Legal

Privacy Policy

Effective date: October 25, 2026. Last updated: October 25, 2026.

FMLY Consulting, LLC ("FMLY Consulting", "we", "us") operates SB Assistant: the website at www.sbassistant.com and the SB Time Tracker, SB Project Management and SB CRM apps (together, the "Service"). This policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It applies to visitors to our website, to the people who create and use SB Assistant accounts, and to the people whose information our customers store in the Service.

Two roles: when we decide, and when our customer decides

SB Assistant is business software. Our customers are businesses, and they put information about their own employees, clients and contacts into the Service. That creates two different roles.

Account, billing and website data. When you visit our website, create an account, sign in, or pay us, we decide how that information is used. For this data we are the "controller" (or "business" under US state privacy laws), and this policy describes our practices directly.
Customer Data. Time entries, timesheets, expenses, projects, tasks, comments, clients, contacts, deals, invoices, estimates, notes, web-form submissions and similar records that a customer enters into its account are "Customer Data". The customer decides why and how that data is used. We process it only to provide the Service to that customer and on its instructions, as a "processor" or "service provider". If you are an employee, contractor, client or contact of one of our customers and want to access, correct or delete information about you, contact that customer. We will help the customer respond.

What we collect

Account information

Your name, work email address, company name, role in your company, the identifier our sign-in provider assigns to you, and when you last signed in. Sign-in is handled by WorkOS at auth.sbassistant.com. We do not see or store your password.

Billing information

The account owner's email address, the number of billable seats on the account, and the customer and subscription identifiers our payment processor (Stripe) assigns. Card details are entered on Stripe's pages and go directly to Stripe. We never store card numbers.

Customer Data

Everything you and your team enter into the apps: time entries and timesheets, expenses and receipt images, projects, task lists, tasks, comments, clients and contacts, companies, deals, invoices, estimates, payments recorded against invoices, rates, notes, reminders, links to documents you keep elsewhere, and submissions received through a contact form you embed on your own website. Some of this is personal information about your employees, clients and contacts.

Signup attribution

If you arrive at our website from a campaign link or an external referrer, a first-party cookie named sb_attr records the campaign parameters, the referring site's hostname, the landing path and the time. If you later start a trial, that record is stored on your account so we know which channel brought you to us. It is not updated afterwards.

Technical and diagnostic data

When you use the Service we receive your IP address, browser and device type, the pages and requests you make, timing and error information. This flows into Azure Application Insights, which we use to keep the Service running and to diagnose problems. Diagnostic logs can include your email address, your user identifier and your company's tenant identifier.

Website analytics

www.sbassistant.com uses Google Analytics to measure site traffic in aggregate. The apps do not use Google Analytics. See "Cookies and analytics" below.

Communications

If you email us or submit the contact form on our website, we keep the message and your contact details so we can reply. Contact-form submissions from our own website land in our own SB CRM.

Hosted invoice and payment pages

SB Time Tracker lets a customer share an invoice through a hosted page that opens without a login. If you pay an invoice there, your payment is made to the customer through Stripe. The customer is the merchant; we record the payment status and amount against the invoice.

Public contact forms

SB CRM customers can embed a contact form, served from forms.sbassistant.com, on their own website. If you fill one in, your name, email, phone and message become a contact in that customer's CRM. Your IP address is used for bot protection (Cloudflare Turnstile) and rate limiting and is not stored with the contact.

How we use information

To provide, operate and secure the Service: sign you in, keep each customer's data separate from every other customer's, enforce roles and permissions, and keep an audit log of changes.
To bill for the Service: count seats, charge the account's card through Stripe and send receipts.
To send service messages: invitations, trial reminders (7, 3 and 1 days before a trial ends), a notice when a trial ends or an account changes status, approval and reminder notifications your company turns on, invoice and estimate emails your company sends to its clients, and security notices.
To answer support, sales and security requests.
To understand how the website and the Service are used, in aggregate, and improve them.
To detect abuse, protect our customers and users, and comply with law.

We do not sell personal information. We do not show advertising. We do not use Customer Data to train AI models.

AI features

Draft my week (SB Time Tracker). When this feature is available in your account, you can ask the app to propose a week of time entries. To generate the draft, the descriptions of your own recent time entries and the names of the projects you can log to are sent to Anthropic's API. Email addresses and phone numbers are removed from that text before it is sent. The suggestions are shown only to you, nothing is saved until you accept an entry, and the draft itself is not stored by us. Each company has a monthly usage ceiling.

Agent access (SB Project Management, Beta). A customer can connect its own AI tool, such as Claude Code or GitHub Copilot, to its projects using a revocable key. Whatever that tool reads from your projects is handled by that tool's provider under your agreement with that provider, not under this policy. Every action an agent takes is recorded in your audit log under the agent's own identity.

Who we share information with

We use the following service providers to run the Service. Each one only receives what it needs for the purpose listed.

Provider	Purpose	What it receives
Microsoft Azure	Hosting (App Service), database (Azure Cosmos DB), file storage (expense receipts, encryption keys), Key Vault (secrets), Application Insights (diagnostics). US regions.	All data stored or processed by the Service.
WorkOS	Sign-in at auth.sbassistant.com, including password policy, multi-factor authentication and breached-password checks.	Name, email address, sign-in session.
Stripe	Subscription billing for your SB Assistant account. For SB Time Tracker customers who turn on online payments, Stripe Connect lets your clients pay your invoices by card or ACH.	Billing email, seat count, card and bank details entered on Stripe's pages, payment amounts.
Azure Communication Services	Sending email from em.sbassistant.com.	Recipient address and message content.
Anthropic	Generating timesheet drafts when the Draft my week feature is available in your account.	Redacted time-entry descriptions and project names, as described above.
Cloudflare	Turnstile bot protection on public contact forms.	IP address and browser signals of the person filling in the form.
Google	Google Analytics and Google Fonts on www.sbassistant.com only.	IP address, browser information and pages viewed on the website.
Intuit QuickBooks Online	Only if you connect it from SB Time Tracker settings.	The customers, invoices and payments you choose to push.

We may also share information with professional advisers, when the law requires it or to protect rights and safety, and as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information. We do not share personal information for cross-context behavioral advertising.

Cookies and analytics

On www.sbassistant.com:

sb_attr: first-touch signup attribution, described above. Set only when you arrive from a campaign link or an external site. Lasts 90 days and is shared across *.sbassistant.com so it can be read when you start a trial.
Google Analytics cookies (_ga and _ga_*): used to measure traffic in aggregate. You can block them in your browser or install Google's opt-out browser add-on.

In the apps:

SbOidc (and its continuation cookies SbOidcC1 and so on): your signed-in session. Strictly necessary.
An antiforgery cookie set by the ASP.NET Core framework to protect forms against cross-site request forgery. Strictly necessary.

The apps set no analytics or advertising cookies. Our website and apps do not respond to browser "Do Not Track" or Global Privacy Control signals. We do not sell or share personal information regardless of those signals.

Where your information is stored

The Service is offered to businesses in the United States and is hosted on Microsoft Azure in US regions. Every record carries a tenant identifier and every query is scoped to it, so each customer's data is kept separate from every other customer's. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

Security

We protect information with technical and organizational measures that include:

TLS 1.2 or higher on every connection, and encryption at rest in Azure Cosmos DB.
Tenant isolation enforced at the data layer, and role-based access on every page and endpoint that touches customer data.
Sign-in delegated to WorkOS; we store no passwords.
Secrets kept in Azure Key Vault. Agent access keys are stored only as a SHA-256 hash.
An audit log of every meaningful change, per customer.
Our own operators cannot change data in your account; they get read-only oversight, and only after an audited, explicit switch into it.
Backups: Azure Cosmos DB takes geo-redundant snapshots of the database every four hours, retained for three days and replicated to a second US region. A restore is a database-level operation we request from Microsoft, not a per-customer rollback.

If we become aware of a breach affecting your information, we will notify the affected customers without undue delay. No system is perfectly secure. To report a vulnerability, email security@sbassistant.com. See Security for more detail.

How long we keep information

Active accounts: for as long as the account is active.
When a trial ends without a card: the account becomes read-only for 90 days, with its data intact. If no card is added in that time, the account is cancelled, and about 30 days after cancellation its data is automatically and permanently deleted from the apps.
When a paid subscription is cancelled: the account becomes read-only and follows the same schedule: cancelled after 90 days, deleted about 30 days later.
Records we must keep: invoices are kept for tax and accounting purposes, with the personal fields removed so they no longer identify anyone. Audit log entries are redacted rather than deleted, so a record that the deletion happened survives.
Legal hold: we may pause deletion when the law or a dispute requires it.
Sign-in and billing records: the automatic deletion covers the apps. Your sign-in identity at WorkOS and your billing records at Stripe are deleted on request, except for what tax, accounting or fraud-prevention rules require us to keep.
Diagnostic logs: kept for up to 90 days and then deleted automatically.
Backups: three days, as described above.
Attribution cookie: 90 days.

Your rights and choices

Wherever you live, you can ask us to access, correct, export or delete the personal information we hold about you. Account members can update their own profile in the apps. Account owners and administrators can export their data as CSV from the apps' list and report pages at any time.

US state privacy rights. If you are a resident of California or another US state with a consumer privacy law, you may have the right to know what personal information we collect and how we use and share it, to access it, to correct it, to delete it, to opt out of its sale or sharing for targeted advertising, and not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for targeted advertising, and we have not done so in the preceding 12 months, so there is no sale or sharing to opt out of. We do not collect sensitive personal information as defined by those laws beyond the account credentials that WorkOS handles for sign-in.

How to make a request. Email security@sbassistant.com from the address on your account, or tell us how to verify that you are the person the request is about. An authorized agent may submit a request on your behalf if they provide proof of your written permission. We will respond within 45 days. If we decline a request, we will tell you why, and you may ask us to reconsider.

If the information is Customer Data (for example, you are an employee or a client of one of our customers), the customer controls it. Please contact that customer. If you contact us instead, we will pass your request to the customer and help it respond.

Email. Service and billing messages are part of running your account. Reminder and notification emails can be adjusted in each app's settings. We do not send marketing newsletters.

Outside the United States. The Service is built for US businesses and is hosted in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland and use it anyway, your information will be transferred to and processed in the United States. Where the GDPR or UK GDPR applies, we rely on performance of a contract, our legitimate interests in running and securing the Service, and compliance with law as our legal bases, and you also have the right to object to or restrict processing and to lodge a complaint with your supervisory authority.

Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, email us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will post the new version here and update the date at the top. If a change materially reduces your rights, we will tell account owners by email before it takes effect.

Contact

Privacy questions and requests: security@sbassistant.com. FMLY Consulting, LLC, operator of SB Assistant.