Try the demo

Legal

Privacy Policy

Last updated October 21, 2026

This policy explains what information Twelfth Fret Music Co. LLC ("we", "us") collects through TFM Manufacturing (the "Service"), why, and the choices you have. We collect only what we need to run the Service, and we never sell your information.

1. Information we collect

  • Account details: your name, email address, password (stored only in hashed form by our sign-in provider) and two-step sign-in settings. If you sign in with Google, we receive your name and email address from Google.
  • Workspace data: what you and your team enter, such as materials, products, builds, orders and your customers' names, addresses and order details.
  • Billing: your plan and subscription status. Payments are handled by Stripe; we never see or store your full card number.
  • Integrations: if you connect QuickBooks Online, we store the connection tokens encrypted and a record of what was sent. API keys are stored only as secure hashes.
  • Activity records: an audit log of changes in your workspace (who, what, when), and logs of API requests and webhook deliveries, used for security, troubleshooting and integration monitoring.
  • Messages: what you send through our contact form or the demo's feedback button.

2. What we don't collect

We don't use advertising or tracking cookies, and we don't sell or rent personal information. We count page visits with Vercel Web Analytics, which uses no cookies and doesn't identify you. The free demo runs entirely in your browser: what you enter there stays on your device and is never sent to us, unless you choose to send feedback. Sign-in stores a session in your browser so you stay logged in, and connecting QuickBooks uses a short-lived security cookie.

3. How we use information

  • to provide the Service, including syncing with the website and accounting systems you connect;
  • to keep it secure: sign-in, roles, rate limits, fraud prevention and audit records;
  • to bill your subscription;
  • to send service emails, such as invitations, password resets, receipts and important notices about your account;
  • to answer your questions and support requests;
  • to meet legal obligations.

4. Your customers' information

When you store information about your own customers in the Service, you decide what is collected and how it is used, and we process it only on your behalf to run the Service. Requests from your customers about their data should go to you; we will help you respond.

5. Service providers

We use trusted providers to run the Service, each only for its own task:

  • Supabase: database and sign-in;
  • Vercel: website and application hosting;
  • Stripe: payments and subscriptions;
  • Intuit: QuickBooks Online, only if you connect it;
  • Google: sign-in, only if you choose "Continue with Google";
  • an email delivery provider, for service emails and contact-form messages.

We may also share information if the law requires it, to protect the rights and safety of our customers or the Service, or as part of a sale or merger of the business, in which case this policy continues to apply.

6. How long we keep information

Workspace data is kept while your account exists, including after cancellation so you can still sign in and export it. API request logs and webhook delivery records are deleted after 30 days. Expired invitations are removed automatically.

You can ask us to delete your account or workspace at any time. We will delete it within 30 days, except records we must keep by law (for example, billing records). Backups are overwritten on a rolling schedule.

7. Security

Each company's data is kept separate by rules enforced in the database and tested automatically. Connections are encrypted, QuickBooks credentials are encrypted at rest, API keys are stored as hashes, and workspaces can require two-step sign-in. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

8. Your choices and rights

You can see and correct your workspace data in the app and export it at any time. You can ask us for a copy of your personal information, or ask us to correct or delete it, through the contact page. Depending on where you live (for example California, or the EU and UK), you may have further rights, and we will honor them.

9. Children

The Service is for businesses and is not meant for children under 16. We do not knowingly collect information from them.

10. Where information is stored

The Service is run from the United States. If you use it from elsewhere, your information is transferred to and stored in the United States.

11. Changes to this policy

If we change this policy in a significant way, we will tell account owners by email or in the app before the change takes effect. The date at the top shows when it was last updated.

12. Contact

Questions or requests about your privacy? Send us a message through the contact page.

Contact us