This Privacy Policy describes how Counsel Inc. ("Counsel," "we," "us") collects, uses, and protects information when you use our service at havecounsel.com.

1. Information We Collect

Account information: Your name, email address, and password (hashed — we never store plaintext passwords) when you create an account.

Business and worker information: Company name, operating state, and the employee and worker details you enter into Counsel (names, job types, pay rates, work states). This information is used solely to generate your HR playbooks.

Usage information: Playbooks you run, questions you ask, tasks you create, and general usage patterns. We use this to improve the service.

Payment information: Billing is processed entirely by Stripe. Counsel never receives or stores your card number or bank details.

Device and log information: IP address, browser type, and pages visited — standard server logs used for security and debugging.

2. How We Use Your Information

• To deliver the Counsel service — running playbooks, answering HR questions, tracking tasks
• To improve accuracy and expand state coverage
• To send essential account emails (receipts, security notices, material policy changes)
• To detect and prevent abuse or unauthorized access

We do not sell your information. We do not use your data to train AI models. We do not send marketing emails without your consent.

3. Third-Party Services

• Supabase — database and authentication. Your account and worker data is stored in US-based data centers with row-level security enforced.
• Anthropic (Claude AI) — processes your questions to generate HR guidance. Anthropic's API terms prohibit training on user data submitted via the API.
• Stripe — payment processing. PCI-DSS certified. Subject to Stripe's own privacy policy.
• Vercel — hosting and serverless infrastructure. Subject to Vercel's data processing terms.

4. Data Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.3). Access to your data is controlled at the database level — you can only read your own records. We apply the principle of least privilege to all internal data access.

5. Your Rights

• Access: Request a copy of the data we hold about you.
• Correction: Update incorrect information directly in your account settings.
• Deletion: Delete your account and all associated data at any time. Contact us and we will permanently delete your records within 30 days.
• Export: Request a data export in JSON format.

To exercise any of these rights, contact us at hello@havecounsel.com.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, we remove your personal data within 30 days except where retention is required by law (e.g., billing records required for tax purposes, retained for 7 years).

7. Children

Counsel is intended for business owners and operators aged 18 and older. We do not knowingly collect data from anyone under 13.

8. Changes to This Policy

We will notify you of material changes by email with at least 30 days' notice before the change takes effect. Continued use of Counsel after that date constitutes acceptance of the updated policy.

9. Contact

Questions or requests: hello@havecounsel.com
Counsel Inc., San Francisco, CA