Privacy Policy

1Who we are and what this policy covers

Lightswitch, Inc. (“Lightswitch,” “we,” “us”) is a Delaware corporation that builds systems and automations for consumer packaged goods brands. We connect to the tools our customers already use — accounting systems, retailer and distributor portals, warehouse and logistics systems, email, and messaging — and automate operational work across them.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and what choices you have. It covers:

• lightswitch.co and any other website we operate;
• the Lightswitch application, agents, automations, and integrations (together, the “Services”); and
• our communications with prospective and current customers.

Two different roles. Most of the information we handle is business data belonging to our customers. For that data we act as a service provider (a processor): we handle it only on our customer’s instructions, to deliver the Services they hired us for. Our customer decides what data we may access and how long we keep it. If you are an employee, vendor, or counterparty of one of our customers and you have a question about their data, please contact them directly; we will refer your request to them.

For information about website visitors and prospective customers, we act as a business (a controller) and decide how it is used. Sections 9 and 10 describe your rights in that information.

2Information we collect

2.1 Information you give us

• Account and contact information — name, business email address, phone number, company name, job title.
• Communications — messages you send us by email, through our website, or in shared channels such as Slack, and records of support requests.
• Billing information — billing contact, address, and payment details. Card payments are processed by our payment processor; we do not store full payment card numbers.

2.2 Information from systems you connect

When you authorize us to connect a third-party system (“Connected System”) to the Services, we access and process data from that system on your behalf. What we access depends on the automations you ask us to build and the permissions you grant. It can include:

• Accounting and financial records — company profile, chart of accounts, vendors and customers, purchase orders, bills, invoices, items and pricing, and transaction detail.
• Operational records — inventory positions, demand and supply forecasts, order and shipment data, and logistics records.
• Retailer and distributor data — point-of-sale, forecast, and order files from retailer and distributor portals.
• Communications and documents — email messages, attachments, and files, where you have asked us to build an automation that reads them.
• Business contact information — names and contact details of your personnel and counterparties that appear in the records above.

We access only what is needed for the automations you have asked us to run. We do not browse, search, or use your connected data for any purpose other than delivering the Services to you, securing them, and complying with law.

QuickBooks Online. Where you connect QuickBooks Online, we authenticate using Intuit’s OAuth 2.0 authorization flow. We never see, receive, or store your QuickBooks username or password. We receive access and refresh tokens scoped to the permissions you approve, and we store those tokens encrypted. You can revoke our access at any time — see Section 8.

2.3 Information we collect automatically

• Website usage — pages viewed, referring page, approximate location derived from IP address, browser and device type, and dates and times of visits.
• Service logs — records of automation runs, API requests and responses, errors, and diagnostic identifiers (including the intuit_tid correlation identifier returned by Intuit APIs), which we use to operate, debug, secure, and support the Services.
• Cookies and similar technologies — see Section 11.

3How we use information

We use information to:

• provide, operate, maintain, and support the Services;
• run the specific automations our customers have engaged us to build;
• authenticate users and secure the Services, including detecting and preventing fraud, abuse, and unauthorized access;
• diagnose and fix errors, and monitor performance and reliability;
• communicate with you about the Services, including service, security, and administrative notices;
• bill for the Services and maintain business records;
• with prospective customers, respond to inquiries and send business communications you have asked for; and
• comply with legal obligations and enforce our agreements.

4What we do not do with your data

We want to be explicit about this:

• We do not sell your personal information, and we have not sold or shared personal information for cross-context behavioral advertising in the preceding twelve months.
• We do not use customer data for advertising, and we do not serve third-party advertising on our Services.
• We do not use customer data to train artificial-intelligence models. See Section 5.
• We do not use one customer’s data to serve another customer.

5Artificial intelligence and model providers

The Services use large language models to read, classify, and generate operational records. To do that, relevant excerpts of customer data may be transmitted to third-party model providers through their commercial APIs.

Our commitments:

• We contract with model providers on commercial API terms that prohibit the use of our customers’ data to train or improve their models.
• We send only the data needed for the task at hand, not bulk exports of your systems.
• We do not use consumer-tier or free chat products to process customer data.
• Model providers are listed as subprocessors in Section 6, and we will update that list before adding a new one.

Automated output. Output generated by these models can contain errors. Our customers are responsible for reviewing output before relying on it, and before it is used in books, records, or filings. Lightswitch does not provide accounting, tax, legal, or financial advice.

6How we share information

We share information only as described here.

Subprocessors. We use vendors to run the Services. Each is bound by contract to protect the information, to use it only to provide services to us, and not to sell it. Our current categories of subprocessors:

A current list of named subprocessors is available on request from privacy@lightswitch.co.

Professional advisors. Lawyers, accountants, insurers, and auditors, under confidentiality obligations.

Legal and safety. We may disclose information if required by law, subpoena, or other legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, or to investigate fraud or a security incident. Where we are legally permitted, we will notify the affected customer before disclosing their data.

Business transfers. If Lightswitch is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.

7Data retention

We retain information for as long as needed to provide the Services and for the purposes described in this policy.

• Customer data from Connected Systems is retained for the duration of the engagement, and in accordance with the retention period agreed with the customer. Some automations require historical records to function; where they do, we retain the minimum history needed.
• Access and refresh tokens are deleted when a Connected System is disconnected or an engagement ends.
• Service logs are retained for up to 90 days for security and debugging, except where a longer period is needed to investigate an incident.
• Business and billing records are retained as required by law and for legitimate accounting purposes.

On termination of an engagement, we delete or return customer data on written request, as described in our End-User License Agreement. Backups are purged on our ordinary backup rotation schedule.

8Your control over connected systems

You control our access to every system you connect.

• You can disconnect at any time, either through the Services or through the third-party provider’s own settings. For QuickBooks Online, you can disconnect from within QuickBooks under Apps → Manage, or by asking us.
• Disconnection revokes our authorization. We revoke the stored tokens and stop accessing that system.
• You can request deletion of the data we retrieved from that system by writing to privacy@lightswitch.co. We will confirm the request with the customer account owner and complete it within thirty (30) days, subject to any data we must retain by law.

9Your privacy rights

9.1 California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, the sources, the purposes, and the categories of parties we disclose it to;
• Access a copy of the personal information we hold about you;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information — we do not sell or share personal information, so there is nothing to opt out of;
• Limit the use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA for the purpose of inferring characteristics; and
• Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised a right.

Categories of personal information collected in the preceding twelve months: identifiers (name, email, phone, IP address); commercial information (services purchased); internet or network activity (website and service usage); professional or employment-related information (company, job title); and business contact information appearing in customer records. We collect these from you, from your use of our website and Services, and from Connected Systems at our customers’ direction. We disclose them for business purposes to the subprocessor categories in Section 6.

How to exercise your rights. Email privacy@lightswitch.co with the subject line “Privacy Request.” We will verify your identity before responding — typically by confirming control of the email address associated with the information, and we may request additional information for sensitive requests. We will respond within forty-five (45) days, and may extend once by another forty-five (45) days with notice. You may use an authorized agent; we will require proof of authorization and may still verify your identity directly.

If the personal information is held on behalf of one of our customers, we will refer your request to that customer and assist them in responding.

9.2 Other U.S. states

Residents of states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana — have comparable rights to access, correct, delete, and obtain a portable copy of their personal information, and to appeal a denial. Use the same contact method above. If we deny your request, you may appeal by replying to our response; if we deny the appeal, you may contact your state attorney general.

10Security

We maintain administrative, technical, and physical safeguards designed to protect information, including:

• Encryption of data in transit using TLS, and encryption of data at rest;
• Credential management — API keys, client secrets, and OAuth tokens are stored in a dedicated secrets manager, never hardcoded in application code, never written to logs, and never exposed in a browser console;
• Access controls — least-privilege access, individual accounts, and multi-factor authentication for systems that hold customer data;
• Network controls — restricted egress and allowlisted addresses where a Connected System supports it;
• Monitoring and logging of service activity and errors, with alerting on anomalies;
• Vendor review before a subprocessor is granted access to customer data; and
• Incident response — a documented process for investigating, containing, and remediating security incidents.

If we become aware of a security incident affecting your data, we will notify the affected customer without undue delay and consistent with applicable law, and will provide the information needed for them to meet their own notification obligations.

No system is perfectly secure, and we cannot guarantee absolute security.

11Cookies and analytics

Our website uses cookies and similar technologies that are strictly necessary to operate the site, and may use analytics cookies to understand how the site is used. Most browsers let you refuse or delete cookies; doing so may affect site functionality. We do not use cookies for cross-context behavioral advertising, and we do not respond to browser Do Not Track signals, as there is no common standard for them.

12Children’s privacy

The Services are business tools intended for organizations. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact privacy@lightswitch.co and we will delete it.

13Where information is processed

Lightswitch is based in the United States and processes and stores information in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

14Third-party services

The Services connect to platforms operated by third parties, and our website may link to third-party sites. This policy does not apply to them. Their handling of your information is governed by their own privacy policies. In particular, your use of QuickBooks Online is governed by Intuit’s privacy policy, not this one. Lightswitch is an independent developer and is not affiliated with or endorsed by Intuit Inc.

15Changes to this policy

We may update this policy from time to time. If we make a material change, we will post the updated policy with a new “Last updated” date and, where we have your contact information and the change affects you, provide reasonable advance notice. Your continued use of the Services after the change takes effect constitutes acceptance.

16Contact us

Questions, requests, or complaints:

Lightswitch, Inc. 401 Park Ave South, 10th Floor, New York, NY 10016
privacy@lightswitch.co