Privacy Policy
Last updated October 13, 2026
PenSnap Software, LLC (“PenSnap,” “we,” “us”) builds and runs Partner Portal (the “Service”). Companies (our “customers”) use it to manage their referral partners: track relationships, send email and texts, run events, and track expenses. This policy explains what information the Service handles, who it is shared with, and the choices you have.
If you work for a customer, we process your account information to run the Service for you. If you are a partner, a partner’s contact, or one of a partner’s clients, the customer decides what information about you is kept and what messages you receive, and we process that information on the customer’s behalf. Questions about that relationship are best sent to the company that contacted you. You can also write to us and we will pass them on.
1. Information we collect
About the people who use the Service (customer staff).
- Account details: name, work email, mobile number for sign-in codes, role, markets, and an optional home or office address used to plan routes.
- Sign-in data: a hashed password and two-factor secrets, or a Google, Microsoft or Apple sign-in.
- Writing samples you give us so the Service can match your tone.
- Connected calendars (Google, Microsoft or iCloud): the title, location and times of your events from 7 days back to 30 days ahead. Appointments you book in the Service are added to your calendar.
- A connected LinkedIn account, if you use it to post from the Service.
- Your location, only when you tap Re-plan on a route. It is used once to plan the route and is not stored.
About partners and their contacts.
- Business details: name, type, address, website and notes.
- Contact details: names, titles, phone numbers, email addresses, birthday (month and day only) and notes.
- Consent and opt-out status for email and texts.
- Activity history: notes, logged calls (calls are not recorded), emails and texts sent through the Service and replies received, meetings and events.
- Newsletter engagement: whether a newsletter was opened and which links were clicked.
- Event responses, check-ins and the names of any guests you bring.
About partners' clients.
When a partner shares their client list through a customer’s link, we receive each client’s name, street address and ZIP code, and optionally their phone, email, city and state. See “How we use information” for what happens next.
From public and commercial sources.
To help customers find new partners, the Service collects business listings from Google Places (name, address, phone, website and rating) and from public licensing records, such as state real-estate and insurance boards and the NMLS mortgage registry.
Financial account information.
When a user connects a credit or debit card through Plaid, we receive the details described in “Financial account information & Plaid” below.
Photos you scan.
Business cards and receipts you photograph are sent to our AI provider to read the details, and the photos are not stored.
Usage and security data.
Sign-in events and an audit log of actions taken in the Service, used for security, support and troubleshooting.
We do not knowingly collect personal information from children. We do not collect health information or full payment card numbers through the Service.
2. How we use information
- Provide the Service: show partner records, send the email, texts, newsletters and event invitations a customer chooses, schedule appointments and plan routes.
- Run AI features a customer uses: drafting messages and posts, personalizing follow-ups, matching a user’s tone, and reading business cards and receipts.
- Send storm alerts: partners’ clients’ addresses are checked against hail data so the partner can be told when a storm may have hit their clients. If the partner then chooses to refer clients, those clients’ details go to the customer’s lead system.
- Categorize, match and approve expenses for the cards a user connects.
- Authenticate users, secure the Service, prevent abuse and keep audit records.
- Support customers and comply with legal obligations.
4. Financial account information & Plaid
When you connect a credit card or bank account inside the Service for expense-tracking purposes, we use Plaid Inc. (“Plaid”) as a data processor. Plaid is a financial-data network used by thousands of applications to securely connect to financial institutions on a user’s behalf.
What Plaid sees: when you click “Connect Card,” Plaid Link opens inside our application. You authenticate directly with your financial institution through Plaid’s interface. Plaid never gives us your bank credentials.
What we receive from Plaid:
- An access token Plaid uses to retrieve data on your behalf.
- The list of accounts on the connection (last four digits, account type, name).
- Cardholder name (used to assign cards to the correct employee).
- Transaction history (merchant, amount, date, currency, Plaid-assigned category).
How we protect it: the Plaid access token is encrypted using AES-256-GCM at the application layer before it’s written to our database, which is hosted by Railway with access limited to our team. We do not store full card numbers, CVV codes, PIN codes, or bank-account/routing numbers.
Your rights: you can disconnect any connected card from the Service at any time. Disconnecting revokes Plaid’s access token on our side; you can also revoke the connection directly through Plaid Portal at https://my.plaid.com.
Plaid’s own policy: Plaid’s end-user privacy policy is available at https://plaid.com/legal/#end-user-privacy-policy. By connecting an account, you agree to Plaid’s policy in addition to this one.
5. Email and text messages
Customers send email and texts to partners through the Service and must follow the law when they do, including having any consent required before texting.
- Email: every marketing email has an unsubscribe link. Unsubscribing stops email to that address from the customer through the Service.
- Texts: reply STOP to any text. Our texting providers record the opt-out and block further texts to that number.
- Newsletters contain a small image and tracked links that tell the customer whether the newsletter was opened and which links were clicked.
7. Security
Passwords are hashed with bcrypt. Two-factor secrets, Plaid access tokens, calendar and LinkedIn connection tokens, and iCloud app passwords are encrypted with AES-256-GCM before they are stored, using keys kept separately from the database. Sessions use HttpOnly cookies, and the Service is served only over HTTPS with HSTS. Access to partner and financial records is limited by role and recorded in an audit log, which we keep for two years. No system is perfectly secure, and we will notify affected customers of a breach as the law requires.
8. How long we keep information
We keep partner, contact and client records while the customer’s account is active, plus 30 days after the account closes so the customer can export them. Transaction data from Plaid is kept while the connection is active; after a disconnect, transaction data tied to that connection is deleted within 90 days unless the law requires us to keep it. Scanned card and receipt photos and route-planning locations are not stored. Audit-log entries are kept for two years.
Our Data Retention Policy lists each kind of data and how long we keep it.
9. Your choices and rights
- See, correct or delete your information: email kirk@pensnap.software. If the information is held for a customer, such as a partner, contact or client record, we will work with that customer to answer your request.
- Stop email: click the unsubscribe link in any marketing email.
- Stop texts: reply STOP to any message.
- Disconnect a card: use “Disconnect” on the linked-cards page, or revoke the connection at https://my.plaid.com.
- Disconnect a calendar or LinkedIn: use Settings or Studio in the Service.
- Close your account: email kirk@pensnap.software. We will delete your record within 30 days unless the law requires us to keep it.
10. State privacy rights
Residents of California, Colorado, Connecticut, Texas, Utah, Virginia and other states with privacy laws have additional rights, such as to know, correct and delete their personal information. To use these rights, email kirk@pensnap.software; we may need to verify your identity. We do not sell personal information or share it for targeted advertising, as those laws define those terms.
11. Changes to this policy
We may update this policy. When we do, we will change the “Last updated” date above. We will give customers notice by email or in the Service at least 30 days before any material change that reduces your rights takes effect.
12. Contact us
PenSnap Software, LLC
4955 Miller St. Suite 202, Wheat Ridge, CO 80033
kirk@pensnap.software