Privacy Policy
Effective date: April 30, 2026
This Privacy Policy describes how Cephus Business Consulting Inc. (“CBC,” “we,” “us,” or “our”) collects, uses, and protects information in connection with CBC SaaS (the “Platform”), our software-as-a-service product for local service businesses.
CBC SaaS has two distinct user groups, and this policy covers both:
- Tenants — businesses who sign up for an account on cbcsaas.com to operate a lead funnel and CRM.
- End users — homeowners and consumers who interact with a tenant's funnel (typically a subdomain like tenant-name.cbcsaas.com) to request a service estimate. Data submitted there is collected by the tenant; CBC processes it on the tenant's behalf — see the Data Processing Agreement.
1. Information We Collect From Tenants
When you create or use a CBC SaaS account, we collect:
- Account details: business name, contact name, email address, phone number, business address, business type
- Authentication data: hashed passwords, session tokens, password-reset tokens
- Billing information: Stripe customer ID, subscription status, payment method metadata (card brand, last 4 digits — full card numbers are stored by Stripe, not by us)
- Configuration data: service catalog, pricing, photos, branding, schedule rules, email templates you upload or configure
- Audit data: logs of administrative actions, API calls, and ad-deploy events for security and dispute resolution
2. Information Automatically Collected
- IP address and device data: for security, rate limiting, and abuse prevention
- Usage analytics: page views and product interactions via PostHog
- Cookies: session cookies for authentication, tenant-resolution cookies, and analytics cookies
3. How We Use Information
- To operate and improve the Platform
- To authenticate your account and protect it from unauthorized access
- To process subscription billing through Stripe
- To send transactional emails (account, billing, security)
- To investigate fraud, security incidents, and Terms violations
- To meet legal and regulatory obligations
We do not sell your personal information. We do not use your data to train third-party AI models.
4. Subprocessors and Third-Party Services
CBC SaaS is built on the following providers. Each has its own privacy practices:
- Vercel — hosting and edge runtime
- Airtable — primary tenant and lead database
- Neon (Postgres) — ad-deploy audit log and dispute records
- Stripe — subscription billing and metered usage
- Resend — transactional email delivery
- Google (Calendar, Maps, OAuth) — calendar sync and address geocoding
- Meta (Facebook/Instagram Ads APIs) — when a tenant uses managed ads
- PostHog — product analytics
The full list with processing roles is in our Data Processing Agreement.
5. Data Retention
We retain account and configuration data for as long as your account is active. After account cancellation, we retain data for 30 days to allow recovery, then delete or anonymize it unless we're required to retain it for legal, tax, or audit purposes.
Aggregated, non-identifying analytics data may be retained indefinitely.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Object to or restrict certain processing activities
- Receive a copy of your data in a portable format
To exercise any of these rights, contact support@cbcsaas.com.
7. Cookies and Tracking
The Platform uses session cookies for authentication, a tenant-resolution cookie when an admin switches tenant context, and PostHog for anonymous product analytics. We do not use advertising cookies on cbcsaas.com or cross-site advertising trackers. Tenant funnels may run a Meta Pixel for retargeting if the tenant has configured one — that data is collected by Meta on the tenant's behalf, not by CBC.
8. Security
We use industry-standard security measures including encrypted connections (HTTPS), AES-256-GCM encryption for stored ad-platform tokens, hashed passwords, scoped access tokens for third-party integrations, and access controls on administrative systems. No method of transmission over the Internet is 100% secure, but we take reasonable steps to protect your data.
9. International Transfers
CBC operates from the United States. By using the Platform, you understand that your data may be processed in the United States and other countries where our subprocessors operate.
10. Children's Privacy
CBC SaaS is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-product notice at least 30 days before they take effect. Continued use of the Platform after changes take effect constitutes acceptance.
12. Contact Us
If you have questions about this Privacy Policy, contact us:
Cephus Business Consulting Inc.
Email: support@cbcsaas.com