Privacy Policy

SuiteSqr ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard information when you use the SuiteSqr platform at suitesqr.com (the "Service"). By using the Service, you agree to the practices described in this policy.

1. Information We Collect

1.1 Account Information

When you register, we collect your email address, password (stored only as a one-way hash), user type (service provider or company), and your acceptance of our Terms of Service. If you sign in through Google, Microsoft, or LinkedIn, we receive your OAuth identifier, display name, and email from that provider. We also track email verification status and periodic re-verification timestamps.

1.2 Service Provider Profile Information

If you create a service provider profile, we collect business details you provide, including: company name, website, headquarters location, country, founding year, company description, CEO name, employee count, provider types, supported NetSuite modules, target industries, client sizes, geographic coverage, methodology, service features, social media URLs (LinkedIn, YouTube, Instagram, Facebook), contact email, logo, and custom specialties. We also store internal account contact details (name, email, phone, LinkedIn) used for administrative purposes.

1.3 Company Profile Information

If you register as a company user, we collect: your first name and last name, a public username you choose (or one we generate for you), company name, position/title, industry, location, country, company size, annual revenue range, NetSuite status, modules in use, company description, website, and logo. We also store internal account contact details (name, email, phone) for administrative purposes. Your public identity across the platform is your username, displayed as "s/username" (for example, "s/CrimsonFalcon492"). Your real name is not shown publicly; it is visible only to SuiteSqr administrators.

1.4 Reviews, Replies, Comments, and Feedback

When you submit a review, we collect: the star rating, review text, project type, industry context, NetSuite modules and features discussed, and project size. When you reply to a review, we store the reply text, threading information, and authorship. We also retain edit history for both reviews and replies, including previous versions and edit timestamps, to maintain transparency and audit trails.

When you comment on a SuiteSqr blog post, we store the comment text, authorship, and timestamp. Comments are publicly visible to all visitors and are attributed to your public identity (your username for company accounts, or your firm's name for provider accounts), which links to your public profile.

1.5 Messages

When you send messages through our messaging system, we store the message content, sender and recipient identifiers, thread identifiers, read status, and timestamps. You may also archive or delete message threads on your end; we track these per-user preferences.

1.6 Reports and Moderation Data

When you report a review or reply, we store the reason for the report, your detailed explanation, the priority level (assigned automatically based on the reason), and the status of the report. When an administrator resolves a report, we store the resolution reason and any administrative notes. If content is removed by a moderator, the removal reason is stored and displayed publicly in place of the removed content.

1.7 Support Cases

When you submit a support request, we collect your name, email, category, message content, and a unique case number. Threaded messages between you and our support team are stored, including sender names and timestamps. Support cases also track priority, status, and resolution details.

1.8 Solutions & Offerings

Service providers may create solutions and offerings (services listed for review). We collect the title, description, pricing information (fixed price, price range, or contact-for-pricing), category, YouTube demo URLs, and file attachments.

1.9 Match Quiz

If you use our "Find My Match" tool, we store your quiz answers (industry, modules, goals, availability preferences, and other preferences) and the resulting provider matches so you can revisit your results.

1.10 Claim Requests

If you submit a request to claim an unclaimed provider profile, we collect your name, email address, phone number, a supporting message, and your IP address (for fraud prevention).

1.11 Information Collected Automatically

When you use the Service, we automatically collect certain technical and usage data:

• IP addresses: Collected when you view profiles, view or click on reviews and solutions & offerings, perform searches, click outbound links (website, social media), and submit claim requests.
• Browser and device information: User agent string (browser type, version, operating system) collected during profile views.
• Profile view tracking: We record which provider profiles are viewed, the viewer type (anonymous, provider, or company), the source of the visit, and repeat visit counts within a deduplication window.
• Review and solutions & offerings impressions: We track views and clicks on individual reviews, replies, and solutions & offerings with 24-hour deduplication per user or IP address.
• Blog engagement: We log views on blog posts (deduplicated once per browser session, and never from search-engine crawlers), including the viewer type (anonymous, buyer, or provider), the logged-in viewer's account where applicable, IP address, and user agent, so administrators can see who viewed a post and how often. Aggregate view counts and comment counts are displayed publicly on the blog; individual viewer identities are visible only to SuiteSqr administrators.
• Search activity: We log search queries, applied filters, result counts, and which provider cards appeared in search results (search impressions), along with session identifiers. Authorized administrators may review search records, including the searcher's user account or IP address, for analytics, fraud detection, and abuse prevention.
• Outbound clicks: We track when users click external links on provider profiles (website, LinkedIn, YouTube, Instagram, Facebook) for analytics purposes.
• Engagement data: We record votes (upvotes/downvotes) on reviews and replies.
• Email send log: We retain a copy of transactional emails we send you, including the recipient address, subject, full message body, template, delivery status, and timestamp. Authorized administrators may review these records for diagnostic, audit, and abuse-prevention purposes.

1.12 Notifications

We generate and store in-app notifications for events such as new reviews on your profile, replies to your content, moderation actions on your reports or content, and content flagged as disputed due to multiple reports. Notifications include a message, type, link, read status, and timestamps. You may delete notifications at any time.

1.13 Payment and Billing

SuiteSqr is currently an open platform with no paid plans. We plan to release premium features in the future; when we do, this section will be updated to describe the data processed in connection with billing.

2. How We Use Information

We use the information we collect to:

• Create and manage your account and authenticate your identity, including email verification and periodic re-verification.
• Display service provider profiles, solutions & offerings, and reviews to facilitate connections between companies and service providers.
• Operate the matching tool to recommend service providers based on your quiz responses.
• Send transactional communications such as email verification codes, password resets, support case updates, and claim request notifications.
• Provide in-app notifications about activity relevant to you (new reviews, replies, moderation outcomes).
• Moderate content through our reporting and flagging system, including labeling content as "Disputed" or "Heavily Disputed" when it receives a high volume of reports, pending administrator review.
• Provide analytics dashboards to service providers showing profile views, search impressions, review impressions, outbound click statistics, and viewer demographics.
• Log and analyze search activity to improve search relevance and understand platform usage patterns.
• Detect and prevent fraud, abuse, and duplicate accounts, including IP-based fraud detection on claim requests and rate limiting on sensitive actions.
• Process and respond to support cases and maintain communication history.
• Enforce our Terms of Service and community guidelines.
• Comply with legal obligations and respond to lawful requests from authorities.
• Detect and prevent fraudulent reviews, fake accounts, and coordinated abuse through automated monitoring of account behavior, review patterns, and platform activity.

Legal Basis for Processing (for users in the EU/UK/EEA)

Where applicable under the General Data Protection Regulation (GDPR) or similar laws, we rely on the following legal bases for processing your personal data:

• Contract performance: Processing necessary to provide the Service you requested, including account creation, profile management, messaging, reviews, matching, and support cases.
• Legitimate interest: Processing for purposes such as analytics and insights for service providers, fraud prevention, platform security, content moderation, improving search relevance, and enforcing our Terms of Service. We balance these interests against your rights and only rely on this basis where our interests do not override your privacy.
• Consent: Processing based on your explicit opt-in for optional communications. You may withdraw consent at any time from your Account Settings without affecting the lawfulness of processing performed before withdrawal.
• Legal obligation: Processing required to comply with applicable laws, court orders, or regulatory requirements.

We do not sell your personal information to third parties. We do not use your data to display third-party advertising on the Service.

3. Information Sharing

We may share your information in the following limited circumstances:

• Public profile information: Service provider profile details (company name, description, modules, etc.) are displayed publicly to all visitors. Your public username is displayed alongside reviews you submit; your real name is not shown publicly. Social media URLs and website links on provider profiles are visible to all users.
• Reviews and replies: Reviews and replies you submit are attributed to your public username, not your real name. Edit history for reviews and replies is visible to other users. If content is removed by a moderator, the removal reason is displayed publicly in place of the removed content.
• Analytics shared with providers: Service providers on paid analytics plans (Pro) can see individual data about customers who have viewed their profile or clicked their outbound links, including the viewer's public username and email address. Your real name is not shared with providers. Aggregated data available to providers includes search terms that led to their profile, impression counts, and click breakdowns by link type. IP addresses and raw user agent strings are not shared with providers.
• Service vendors: We share data with trusted vendors who help us operate the Service (e.g., hosting, email delivery via SMTP), subject to confidentiality obligations.
• Authentication providers: If you use Google, Microsoft, or LinkedIn sign-in, those providers receive confirmation that you are authenticating with our Service. We receive your email and display name from them. We do not share your SuiteSqr activity data back to these providers.
• Legal compliance: We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of SuiteSqr, our users, or others.
• Business transfers: If SuiteSqr is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via the email address on your account before your data becomes subject to a different privacy policy.

4. Cookies and Local Storage

We use cookies and browser local storage to operate and improve the Service:

• Authentication tokens: We store a JSON Web Token (JWT) in your browser's local storage to maintain your logged-in session. This token contains your user ID, user type, and admin status, and expires after a set period.
• User preferences: We store your account information in local storage for quick access during your session.
• Analytics cookies: We may use cookies to understand how users interact with the Service so we can improve the experience.

You can configure your browser to refuse cookies or clear local storage at any time. Note that doing so will log you out and may affect the functionality of the Service.

If you are located in the European Union, United Kingdom, or European Economic Area, we endeavor to obtain your consent before setting any non-essential cookies, in accordance with applicable ePrivacy and data protection laws.

5. IP Addresses and Tracking

We collect IP addresses in the following contexts:

• Profile view events (to deduplicate views and provide viewer analytics to providers)
• Review and reply impression tracking (to deduplicate within 24-hour windows)
• Search impression tracking (to measure search result visibility)
• Outbound click tracking (to count clicks on external links)
• Solutions & offerings impression tracking (to measure visibility)
• Claim requests (for fraud detection and prevention)

IP addresses are used for deduplication, fraud prevention, and aggregated analytics. They are not displayed to other users or shared with service providers. We do not use IP addresses to build user profiles or for targeted advertising.

6. Data Retention

We retain your account information and associated data for as long as your account is active or as needed to provide the Service.

• Account and profile data: Retained while your account is active. If your account is archived or deleted by an administrator, your data is soft-deleted (retained internally with an archived flag and reason).
• Reviews and replies: Retained indefinitely as part of the public record, even if your account is deactivated. If you delete a review or reply within 24 hours of posting, the text is replaced with "[deleted by user]" but the record is retained. Reviews removed by moderators display the removal reason publicly.
• Edit history: Previous versions of reviews and replies are retained permanently for transparency.
• Messages: Message content is retained until the associated user account is deleted. Thread archive and delete settings are per-user soft deletes.
• Reports and moderation records: Flag records, including reporter identity, reason, and resolution, are retained indefinitely for moderation audit purposes.
• View events, impressions, and analytics: Tracking data including IP addresses and user agent strings is retained for up to 24 months.
• Search logs: Search queries and filter data are retained for up to 12 months.
• Support cases: Support case records and threaded messages are retained indefinitely. Cases may be auto-closed after a period of inactivity.
• Notifications: Notifications are retained until you delete them or clear all notifications. You may delete individual notifications or all notifications at any time.
• Verification codes: Email verification codes, email change codes, and identity codes are temporary and expire after a set period (typically minutes to hours).

If you request account deletion, we will delete or anonymize your personal information within 30 days, except where we are required to retain certain data by law or for legitimate business purposes such as fraud prevention, dispute resolution, or maintaining the integrity of public reviews.

7. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request that we delete your personal information, subject to the retention exceptions described above.
• Portability: Request a machine-readable export of your data.
• Objection: Object to our processing of your data in certain circumstances.
• Restriction: Request that we restrict the processing of your personal data in certain circumstances (e.g., while we verify the accuracy of your data or assess an objection).
• Withdraw consent: Where we rely on your consent to process data, you may withdraw that consent at any time without affecting the lawfulness of processing performed before withdrawal.
• Automated decision-making: Request not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Our matching tool provides algorithmic recommendations only and does not make binding decisions about you.
• Lodge a complaint: If you believe we have not handled your data in accordance with applicable law, you have the right to lodge a complaint with your local data protection authority or supervisory authority.

Choices you can make directly:

• Edit or update some profile information directly through your Dashboard or Account Settings. Changes to certain fields may require submitting a support case.
• Delete your own reviews or replies within 24 hours of posting.
• Delete individual notifications or clear all notifications from the Notifications page.
• Archive or delete message threads.
• Disconnect SSO (Google/Microsoft/LinkedIn) by setting a password.
• Email preferences: From Account Settings > Email Preferences, turn off any of the following categories at any time: direct messages, support case updates, reviews and replies, and product news and announcements. Security and identity emails (verification codes, password resets, admin decisions on your profile) are always sent and cannot be disabled.

To exercise any of the rights listed above that you cannot perform directly, please create a support case. We will respond to your request within 30 days.

8. Security

We take reasonable technical and organizational measures to protect your personal information:

• Passwords are hashed using bcrypt and are never stored in plain text.
• All data in transit is encrypted via HTTPS.
• Authentication uses signed JSON Web Tokens with expiration.
• Email verification codes are time-limited and single-use.
• Rate limiting is applied to sensitive endpoints (login, registration, flagging, verification code resends).
• Administrative actions (account management, moderation) require authenticated admin accounts.
• Foreign key constraints and data integrity checks are enforced at the database level.

However, no security system is impenetrable. We cannot guarantee the absolute security of your information. In the event of a data breach that affects your personal data, we will notify affected users and relevant authorities as required by applicable law, including GDPR supervisory authority notification requirements and state-level breach notification statutes in the United States.

9. Content Moderation and Dispute Escalation

Our platform includes a community reporting system. When content (a review or reply) accumulates 5 or more pending reports, it is marked as "Disputed" and a community summary is generated to provide context. If reports continue to accumulate and reach 15 or more, the content is elevated to "Heavily Disputed." In both cases, the content remains publicly visible but is clearly labeled so readers are aware of community concerns. These labels are temporary and do not constitute a determination that the content violates our policies. An administrator will review the reports and either dismiss them (removing the dispute label) or remove the content (with a stated reason displayed publicly).

If your content is reported, dismissed, or removed, you will receive an in-app notification with details. If a report you filed is dismissed, you will receive a notification with the administrator's stated reason.

10. Third-Party Authentication

We offer sign-in via Google, Microsoft, and LinkedIn OAuth. When you use these services:

• We receive your email address and display name from the authentication provider.
• We store an OAuth identifier to link your external account to your SuiteSqr account.
• Your email is automatically marked as verified when using SSO.
• We do not receive or store your password from these providers.
• We do not share your SuiteSqr activity data with these providers.

Your use of Google, Microsoft, or LinkedIn sign-in is also subject to those companies' respective privacy policies.

11. Children's Privacy

The Service is intended for business use by adults and is not directed at children under the age of 13 (or 16 in jurisdictions where that threshold applies). We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please create a support case immediately and we will delete it promptly.

12. International Users and Regional Privacy Rights

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our infrastructure is located.

12.1 Cross-Border Data Transfers

When we transfer personal data from the European Union, United Kingdom, European Economic Area, or other jurisdictions with data transfer restrictions, we take steps to ensure your data receives an adequate level of protection regardless of where it is processed. These steps may include relying on appropriate safeguards as required by applicable law, such as Standard Contractual Clauses (SCCs) or other recognized transfer mechanisms. If you have questions about how your data is transferred, please create a support case.

12.2 European Union, United Kingdom, and EEA Residents

If you are located in the EU, UK, or EEA, you may have rights under the General Data Protection Regulation (GDPR) or equivalent local legislation. These rights are described in Section 7 of this policy and include the rights to access, correct, delete, port, restrict, and object to processing of your personal data, as well as the right to withdraw consent and lodge a complaint with your local data protection authority. We process your data on the legal bases described in Section 2. To exercise your rights, please create a support case. We aim to respond within 30 days.

12.3 California Residents

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• Right to know: You may request the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete: You may request that we delete the personal information we have collected from you, subject to certain exceptions (such as maintaining the integrity of public reviews).
• Right to correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. We do not use your personal information for cross-context behavioral advertising. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. To exercise your rights, please create a support case. We may verify your identity before processing your request.

12.4 Canadian Residents

If you are located in Canada, your personal information may be protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable provincial legislation. You may have the right to access, correct, and challenge the accuracy of personal information we hold about you. To exercise these rights, please create a support case.

12.5 Other Jurisdictions

If you are located in another jurisdiction with data protection laws, we are committed to respecting your rights under applicable local legislation. We take steps to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed. If you have questions about your rights or how your data is handled, please create a support case.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or in-app notification. Your continued use of the Service after any changes indicates your acceptance of the updated policy.

We encourage you to review this policy periodically to stay informed about how we protect your information.

14. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

SuiteSqr Legal
admin@suitesqr.com

To report a security vulnerability, please submit a support case with a description of the issue. We ask that you provide us a reasonable opportunity to investigate and address the issue before any public disclosure.