Your data. Your rules. Our admin accounts are locked out.

Think of it like renting an office in a managed building. You get your own locked office (your data), and the building manager (us) has keys to the common areas but not to your office. When you enable Privacy Shield, database-level Row Level Security rules block our admin account from querying your sensitive tables — customers, invoices, bookings, and payments. We can see your site structure and support tickets, but our admin accounts cannot read your business data. The one key that can is the database provider's service credential, which we hold to operate the platform — see “Can you really not see my data?” below.

Click "Grant Support Access" from your settings. Choose what we can see (just bookings, just invoices, or everything) and how long (24 hours, 48 hours, or 7 days). Once the window closes, access is revoked automatically. You can also revoke it instantly with one click.

Correct, for our administrator accounts, and the database enforces it rather than a policy document. With Privacy Shield on, admin queries against your customers, invoices and bookings return zero rows unless you have granted a live, time-limited support grant. One caveat we would rather state than hide: the underlying database provider issues a service credential that bypasses all row-level rules by design, and we hold it in order to run the platform. Its use is restricted and logged. We will not claim it does not exist.

Yes. Every support access grant, every admin query, every access event is recorded in your Transparency Dashboard with timestamps. There is no way for us to access your data without it appearing in the log.

Payments go directly through your own Stripe account. We never touch the money, never see your bank details, and never hold funds. Your Stripe API keys are encrypted and shielded behind the same privacy rules.