1. Privacy Policy

CORR ("CORR," "we," "our," or "us") operates the CORR platform at corrapp.com. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your data.

Who we are

CORR is a software platform operated as a sole proprietorship based in Monticello, Kentucky, United States. We operate a software-as-a-service platform for service-business owners (tattoo artists, barbers, mechanics, contractors, and similar professionals) to manage their clients, finances, scheduling, inventory, and payments.

Data controller vs. data processor

When you ("the artist" or "business owner") sign up for CORR and enter your own business data, you are the data controller for your clients' information, and CORR is the data processor acting on your instructions. When CORR collects your account information (name, email, billing data) to operate our service, CORR is the data controller. The Data Processing Addendum covering the artist → client relationship is available on request from privacy@corrapp.com.

Information we collect

We collect information you provide directly:

• Account information — name, email address, phone number, business name, password hash
• Business data you enter — clients, appointments, transactions, invoices, inventory, tax records, waitlist entries
• Payment information — billing name, last-4 of card, expiration date (full card data is held by Stripe; CORR never stores full card numbers)
• Content you upload — profile and logo images, portfolio photos, receipt images (stored in Firebase Storage)
• Google Calendar data — only when you explicitly connect your Google account (see Section 3)
• Square access tokens — only when you connect your Square POS account, stored encrypted at rest
• Contact form and support messages — the content of any message you send us, plus your name and email address

We also collect information automatically:

• Usage data — pages visited, features used, approximate timing, HTTP status codes
• Device and log data — IP address, browser type, operating system, referral URLs (for security and abuse prevention)
• Transactional email metadata — delivery and bounce status from Resend, our email provider, so we know whether account-critical emails reached you

How we use your information

• To provide, operate, and improve the CORR platform
• To process payments and manage your subscription
• To send transactional emails (receipts, welcome messages, appointment confirmations, invoice notices)
• To generate financial summaries, tax estimates, and business reports inside the app
• To respond to your support, privacy, or legal requests
• To detect, prevent, and respond to fraud, abuse, and security incidents
• To comply with our legal obligations (tax, accounting, subpoena, lawful court order)

What we don't do

2. Sub-Processors

To operate CORR we rely on the following third-party service providers ("sub-processors"). Each has its own privacy commitments and we have contractual obligations (standard contractual clauses, data-processing addenda, or the vendor's standard terms) requiring them to protect your data.

We will update this list when we add or change a sub-processor. Material changes will be announced in-app or via the email on file before the change takes effect.

3. Google API & Calendar Data Disclosure

What we access

When you connect your Google Calendar to CORR we request the scope https://www.googleapis.com/auth/calendar.events, which allows us to:

• Read your Google Calendar events to display them inside the CORR Client calendar
• Create new calendar events when you book appointments in CORR
• Update existing events when you edit appointments in CORR
• Delete events when you remove appointments in CORR
• Update event colors when you change them in CORR

How we store Google data

• OAuth tokens are stored server-side in a secure directory on our InterServer host — never in your browser or our database
• Tokens are encrypted at rest and never shared with third parties
• Calendar event data is fetched on demand; we do not permanently mirror your calendar in our database
• Refresh tokens are used solely to keep your connection alive without re-authorization

Revoking access

You can disconnect Google Calendar any time from the CORR Client app (Calendar tab → Settings → Disconnect). You can also revoke access at myaccount.google.com/permissions. On disconnection your OAuth tokens are invalidated and removed from our server.

4. Your Rights (GDPR / CCPA / CPRA)

Depending on where you live, you may have the following rights over your personal data:

GDPR (EU / EEA / UK residents)

• Access — ask for a copy of the personal data we hold about you (Article 15)
• Rectification — correct inaccurate data (Article 16)
• Erasure — request deletion of your data, subject to our legal retention obligations (Article 17)
• Restriction — ask us to pause processing while a dispute is being resolved (Article 18)
• Portability — receive your data in a machine-readable format (Article 20)
• Objection — object to processing based on legitimate interest (Article 21)
• Withdraw consent — where processing is consent-based, withdraw at any time
• Lodge a complaint — with your local supervisory authority

CCPA / CPRA (California residents)

• Right to know what personal information we collect and how we use it
• Right to delete your personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing — CORR does not sell personal information and does not share personal information for cross-context behavioral advertising, so there is nothing to opt out of
• Right to limit use of sensitive personal information
• Right of non-discrimination for exercising any of these rights

How to exercise your rights

Email privacy@corrapp.com from the email address on file with your CORR account, or send a signed letter to the address in Section 11. We will verify your identity, respond within 30 days (GDPR) or 45 days (CCPA), and act on the request unless a legal exception applies. If we deny your request we will explain why.

You may also use an authorized agent to submit a request on your behalf. We will require written proof of authorization.

5. Data Retention & Deletion

Active accounts

While your account is active, we retain your business data (clients, transactions, appointments, invoices, inventory, tax records, settings) indefinitely so your records remain accessible. You can delete any individual record from inside the app at any time.

Account cancellation

• When you cancel your subscription, your account access is suspended at the end of your paid period
• Your data is retained for 30 days after account suspension so you can reinstate if you change your mind
• After 30 days your data is permanently deleted from our Firebase project
• Backups that contain your data roll off within 90 days
• Stripe subscription records may be retained by Stripe per their own policies and applicable financial-records law

Legal holds

If we are required by a subpoena, court order, or active investigation to retain specific records, we will do so for the minimum period required even if you have asked for deletion. We will notify you unless legally prohibited.

Data export

You can export your data to CSV from the admin panel inside CORR at any time. For a complete portable export beyond the in-app option, email privacy@corrapp.com. We will provide the export within 7 business days.

Google Calendar tokens

OAuth tokens are deleted from our server immediately upon disconnection. No Google Calendar event data is retained after your session ends.

6. Cookies & Tracking

CORR uses a minimal set of cookies and similar technologies:

• Strictly necessary — Firebase Authentication session tokens; without these you cannot log in
• Functional — remembering your selected app tab, theme preference, and dismissed tips (stored in localStorage, not a true cookie)
• Security — Stripe checkout writes cookies that help prevent fraud during payment

We do not use advertising cookies, cross-site trackers, or analytics cookies that profile you individually. If EU or California regulations require an explicit cookie-consent banner when you visit corrapp.com, we will display one at first visit and respect your choice.

Do Not Track

We honor Global Privacy Control (GPC) signals where feasible. Because we do not engage in cross-context behavioral advertising, there is no tracking to disable.

7. Payments & Subscriptions

Detailed subscription, billing, auto-renewal, cancellation, and refund terms are in the Terms of Service. The short version:

• All card payments are processed by Stripe. CORR never stores your full card number.
• Subscriptions renew automatically at the price and frequency shown at checkout until you cancel.
• You can cancel any time from the Manage Plan page inside CORR; cancellation takes effect at the end of the current billing period.
• Refund policy is explained in the Terms of Service.

For billing questions email billing@corrapp.com.

8. Communications Policy

Transactional email

Account-critical emails are sent via Resend. They include purchase receipts, welcome emails on signup, appointment confirmations, invoice notices, and similar operational messages. These cannot be turned off while you have an active account, because they are required to operate the service you paid for.

Marketing email

If we ever send product announcements or newsletters, every message will identify CORR as the sender, include our physical mailing address, and contain a one-click unsubscribe link as required by the U.S. CAN-SPAM Act. You can opt out of marketing email without affecting transactional email.

Native SMS ("tap-to-text")

CORR no longer operates an automated SMS reminder service. Where phone numbers are stored in your client records, the app offers a "tap to text" link that opens your device's native messaging app with the message pre-filled — your carrier sends the text, not CORR. Standard carrier rates apply.

Client consent (your responsibility as the artist)

9. Children's Privacy

CORR is a business-tools product intended for use by adults (18+). We do not knowingly collect personal information from children under 13 (COPPA) or 16 (GDPR). If you believe a minor has provided us with personal information, contact privacy@corrapp.com and we will delete it promptly.

Some CORR features (self-booking pages, waivers, client intake forms) may collect information about your clients. It is your responsibility as the CORR account holder to ensure you are not collecting data about minors without proper parental/guardian consent.

10. Security & Breach Notification

How we protect your data

• HTTPS everywhere — TLS encryption on all corrapp.com traffic
• Firebase security rules that scope every read/write to the account owner's UID
• OAuth tokens (Google, Square) stored server-side, never in browser storage
• API keys and third-party credentials stored in a server directory outside the web-accessible path
• Role-separated administrative email addresses for incident response (security@corrapp.com)

If a breach occurs

If we confirm a data breach that affects your personal information, we will notify you without undue delay — and no later than 72 hours after discovery where GDPR applies — at the email address on file. Notifications will describe the nature of the incident, the categories of data affected, steps we have taken, and recommended steps for you.

Report a suspected vulnerability to security@corrapp.com.

11. Contact

Use the address that matches your question — it routes faster:

We may update this Privacy Policy from time to time. Material changes will be announced in-app or via email at least 14 days before they take effect. Continued use of CORR after the effective date constitutes acceptance of the updated policy.