Privacy

Who we are

Front Desk and its Money add-on are run by Lobos, the operating name of A.L. CAPITAL GROUP HOLDINGS LLC, a Florida limited liability company. In this page, "we" means Lobos. Questions go to alojr27@gmail.com.

What we collect

• Your email address, which is how you sign in.
• The names, emails and roles of the people your business puts in its settings.
• For Front Desk clients, the leads that come in through your form or Instagram: name, email, phone, Instagram handle, the service they asked about, how they heard of you, their message and notes your team adds.
• If you turn on Money and connect a bank through Plaid: the bank's name, account names, the last 4 digits of each account (never the full account number), balances, transactions (date, amount, description, merchant and the bank's category) and loan details such as interest and principal paid this year.
• If you use commission matching, the closings you list: address, side, date and commission amount.
• Sign in sessions, and a log of who viewed, changed, connected or exported Money data.

How bank access works

Banks connect through Plaid. You type your bank login on Plaid's screen, so we never see or store it. Plaid gives us a key that can only read: it cannot move money, pay bills or change anything at your bank. We store that key encrypted. Plaid handles your data under its own policy: Plaid End User Privacy Policy.

Plaid may ask you to also allow loan and investment access, so we can add those later without a new link. Today we read transactions, balances and loan details only.

Who else handles your data

We use a few service providers to run the app. Each gets only what its job needs.

• Plaid: connects your banks and passes us the bank data above.
• Vercel: hosts the app.
• Supabase: hosts the database where your data is stored.
• Anthropic, an AI company: receives transaction descriptions, merchant names, amounts and dates so it can suggest a category. It never receives account numbers, account names or the names of people. Its answer is only a suggestion; you approve it.
• Resend: sends our emails, such as sign in links and reconnect notices.
• Composio and Intuit: only if your business turns on the QuickBooks option, sorted transactions are sent through Composio to your QuickBooks account at Intuit.

How we protect it

• Bank keys and authenticator secrets are encrypted with AES-256-GCM, each tied to its own record.
• All traffic between you, us and our providers is encrypted in transit with TLS.
• Sign in uses a one time email link that works once, for 15 minutes. There is no password to steal.
• Money is open to your business's owners only, never staff, and needs an authenticator app code plus a sign in no older than 7 days.
• Every view, change, bank link, disconnect and export in Money is logged, and owners can see that log.
• Each business only ever sees its own data.
• Inside Lobos, only Alvin, the owner, can see your data, to run and support the service.

We follow the FTC Safeguards Rule (16 CFR 314), part of the Gramm-Leach-Bliley Act, through a written security program, whether or not the rule strictly applies to us.

How long we keep it

• Bookkeeping records are kept for 7 years after the tax year they belong to, so they are there for taxes and audits.
• You can disconnect any bank at any time. We tell Plaid to remove the link, delete the stored key, and no new data comes in. What was already pulled stays in your books.
• When you leave, we disconnect every bank at Plaid and give you your CPA export. If you ask in writing after that, we delete your data, except anything the law makes us keep.

What we never do

We do not sell your data. We do not show ads or share your data with advertisers. We do not use it for anything but running the service for your business.

Your choices

You can ask to see, correct, export or delete your data, or ask any question about it, by emailing alojr27@gmail.com.

Changes

If we change this page, we update the date at the top. If a change affects how bank data is used, we tell your business's owners by email first, and Money asks for your OK again before it reads anything new.