Privacy Note
The short version
Pourline keeps each producer's orders walled off from every other producer's, collects as little as it can, and never sells or shares data. No ads, no tracking inside the product, no third-party analytics, and no AI is applied to customer data inside the product. If a producer connects QuickBooks Online, Pourline reads their customer and product lists and creates invoices only when they ask it to. Nothing else.
Who we are
Pourline is made and run by Mayrose Future Company Limited, a company registered in Ireland (company number 724698), whose registered office is at 11 Shandon Park, Monkstown, Co. Dublin, A94 R265. For anything in this note, including data protection, email enquiries@mayrosefc.com. The law doesn't require a service like ours to appoint a data protection officer, so we haven't; that address reaches the people responsible.
Whose data is it?
Pourline holds two kinds of information, and the law treats them differently.
- A producer's business records. Orders, the producer's customers and contractors, sites, drivers, trucks, prices and tickets. The producer decides why and how these are used, so the producer is the controller. We are the producer's processor: we hold and use these records only to run Pourline for that producer, under our Data Processing Terms.
- Our own records. The people at each producer who sign in, billing and support contacts, messages sent to us, and the security logs that keep the service safe. For these we are the controller, and this note explains how we use them.
If you are a contractor or a customer of a producer, the producer you deal with is responsible for your information. Contact them first; we'll help them answer.
Where data lives
We keep each producer's records in its own region: the United States (Ohio) for US producers, and the European Union (Ireland) for Irish and UK producers. The databases are provided by Supabase. Each producer's records are kept apart from every other producer's by the database's own rules, and automated tests check that wall every time the software changes. Pourline's web pages are served by Netlify; your browser talks to the database directly over an encrypted connection, so order records don't pass through the web host.
Producers who started on an earlier version of Pourline may still have their records in spreadsheets in their own Google account, run by Google Apps Script, until they move to the current version. For them the earlier arrangement applies: the records stay in the producer's own Google account, which the producer owns and can open at any time, and we access them only to run the service. We tell each of those producers before their move.
What we collect
From producers and their staff: names, work email addresses and phone numbers of the people who use Pourline; plant, truck and driver details; and the order, customer, site and price records the business creates.
About contractors and customers, as entered by the producer or placed through Pourline: name, company, contact details, site address and site contact, and the details of each order. This information is for the producer fulfilling the order; that is the point of the service.
When you sign in: your work email address and a record of each sign-in (time and browser), kept for security.
Previews: Our previews tell us when they are opened: which preview, the day and time, the board or the plant screen, and phone or computer. We don't keep your IP address, and nothing is stored on your device. We keep this for 90 days.
Technical: our providers keep standard server logs (IP address, browser type, time of request) for security and troubleshooting.
Pourline sets no advertising or tracking cookies and uses no third-party analytics. It keeps three small things in your browser, all needed for it to work: your sign-in session, which yard you last opened, and who is taking calls on that computer. None of them is used to track you. Pourline's pages load their fonts and code from Pourline itself, not from third-party services.
Why we use it
- To run Pourline for the producer, under our contract with them (GDPR Article 6(1)(b)). For a producer's business records we act only on the producer's instructions.
- To keep the service secure, prevent misuse, give support and improve the service, in our legitimate interests (Article 6(1)(f)). You can object to this; see Your rights.
- To keep accounting and tax records and answer lawful requests, where the law requires it (Article 6(1)(c)).
We don't make decisions about people by automated means.
QuickBooks Online connection
A producer may choose to connect Pourline to their QuickBooks Online company. This is optional, started by the producer's own QuickBooks administrator, and can be undone at any time.
What Pourline reads from QuickBooks: the producer's customer list (names, company names, billing contact details, billing addresses, balances) and the producer's product and service items (names, descriptions, prices). Pourline reads these so that the producer's order screen matches their QuickBooks records and invoices land against the right customer.
What Pourline writes to QuickBooks: an invoice for a delivered order, only when a producer user confirms that order. Pourline may also create a customer in QuickBooks, but only when a producer user explicitly asks it to. Pourline never sends, emails, edits, voids or deletes invoices, and never records payments.
What Pourline never accesses in QuickBooks: payments, banking, payroll, bank feeds, reports, or any data beyond the customer, item and invoice records above. Pourline asks only for QuickBooks' accounting permission.
How the connection is kept: Intuit issues connection keys when the producer authorises Pourline. Pourline keeps them in the producer's own region's database, in a part that no user, browser or web page can reach; only Pourline's own server uses them, and only for that producer. The customer and product lists Pourline reads are kept with that producer's records.
Disconnecting: the producer can disconnect from within QuickBooks (Apps, then Connected apps), from Pourline, or by emailing enquiries@mayrosefc.com, and we act on it straight away. On disconnect, Pourline deletes the connection keys at once, stops all reading and writing, and deletes its copy of the producer's QuickBooks customer and product lists. The links between the producer's Pourline customers and their QuickBooks customers stay with the producer's records, so reconnecting the same company works; they are deleted with the producer's other records when the producer leaves.
Use of QuickBooks itself is governed by Intuit's own terms and privacy policy.
Other business systems
A producer may connect Pourline to another business or accounting system it already uses. The same rules apply: only the producer's administrator can switch the connection on, Pourline exchanges only the records needed to take, deliver and invoice orders, and the producer can switch it off at any time. That system's own provider handles the data under its own agreement with the producer.
Who else handles the data
We use a small number of providers to run Pourline. They handle data only to provide their service to us, under written data processing terms:
| Provider | What for | Where |
|---|---|---|
| Supabase | The database that holds producers' records; sign-in and sign-in emails | United States (Ohio) for US producers; European Union (Ireland) for Irish and UK producers. Supabase Inc. is a US company |
| Netlify | Serving Pourline's web pages (order records don't pass through it) | United States, with a worldwide delivery network |
| Resend | Sending sign-in codes and Pourline's own service emails | United States |
| Google (Workspace, Sheets, Apps Script, Gmail) | Only for producers still on the earlier version of Pourline: their records in their own Google account, and service emails | United States and European Union |
Intuit (QuickBooks Online) and any other system a producer connects are chosen and controlled by the producer, not by us. We tell producers before we add or replace a provider; the current list is always here and in our Data Processing Terms.
We do not sell personal information and we do not share it for advertising. We do not use customer data to train any AI model, and we don't put producers' customer or contractor details into AI tools. We disclose data only if the law requires it, and we tell the producer unless the law forbids us.
Transfers outside the EU
We keep each producer's records in its own region: the United States (Ohio) for US producers, and the European Union (Ireland) for Irish and UK producers. Where a provider outside the EU or UK (such as Supabase Inc. or Netlify in the United States) can reach personal data, the transfer is covered by the European Commission's Standard Contractual Clauses, or by the EU-US Data Privacy Framework where the provider is certified, with the UK addendum for UK data. Ask us for a copy of the safeguards that apply.
How we protect it
- Encrypted in transit (HTTPS) everywhere, and encrypted at rest in the database.
- Each producer's records are walled off from every other producer's by the database's own rules, checked by automated tests on every change.
- Only a producer's own people can sign in to its yard. Deleting records is limited to the producer's administrator, and every change to an order is logged with who made it.
- The accounts that run Pourline (database, hosting and code) are protected with two-step sign-in.
- Connection keys are held on the server, never in the browser or in page code.
- Pourline doesn't collect or store card or bank details.
- If a security incident affects a producer's data, we tell that producer without undue delay, with what we know, so they can meet their own duty to report it (within 72 hours where the law requires).
How long we keep it
- Producer records: for as long as the producer uses Pourline. When a producer leaves, we give them an export of their records on request and delete the records from Pourline within 30 days; backup copies are overwritten within a further 30 days. Invoices already sent to the producer's accounting system stay there, under the producer's control.
- Sign-in accounts: deleted when the producer removes the person, or with the producer's records.
- Our own billing and contract records: for as long as Irish tax law requires (currently six years).
- Server logs: kept by our providers for a limited period for security, then deleted.
Your rights
Under the GDPR and the UK GDPR you can ask to see, correct, delete or export your personal data, to restrict how it is used, and to object to processing based on our legitimate interests. Email enquiries@mayrosefc.com and a person will answer within one month. Where your data is in a producer's records, we pass your request to that producer and help them answer.
You can also complain to a data protection authority: in Ireland, the Data Protection Commission (dataprotection.ie); in the UK, the Information Commissioner's Office; or the authority where you live or work.
In the United States we act as a service provider to producers. Residents of states with privacy laws have the rights those laws give, and we help producers honour them.
Children
Pourline is a business tool for adults at work. It is not directed at anyone under 18.
Pourline sends only the emails the service needs: sign-in codes and, where a producer switches them on, order alerts, quotes and confirmations, plus notices about the service. No marketing lists.
Changes
If this note changes in a way that matters, we tell producers by email before the change takes effect, and update the date at the top.
Questions
Email enquiries@mayrosefc.com and a person will answer.