visible to the team members who use the Prospecting Engine for that business, and are kept after a team member disconnects.

Disconnecting. A team member can disconnect at any time from the app's header. Disconnecting deletes the stored authorization from the Prospecting Engine's database. It does not withdraw the permission on Google's side; to do that, remove the app at myaccount.google.com/permissions. The stored authorization is also deleted automatically if Google reports it is no longer valid. Records of emails already sent and appointments already created stay in the activity history.

Deletion requests

A request to delete Google-derived data held by either product can be sent to us using the contact details on the contact page.

Artificial intelligence

Google user data is not used to develop, improve, or train generalized artificial-intelligence or machine-learning models. Neither product sends Google user data to any artificial-intelligence provider. The Prospecting Engine's research feature sends an artificial-intelligence provider details about the business being researched and the reason a team member gave for the request, never email or calendar records. VaultIQ does not put calendar data into any document, and its AI-assisted chat and drafting do not use agendas or weekly action sheets as input. The calendar-derived dates that an earlier version copied into weekly action sheets were never sent to an artificial-intelligence provider: weekly action sheets have always been written by VaultIQ's own built-in drafter, which makes no outside call.

Limited Use

VaultIQ's and the ActionCOACH Prospecting Engine's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve the user-facing features described above, which are prominent in each product's interface.
• We do not transfer Google user data to others except: as necessary to provide or improve those user-facing features, and only with the user's consent; for security purposes, such as investigating abuse; to comply with applicable law; or as part of a merger, acquisition, or sale of assets, and only after obtaining the user's explicit prior consent.
• We do not use, transfer, or sell Google user data for serving ads, including retargeting, personalized, or interest-based advertising; we do not transfer or sell it to advertising platforms, data brokers, or information resellers; and we do not use it to determine credit-worthiness or for lending purposes.
• We do not allow humans to read Google user data unless: the user has given affirmative agreement for specific data to be viewed by specific people, for example by confirming that a particular item may be shown to the people the product names before it is shared; it is necessary for security purposes, such as investigating a bug or abuse; it is necessary to comply with applicable law; or the data, including anything derived from it, is aggregated and used for internal operations in accordance with applicable privacy and other legal requirements.
• We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.

Your choices

• You can use every page of this site without submitting any personal information.
• You can request deletion of any correspondence you have sent us by emailing us.
• You can review your assessment answers before anything is submitted — nothing is sent silently.

Changes

If our practices change — for example, if we add privacy-respecting analytics — this policy will be updated before the change takes effect, with a new effective date.

Contact

Questions about this policy can be sent through the contact page or to the email address published there.