1. Privacy Policy

CORR ("CORR," "we," "our," or "us") operates the CORR platform at corrapp.com. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data.

Who we are

CORR is a software platform operated as a sole proprietorship based in Monticello, Kentucky, United States. We operate a software-as-a-service platform for service-business owners (tattoo artists, barbers, mechanics, contractors, and similar professionals) to manage their clients, finances, scheduling, inventory, and payments.

Data controller vs. data processor

When you ("the artist" or "business owner") sign up for CORR and enter your own business data, you are the data controller for your clients' information, and CORR is the data processor acting on your instructions. When CORR collects your account information (name, email, billing data) to operate our service, CORR is the data controller. The Data Processing Addendum covering the artist → client relationship is available on request from privacy@corrapp.com.

Information we collect

We collect information you provide directly:

• Account information — name, email address, phone number, business name, password hash
• Business data you enter — clients, appointments, transactions, invoices, inventory, tax records, waitlist entries
• Payment information — billing name, last-4 of card, expiration date (full card data is held by Stripe; CORR never stores full card numbers)
• Content you upload — profile and logo images, portfolio photos, receipt images (stored in Firebase Storage)
• Google account, Gmail, and Calendar data — when you connect a Google account and authorize the relevant features (see Section 3)
• CORR AI and Operator content — your questions, saved instructions, shop rules, inquiry summaries, proposed replies, and action history
• Square access tokens — only when you connect your Square POS account, stored encrypted at rest
• Contact form and support messages — the content of any message you send us, plus your name and email address

We also collect information automatically:

• Usage data — pages visited, features used, approximate timing, HTTP status codes
• Device and log data — IP address, browser type, operating system, referral URLs (for security and abuse prevention)
• Transactional email metadata — delivery and bounce status from Resend, our email provider, so we know whether account-critical emails reached you

How we use your information

• To provide, operate, and improve the CORR platform
• To process payments and manage your subscription
• To send transactional emails (receipts, welcome messages, appointment confirmations, invoice notices)
• To generate financial summaries, tax estimates, and business reports inside the app
• To display connected email conversations and calendars, track inquiries, check artist availability, and prepare replies and appointments through the features you enable
• To respond to your support, privacy, or legal requests
• To detect, prevent, and respond to fraud, abuse, and security incidents
• To comply with our legal obligations (tax, accounting, subpoena, lawful court order)

What we don't do

2. Sub-Processors

To operate CORR we rely on the following third-party service providers ("sub-processors"). Each has its own privacy commitments and we have contractual obligations (standard contractual clauses, data-processing addenda, or the vendor's standard terms) requiring them to protect your data.

We will update this list when we add or change a sub-processor. Material changes will be announced in-app or via the email on file before the change takes effect.

3. Google, Gmail, Calendar & Operator

Your connection and choices

Connecting Google lets CORR use the Google account you select for your business inbox and scheduling. Your CORR login and connected Google account may be different. Google authorization does not give CORR your Google password. You choose the inbox label, the main business calendar, and the shared calendar assigned to each artist in Shop settings. Artist calendars must be accessible to the connected account.

Google's permissions can cover the connected mailbox and all calendars that account can access. Your choices in CORR control which inbox and calendars its features use; they do not narrow the underlying Google permission. CORR does not change calendar-sharing permissions.

What we access and why

• Account identity and email address: to identify and confirm the Google account you connected.
• Gmail: labels, conversation and message identifiers, sender and reply addresses, subjects, dates, message text, and attachment indicators. CORR displays conversations and records inquiry activity. Operator reviews conversations from your selected inbox label to summarize inquiries and prepare proposed replies. The current inbox list looks for recent conversations; opening a conversation can include older messages in that conversation.
• Email replies: when you grant sending permission, Operator can send a reply from the connected Gmail account after you approve it in CORR. The current Gmail connection does not delete messages, change labels, or mark messages as read. Operator does not download attachment files for its email review; it directs you to review those in Gmail.
• Calendar: calendar identifiers, names, time zones, access roles, and event details such as titles, descriptions, locations, start and end times, and availability. CORR displays the selected business and artist calendars, checks scheduling conflicts, and creates, updates, colors, or deletes events when you use the corresponding calendar action. Operator requires your approval to create an appointment.

Event descriptions and message text may contain customer names, contact details, booking notes, or other information included by you or the sender. Choose a business account and shared calendars appropriate for these functions.

AI processing and your instructions

When you run an Operator review, selected email conversation text and relevant lead details are sent to OpenAI's API together with your shop rules and saved directions. This produces an inquiry summary, proposed reply, or other proposal shown inside CORR. Message text can include personal information supplied by customers. Google OAuth tokens are not included in these AI prompts. Calendar availability is checked through Google; a request containing appointment information can also include that information in the AI context.

Launching Operator authorizes it to review eligible inbox conversations while it is running. Background review, where available and enabled, can continue while the page is closed. Approving Google access alone does not launch Operator or approve sending a reply. You can pause Operator, ask questions, and save or retire directions. Saved directions affect subsequent work; an instruction to send or book does not replace the current action-approval controls.

CORR uses AI responses to provide these features, not to train or fine-tune general-purpose AI models with Google data. OpenAI states that API inputs and outputs are not used for training by default. Operator requests disable optional response storage, but this does not eliminate provider security or abuse-monitoring retention. See OpenAI's API data controls.

Storage and sharing

Google access and refresh tokens are kept in encrypted server-side connection records on CORR's hosting service. The connection also stores the account identity, granted permissions, and inbox preferences. Refresh tokens let CORR renew access while the connection remains authorized; Google may still require reconnection.

Selected calendar assignments, tracked leads, message identifiers and activity, appointment references, and related business records are stored in CORR's Firebase database. Operator keeps encrypted server-side records of saved directions, recent chat, review summaries, proposed replies, job status, and activity. Email and calendar content is fetched as needed, but records or summaries created from that content can remain after you close the page or disconnect Google. CORR does not make a complete mailbox backup through Operator.

Our hosting, database, Google API, and AI providers process the data needed for the functions described here. Approved replies are delivered to their recipients through Gmail. Events written to a shared calendar are visible according to that calendar's existing Google sharing settings. CORR does not publish your inbox or private calendar data as part of this connection.

Limited use and human access

We do not sell Google data, use it for advertising or credit decisions, or transfer it to data brokers. We do not use it to build or improve general-purpose AI models. These limits also apply to information derived from Google data.

CORR personnel do not routinely read connected messages or calendar content. Human access is limited to your explicit agreement to view specific data, necessary security investigations, legal requirements, or aggregated and anonymized internal analysis allowed by Google's policy. Transfers beyond the providers and recipients described above are limited to necessary security or legal purposes, or a business transfer with your prior consent, consistent with Google's Limited Use requirements.

Pause, disconnect, revoke, or delete

Pause Operator to stop new automated reviews. Pausing does not disconnect Google or erase saved records. Retiring a direction stops it from being applied; it does not erase its history or undo rule changes already saved.

Disconnect through the Google connection controls in Shop settings to stop that connection's use in CORR. If an older, separate Client connection is also present, disconnecting Operator does not necessarily revoke that separate connection. To remove CORR's Google authorization at the account level, open your Google Account's third-party connections, select CORR, and remove its access. Revocation stops future access; it does not delete messages or events already stored in Google.

Delete saved CORR data using available record controls or by emailing privacy@corrapp.com with a request to delete your Google connection records, imported lead information, and/or Operator history. Disconnecting Google, pausing Operator, or dismissing a proposal is not a request to erase those records. See Section 5 for retention and deletion.

4. Your Rights (GDPR / CCPA / CPRA)

Depending on where you live, you may have the following rights over your personal data:

GDPR (EU / EEA / UK residents)

• Access — ask for a copy of the personal data we hold about you (Article 15)
• Rectification — correct inaccurate data (Article 16)
• Erasure — request deletion of your data, subject to our legal retention obligations (Article 17)
• Restriction — ask us to pause processing while a dispute is being resolved (Article 18)
• Portability — receive your data in a machine-readable format (Article 20)
• Objection — object to processing based on legitimate interest (Article 21)
• Withdraw consent — where processing is consent-based, withdraw at any time
• Lodge a complaint — with your local supervisory authority

CCPA / CPRA (California residents)

• Right to know what personal information we collect and how we use it
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing — CORR does not sell personal information and does not share personal information for cross-context behavioral advertising, so there is nothing to opt out of
• Right to limit use of sensitive personal information
• Right of non-discrimination for exercising any of these rights

How to exercise your rights

Email privacy@corrapp.com from the email address on file with your CORR account, or send a signed letter to the address in Section 11. We will verify your identity, respond within 30 days (GDPR) or 45 days (CCPA), and act on the request unless a legal exception applies. If we deny your request we will explain why.

You may also use an authorized agent to submit a request on your behalf. We will require written proof of authorization.

5. Data Retention & Deletion

Active accounts

While your account is active, we retain your business data (clients, transactions, appointments, invoices, inventory, tax records, settings) indefinitely so your records remain accessible. Use the available in-app controls to remove records, or contact privacy@corrapp.com for records without a deletion control.

Account cancellation

• When you cancel your subscription, your account access is suspended at the end of your paid period
• Your data is retained for 30 days after account suspension so you can reinstate if you change your mind
• After 30 days your data is permanently deleted from our Firebase project
• Backups that contain your data roll off within 90 days
• Stripe subscription records may be retained by Stripe per their own policies and applicable financial-records law

Legal holds

If we are required by a subpoena, court order, or active investigation to retain specific records, we will do so for the minimum period required even if you have asked for deletion. We will notify you unless legally prohibited.

Data export

You can export your data to CSV from the admin panel inside CORR at any time. For a complete portable export beyond the in-app option, email privacy@corrapp.com. We will provide the export within 7 business days.

Google connections and Operator records

Google connection credentials are retained to maintain the connection until it is disconnected or removed. Account-level revocation in Google prevents further API access but does not itself erase CORR's saved copies of business records. A separate Client connection, if present, must also be disconnected or revoked.

Imported lead details, message activity, appointment references, Operator proposals, and saved directions are retained for your ongoing business workflow and action history. These records do not automatically expire when a browser session ends or Google is disconnected. Recent chat and activity lists have size limits; removing an item from a displayed list is not a guarantee that related records have been erased.

For removal of server-side Operator history or Google-derived records that cannot be deleted in the interface, email privacy@corrapp.com. We verify the request and remove the applicable records, subject to required legal retention. State whether you want to disconnect, erase saved data, or both. Deleting CORR records does not delete the original Gmail messages or Google Calendar events. AI-provider security logs are governed by the provider's retention terms linked in Section 3.

6. Cookies & Tracking

CORR uses a minimal set of cookies and similar technologies:

• Strictly necessary — Firebase Authentication session tokens; without these you cannot log in
• Functional — remembering your selected app tab, theme preference, and dismissed tips (stored in localStorage, not a true cookie)
• Security — Stripe checkout writes cookies that help prevent fraud during payment

We do not use advertising cookies, cross-site trackers, or analytics cookies that profile you individually. If EU or California regulations require an explicit cookie-consent banner when you visit corrapp.com, we will display one at first visit and respect your choice.

Do Not Track

We honor Global Privacy Control (GPC) signals where feasible. Because we do not engage in cross-context behavioral advertising, there is no tracking to disable.

7. Payments & Subscriptions

Detailed subscription, billing, auto-renewal, cancellation, and refund terms are in the Terms of Service. The short version:

• All card payments are processed by Stripe. CORR never stores your full card number.
• Subscriptions renew automatically at the price and frequency shown at checkout until you cancel.
• You can cancel any time from the Manage Plan page inside CORR; cancellation takes effect at the end of the current billing period.
• Refund policy is explained in the Terms of Service.

For billing questions email billing@corrapp.com.

8. Communications Policy

Transactional email

Account-critical emails are sent via Resend. They include purchase receipts, welcome emails on signup, appointment confirmations, invoice notices, and similar operational messages. These cannot be turned off while you have an active account, because they are required to operate the service you paid for.

Connected Gmail replies

Replies you approve through Operator are sent through your connected Gmail account to the relevant conversation recipient. CORR records their status and identifiers to track the inquiry and prevent duplicate actions. This is separate from CORR's account and billing emails.

Marketing email

If we ever send product announcements or newsletters, every message will identify CORR as the sender, include our physical mailing address, and contain a one-click unsubscribe link as required by the U.S. CAN-SPAM Act. You can opt out of marketing email without affecting transactional email.

Native SMS ("tap-to-text")

CORR no longer operates an automated SMS reminder service. Where phone numbers are stored in your client records, the app offers a "tap to text" link that opens your device's native messaging app with the message pre-filled — your carrier sends the text, not CORR. Standard carrier rates apply.

Client consent (your responsibility as the artist)

9. Children's Privacy

CORR is a business-tools product intended for use by adults (18+). We do not knowingly collect personal information from children under 13 (COPPA) or 16 (GDPR). If you believe a minor has provided us with personal information, contact privacy@corrapp.com and we will delete it promptly.

Some CORR features (self-booking pages, waivers, client intake forms) may collect information about your clients. It is your responsibility as the CORR account holder to ensure you are not collecting data about minors without proper parental/guardian consent.

10. Security & Breach Notification

How we protect your data

• HTTPS everywhere — TLS encryption on all corrapp.com traffic
• Firebase security rules that scope every read/write to the account owner's UID
• OAuth tokens (Google, Square) stored server-side, never in browser storage
• API keys and third-party credentials stored in a server directory outside the web-accessible path
• Role-separated administrative email addresses for incident response (security@corrapp.com)

If a breach occurs

If we confirm a data breach that affects your personal information, we will notify you without undue delay — and no later than 72 hours after discovery where GDPR applies — at the email address on file. Notifications will describe the nature of the incident, the categories of data affected, steps we have taken, and recommended steps for you.

Report a suspected vulnerability to security@corrapp.com.

11. Contact

Use the address that matches your question — it routes faster:

We may update this Privacy Policy from time to time. Material changes will be announced in-app or via email at least 14 days before they take effect. Continued use of CORR after the effective date constitutes acceptance of the updated policy.