Privacy Policy

_Effective October 14, 2026._

This policy explains how the Ruff Life Business Hub ("the Hub", www.rufflifehub.com), the private internal portal of Ruff Life Dog Bones, handles information. The Hub is used only by people the owners invite.

Information the Hub keeps

• Accounts: name, email address, role, whether the account is active, and sign-in security settings (Supabase Auth). Passwords are handled by Supabase Auth and are never visible to the business.
• Activity history: who did what and when (for example a request, an approval or a filing). It can't be edited or deleted, so it is kept for as long as the Hub runs.
• Requests and approvals: what was proposed and who decided it.
• AI assistant conversations: messages are stored for the person who wrote them and sent to Anthropic's API to produce answers. Usage costs are recorded. Stored messages can't be edited.
• Documents sent for approval: the file itself (temporarily, see below) plus its name, type, size, a fingerprint (SHA-256) used to stop duplicates, the chosen folder, and, once filed, the Google Drive file ID and link.
• Cookies: only the sign-in session cookies needed to keep you signed in, and a short-lived cookie during Google sign-in. No advertising or analytics cookies.

Google user data

When an owner connects Google Drive, the Hub requests only these permissions:

• openid and email: to know which Google account was connected (its email address is shown to owners).
• https://www.googleapis.com/auth/drive.file: to create new files in folders the owner picks with Google's folder picker, and to find files the Hub itself created.

With this access the Hub can't read, list, change, move, share or delete any other file or folder in the Drive. The Hub uses Google data only to file the business's approved documents into the owner's Drive and to show where they were filed.

Tokens: Google gives the Hub a refresh token. It is encrypted (AES-256-GCM) and stored on the server only; it is never shown in the Hub or sent to a browser. Short-lived access tokens are created when needed and not stored; when an owner chooses a folder, one is given to Google's folder picker in that owner's browser.

Sharing: Google user data is not sold, not used for advertising, not shared with anyone outside the business, and not sent to AI services. The Hub's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Files waiting for approval

An uploaded file is kept in private storage (Supabase Storage, no public links) until it is decided:

• Approved and filed: the private copy is deleted once Google confirms the file was created in Drive.
• Rejected or withdrawn: the private copy is deleted.
• Filing failed: the copy is kept so an owner can try again.
• Picked but never sent: cleared after a day, the next time that person uploads.

Files filed in Google Drive stay there under the owners' control; the Hub never deletes them.

Removing Google access

An owner can disconnect at any time in Admin settings → Connections → Disconnect. The Hub asks Google to revoke its access and deletes the stored token. Access can also be removed in your Google Account under Security → Third-party apps & services. Files already in Drive are not affected. Google may also end access on its own (for example after long inactivity); the Hub then asks an owner to connect again.

Where data is processed

The Hub runs on Vercel and stores its data with Supabase (United States). AI answers are produced by Anthropic. Google Drive and Google Sheets data stays in Google's services and is read or written only as described here.

Your choices

Invited users can ask the owners to correct their account details or to switch their account off. Because the activity history is a permanent business record, entries in it are not removed.

Changes

If this policy changes, the new version is posted here with a new effective date.

Contact

Questions about this policy or your data: contact the Ruff Life Dog Bones owners.