Privacy Policy

Effective date: September 29, 2026 (previous version: September 24, 2026)

This Privacy Policy explains how Fireworks Effect AI, LLC ("Fireworks", "we", "us") collects, uses, and shares information when you use Fireworks for Square and the websites at fireworkseffect.com and app.fireworkseffect.com.

What we collect

• Account data: Square merchant identifier, business name, email address, and encrypted Square OAuth tokens.
• Contact details you give us: If you ask us to email you a link, on our website or in a form in one of our ads on Instagram or Facebook, we store the email address you give us and which advertisement you arrived from and whether you open or click the emails we send you about it. You are not creating an account, and you can ask us to delete it at any time.
• Usage events: Product analytics events (pageviews, clicks, feature usage).
• Session recordings: We record a sample of app sessions for debugging and product-quality purposes. All input fields are masked; we never capture what you type.
• IP address and device data: Standard web request metadata: IP, user agent, timezone, referrer.
• Cookies: Used for analytics stitching across subdomains, and for advertising measurement on the marketing site. You can turn them off on Your privacy choices.
• Content you upload: Vendor invoices, images, and CSV files you submit. These are stored in our AWS infrastructure and processed by our AI extraction pipeline.

Who we share with

We share data only with the service providers that run Fireworks:

• Amazon Web Services (AWS): hosting, storage (S3), compute (Lambda), database (DynamoDB), email (SES). Data stays in us-east-1.
• PostHog: product analytics and session recording. Hosted in the United States.
• HubSpot: our contact list. If you give us your email address, on our website or in a form in one of our ads on Instagram or Facebook, we keep it in HubSpot with a short record of your steps with us: which of our emails you opened or clicked, whether you booked a call, and, if you go on to use Fireworks, when you connected Square, started your trial and first paid. We use it only so a person at Fireworks can follow up with you. It never includes your catalog, inventory, prices, invoices, or anything else from your Square account. If you book a call through our scheduling page, HubSpot also receives the name, email and meeting details you enter.
• Stripe: subscription billing and payment processing. We never store your full card number; Stripe tokenizes it.
• Anthropic: vendor document extraction via the Claude API. Uploaded document contents are sent to Anthropic for extraction but are not used to train their models.
• Meta and Google: advertising on the marketing site. Advertising pixels run unless you turn them off on Your privacy choices or your browser sends a Global Privacy Control signal. Separately, our servers report to Meta when an advertising click led to a sign-up, using only Meta's own click identifier. Both are described under Advertising below.
• Square: we exchange data with Square's Catalog, Inventory, and Orders APIs on your behalf, using the OAuth scopes you granted.

We do not sell your data. Apart from an email address you type into a form in one of our ads, which Meta receives because the form is Meta's, the only information that reaches an advertising company is the limited set of signals described under Advertising below.

Data retention

• Active accounts: data is retained for as long as your account is active.
• Cancelled accounts: data is retained for 180 days after cancellation, then deleted.
• Feedback submissions: retained for 90 days.
• Contact details from the marketing site: retained for 12 months, then deleted, unless you become a customer.
• Your contact record and follow-up history in HubSpot: kept until you ask us to delete them.
• Session recordings: retained for 30 days.
• You can request earlier deletion at any time by emailing support@fireworkseffect.com.

Cookies

The marketing site at fireworkseffect.com sets analytics and advertising cookies when you visit. You can turn them off at any time on Your privacy choices, and if your browser sends a Global Privacy Control signal we honour it automatically without your having to ask. Cookies are scoped to .fireworkseffect.com so we can stitch your marketing-site visit to your in-app activity with a consistent analytics ID.

Advertising

To find out whether our advertising works, the marketing site at fireworkseffect.com may load advertising pixels from Meta (Facebook and Instagram) and Google (Google Ads). They load when you visit, unless you have turned them off on Your privacy choices or your browser sends a Global Privacy Control signal. When they run, they can receive the pages you visit on the marketing site, an advertising click identifier if you arrived from one of our ads, and a conversion event when you connect a Square account, matched to that click identifier. They never receive the documents you upload, your catalog, your inventory, your prices, or anything from your Square account. Meta and Google may use these signals to show you our ads elsewhere. You can turn this off at any time on Your privacy choices, which takes effect immediately in that browser.

Separately from those pixels, and whether or not you accept cookies, our own servers may tell Meta that an advertising click led to a sign-up or an enquiry, for example when you ask us to email you a link, or when you connect a Square account. That report contains only the click identifier Meta placed on the link you followed. It carries no name, no email address, and nothing else about you or your business. We do this so we can tell which of our advertisements work.

Email tracking

Transactional and notification emails sent via AWS SES include open and click tracking for product-improvement purposes (for example, to confirm that order-confirmation emails are reaching you). Unsubscribe links are included where applicable.

Security

Square OAuth tokens are encrypted at rest using AWS KMS. Data in transit is encrypted via TLS. Access to production systems is restricted to the Fireworks engineering team and logged.

Your rights

You can request access to, correction of, or deletion of your personal data at any time by emailing support@fireworkseffect.com. California residents: you have the rights described in the CCPA/CPRA, including the right to opt out of the sharing of personal information for cross-context behavioural advertising, which you can exercise on Your privacy choices or by sending a Global Privacy Control signal from your browser. EU/UK residents: you have the rights described in the GDPR/UK GDPR.

Changes

We may update this policy from time to time. Material changes will be announced by email or in-app notice before they take effect.

Contact

Fireworks Effect AI, LLC
support@fireworkseffect.com