GodKey MFG — Privacy Policy Effective: October 30, 2026 · Version: privacy-2026-10-30

The short version. We collect only what we need to run GodKey MFG for you. We don't sell or share your data, we don't run ad tracking, and you can get a copy or ask us to delete it at any time. Email support@godkeymfg.com.

Who we are. Aurora Lites LLC, dba GodKey MFG, Concrete, Washington, USA. For your account data — your name, email and sign-in — we are the controller. For the business records your company enters or connects, we act as your company's service provider (processor); your company decides what goes in and who it belongs to. The companies listed below run infrastructure for us under contract.

Where your data lives. Your data is stored in the United States, and GodKey MFG is offered to US businesses.

What we collect.

• Your account: name, email, password (stored only as a secure hash), and your sign-in activity.
• Your company's records: what you enter to run your business — materials, recipes, production, inventory, purchases, invoices, customers and suppliers, owner/finance records, and (if you use them) employee and pay records.
• Payment data (only if/when paid plans begin): handled by Stripe. We never see or store full card numbers.
• From accounts you connect: if your company connects Square (or, later, Stripe or a bank), we receive what that service sends — sales, payments and the statements you upload. That can include your own customers' details (a name on a sale, a payer on a statement line). We use it only to keep your company's records; never for anything else.
• Documents you upload to be read: supplier invoices, bills, receipts, and bank or card statements, with whatever is printed on them, such as names, addresses, amounts and the last digits of an account number. We use them only to keep your company's records; never for anything else.
• Basic technical data: the app build, your browser/viewport, and error/diagnostic logs needed to keep it working.
• We do not collect health data. The only health-adjacent fields are benefit-deduction amounts in payroll, which you choose to enter; they're treated as ordinary pay records, not medical data.

The sensitive things the app can hold, and how each is protected. Contractor and business tax ID numbers (for 1099s), bank account details and uploaded bank statements, business documents you attach, and the addresses of your suppliers and customers. All of it is encrypted in transit and at rest, access-controlled to your company alone, and backed up encrypted; uploaded documents live in a private store no browser can reach directly. A document you upload to be read (a statement, supplier invoice, bill or receipt) is sent whole to the AI reading service below, only to prepare the summary you check; nothing from it goes into your records until you say it looks right. A spreadsheet or CSV file GodKey's own software can read is never sent.

A photo is kept exactly as you took it, including any location your phone recorded in it. GodKey makes a JPEG copy of it, where your browser can open it, to read, preview and print, and that copy carries none of that. You can always download the original.

A file dropped on the upload page, before anything is made from it, is seen only by the person who uploaded it and your company's owner.

Until then, either of them can remove a file uploaded by mistake. It is deleted from our live store at once; we keep only a note of who removed a file and when. The encrypted backup copies that hold it are deleted on the backup schedule described under "How long we keep it" below: no more than 92 days later, unless the backup system has paused, as that section explains.

How we use it. To provide the app, keep your records, keep it secure and backed up, support you, and (only with your consent, once paid plans exist) bill you. That's all.

Who it's shared with (our processors, by name). We share data only with the vendors that run the service for us, each under a contract that limits them to serving us:

• Railway — application hosting.
• Supabase — database and authentication.
• Backblaze B2 — encrypted off-site backups.
• GitHub — our nightly backup is restore-tested on GitHub-run build machines, so an encrypted backup copy is briefly processed there during that verification.
• Hostinger — hosts our support email (support@godkeymfg.com), so anything you email us passes through it.
• Anthropic — the AI reading service. It reads the statements, supplier invoices, bills and receipts you upload to be read (the whole file), only to prepare the summary you check. A file GodKey's own software can read, such as a spreadsheet or CSV, is never sent. Under Anthropic's Commercial Terms, "Anthropic may not train models on Customer Content from Services" (anthropic.com/legal/commercial-terms, effective June 17, 2025). Its retention policy states it will "automatically delete inputs and outputs on our backend within 30 days of receipt or generation", except where it needs to keep them longer to enforce its Usage Policy or to comply with the law (privacy.claude.com, "How long do you store my organization's data?", updated July 1, 2026). Both checked October 30, 2026; we re-check when we change the model or Anthropic changes its terms.
• Stripe — payment processing (only if/when paid plans begin).
• Resend — transactional email (sign-in, verification, notices).
• Sentry — server error reporting. What it receives is scrubbed before it leaves our server: no request bodies, no cookies or authorization headers, no query strings, no document contents, and tokens, email addresses, account and card numbers are redacted from every string, stack traces included.

We do not sell your data, we do not share it for anyone else's advertising, and we run no third-party ad or tracking pixels or SDKs.

Cookies. GodKey MFG sets no cookies. Your sign-in is kept as a token in your browser's own storage on your device and sent only to GodKey.

How long we keep it (retention). While your company is open, we keep its records so the app works. Its owners can close it in GodKey, under Settings, Company details: every owner approves, and for 30 days after closing an owner can restore it. Your company's data is removed from GodKey 30 days after closing, and every backup copy of it is deleted no more than 92 days after that removal. If our backups ever stop running, deletion waits until they run again. Our backup system enforces this on its own, for as long as it is running and verifying each night. If it ever pauses (a fault, or a failed verification), existing copies are deliberately kept until it runs clean again — a fault must never be able to erase the backups — and our monitoring alerts us within a day, so a pause is corrected in days, not weeks. Need a copy first? Email us at support@godkeymfg.com before you close, and we'll help you export it — you are responsible for keeping the records the law requires your business to keep.

Your choices and rights. You can ask us to access, correct, export, or delete your data at any time — email support@godkeymfg.com and we'll verify it's you and act on it. Closing your company starts the deletion schedule above. Your login belongs to you and isn't deleted just because a company is.

Security. Passwords are hashed, data is access-controlled per company, and backups are encrypted and tested. No system is perfect; if a breach ever affects your data, we'll follow our breach-response plan and notify you as the law requires.

Who can use it. GodKey MFG is a business tool for people 18 or over who are authorised to act for their business. It isn't directed to anyone under 18, and we don't knowingly collect their data.

Changes. If we change this policy materially, we'll post the new version with a new effective date and ask you to agree to it the next time you sign in.

Last updated: October 30, 2026. Contact: support@godkeymfg.com.