Privacy Policy

Account deletion

You can ask us to delete your Squid ERP account, or (if you are the tenant owner or administrator) your company’s whole tenant, at any time. You do not need the app to do this. We complete deletion within 45 days of a verified request and confirm to you when it is done.

1. Who we are

SquidERP (“SquidERP,” “we,” “us,” or “our”) provides a cloud-hosted ERP, order-management, and operations platform. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to our marketing site, customer portal, hosted tenant subdomains (*.squiderp.net), any SMS messages we send, and the Squid ERP mobile apps for Android and iOS, which are published by SQUID ERP (the developer name shown in the app store listing).

Our customers are businesses. Each customer has its own workspace (a “tenant”). The Squid ERP app is a companion to that workspace: you can only sign in with a user account that your company has set up for you. For the business records stored in a tenant, the company that owns the tenant decides what is collected and how it is used, and we process those records on its behalf. We may refer questions about those records to your company’s administrator.

2. Information we collect

We collect only the information needed to operate the service:

• Account information— name, business name, work email address, mobile phone number, and role. Sign-in to the customer portal is handled by Google Firebase Authentication, either with an email address and password or with your Google account. Portal passwords are processed by Firebase and are not stored by us in readable form. In the mobile app, your password is sent to your company’s workspace server to sign you in, and the app does not keep it (see section 3.2).
• Temporary owner password— when a new tenant is created, we generate a temporary password for the owner account. It is shown once on the setup page and included in the setup confirmation email so the owner can sign in for the first time, and it is removed from our provisioning records when you confirm on the setup page that you have saved it. Please change it after your first sign-in.
• Billing information— billing name and address, billing contact email, and the plan you purchase. Your card number and security code are entered into secure fields hosted by our payment processor, Sola Payments (Cardknox), and are converted into tokens before they reach us. We keep the processor’s customer, payment-method, and recurring schedule references, a payment token that lets the processor charge your stored card for renewals and add-ons you approve, and the amount, date, result, and reference number of each charge. We do not store full card numbers or card security codes.
• Operational data you enter— customers, orders, inventory, invoices, and similar records you create inside your tenant.
• Technical data— IP address, browser type, device information, pages visited, and timestamps, collected via cookies and standard server logs for security and troubleshooting. We record the IP address and browser of security-relevant actions in an audit log.

3. Mobile application data

This section describes the Squid ERP apps for Android and iOS. Unless stated otherwise, what you enter or attach in the app is sent over an encrypted (HTTPS) connection to your company’s SquidERP workspace server, which we operate for your company, and is stored there.

3.1 Mobile app data at a glance

Plain-language summary. “Shared” means given to another company for its own use; data handled by our service providers on our behalf is not counted as shared.

We do not sell personal data, and we do not share it for third-party advertising. The app contains no advertising.

3.2 Account, sign-in, and workspace

• You tell the app which workspace to use by typing your company’s workspace name or by opening a workspace link your company sends you.
• Email and password: your email address and password are sent to your company’s workspace server to sign you in. If your company uses two-factor authentication, a one-time code is also exchanged. The app does not save your password.
• Google or Microsoft 365 sign-in (optional): if your company enables it, the app opens your device’s browser to sign in with Google or Microsoft through our sign-in service. We receive an identity token that confirms your email address, and we use it only to match you to an existing user in your company’s workspace.
• After sign-in, the workspace issues a session token that the app keeps on your device so you stay signed in.
• The app does not create accounts. Your company’s administrator creates and removes user accounts. To delete an account, see Account deletion.

3.3 Business data

The app shows and updates your company’s ERP records: customers and their contact details and addresses, orders, picking and receiving, inventory, deliveries and routes, invoices, and payments. These records belong to your company.

3.4 Photos, videos, files, signatures, and barcodes

• Photos and videos you take in the app, images you choose from your photo library, and files you choose are uploaded to your company’s workspace as attachments. If your company turns on the setting, photos you take in the app are also saved to your device’s photo gallery.
• Signatures you capture (for example, on a delivery) are uploaded as an attachment to the record.
• When you scan a barcode, the app uses only the scanned value to look up items, orders, or locations.
• Each uploaded file carries a short technical note with the app version, your device’s operating-system version and make and model, the file size, and whether you were on Wi-Fi, to help with support.

3.5 Device permissions

Permissions are requested through your device’s standard permission prompts. You can refuse or withdraw a permission in your device settings; only that feature stops working.

• Camera (Android and iOS) — to take photos and videos for attachments and to scan barcodes.
• Photos and media (Android and iOS) — to choose existing images to attach and to save photos taken in the app.
• Microphone (iOS only) — iOS asks for it when you record a video attachment, so the video can include sound. The Android app does not request the microphone permission: video recording there is handled by your device’s camera app. The app does not make separate audio recordings.
• Bluetooth (Android only) — to find and connect to supported label and receipt printers. Android requires the location permission for scanning for nearby Bluetooth devices, so the app may ask for it for this purpose only. The app does not read or store your location.
• NFC (Android only) — to read a contactless payment card that is tapped on the device, to fill the card number and expiry date into the payment form.
• Network access and vibration— to communicate with your workspace, detect when you are offline, and give feedback when you scan.

3.6 Maps and location

The delivery-route map shows stops at map positions that your company’s workspace calculates from customer addresses. The map itself is displayed by Google Maps, which receives the requests needed to draw the map. The app does not collect your device’s location on Android or iOS and does not show your position on the map. The iOS app’s configuration includes a description for the location permission, but the app does not request or use your device location.

3.7 Payments taken in the app

If your company uses this feature, you can take a payment from one of your company’s customers by entering card or bank account details or, on Android, by tapping a contactless card on the device. These details are sent over an encrypted connection to your company’s workspace, which passes them to the payment processor your company has chosen to complete the payment. The app does not save card numbers or security codes on the device. Payments made in the app are your company’s transactions with its customers; SquidERP does not sell anything to you through the app.

3.8 Diagnostics and analytics

• Crash reporting: released versions of the app use Google Firebase Crashlytics to send crash and error reports (error details, device model, operating-system and app version, and a Crashlytics installation identifier), together with the address of the workspace you were connected to and whether offline mode was on. We do not add your name or email address to crash reports.
• Analytics (Android only): the Android app includes Google Analytics for Firebase, which can automatically record app usage events (for example, first open and app sessions), an app-instance identifier, and device information. We use it only to understand app stability and usage, not for advertising. The iOS app does not include Google Analytics.
• Error reports you send: if you use the app’s option to send an error report, the app uploads its log file and a copy of its local data cache to your company’s workspace so our support team can investigate.
• Other checks: the app checks the app store for newer versions and briefly contacts public internet services to test whether the device is online. No account data is sent in these checks.
• The app does not use the advertising ID and contains no advertising or third-party tracking software.

3.9 Data stored on your device

To work offline and stay signed in, the app keeps a local copy of some business data (for example customers, items, orders, and uploads that have not been sent yet) and keeps your session token, email address, username, and workspace name in its app settings. Your password is not stored. This data is kept in the app’s private storage, which the operating system protects from other apps; the app does not add its own encryption, so please protect your device with a screen lock. Uninstalling the app removes this data from the device.

3.10 Service providers used by the app

Google (Firebase Crashlytics, Google Analytics for Firebase on Android, Google Maps, and optional Google sign-in), Microsoft (optional Microsoft 365 sign-in), Google Play and the Apple App Store (app distribution and updates), the payment processor your company chooses (for payments taken in the app), and our cloud hosting and infrastructure providers.

4. SMS / text messaging

SquidERP sends transactional SMS messages to users and customers of our hosted ERP / order-management platform. Messages include user-invitation links to accept access to a tenant, one-time verification codes for two-factor authentication, and order / shipment status updates that tenant administrators configure for their customers. We do not send marketing or promotional content over SMS.

Call to Action / how users opt in. A mobile phone number is only added to a SquidERP account when one of the following happens, and in each case the person providing the number is shown the consent disclosure below before any SMS is sent:

• Administrator-added user. A tenant administrator adds the user from inside their SquidERP tenant and enters the user’s mobile number. The administrator must confirm that the user has agreed to receive transactional SMS (account invitations, verification codes, account-security alerts) before the record can be saved. The user then receives the invitation SMS containing a single-use accept-invite link.
• Customer-provided number for order updates. An end customer of a SquidERP tenant submits their phone number at checkout or order entry, on a form operated by that tenant. The form displays the consent disclosure below and requires the customer to confirm before the order can be submitted.
• User-enabled two-factor authentication. A signed-in user enables SMS-based two-factor authentication from their account settings and enters and verifies their mobile number. The consent disclosure below is shown on the same screen and the user must verify the number with a code before SMS 2FA is activated.

Consent disclosure shown at each opt-in point:

By providing your phone number, you agree to receive transactional SMS messages from SquidERP related to account access, verification codes, invitations, and order updates. Message frequency varies. Msg & data rates may apply. Reply HELP for help, STOP to cancel.

• Program name: SquidERP Notifications.
• Message types:account invitations, one-time verification / 2FA codes, password & account-security notifications, and order or shipment updates.
• Message frequency is not fixed and varies based on your account activity (for example, each invitation, each 2FA-triggered sign-in, and each order or shipment event configured by the tenant administrator).
• Message and data rates may apply from your mobile carrier.
• Reply HELP to any message for assistance, or email hello@squiderp.com.
• Reply STOP to any message to opt out. After STOP you will receive one final confirmation message and no further SMS. To resume, sign in and re-enter your mobile number, or reply START.
• Carriers are not liable for delayed or undelivered messages.
• No mobile information is sold or shared with third parties or affiliates for marketing or promotional purposes. Mobile phone numbers and SMS opt-in data are not shared with third parties for marketing under any circumstances.

5. How we use information

We use the information above to:

• Provision and operate your tenant and user accounts.
• Authenticate sign-ins, including sending two-factor authentication codes by SMS or email when enabled.
• Provide the features of the website, portal, and mobile app that you and your company use.
• Send transactional notifications you or your administrators request — user invitations, order updates, shipment notifications, password and verification messages, and similar service communications.
• Process payments, prevent fraud, and bill for usage.
• Provide support, investigate incidents, diagnose crashes, and improve reliability and security of the service.
• Comply with legal obligations.

We do not sell personal data, and we do not use or share it for third-party advertising.

6. How we share information

We do not sell personal information and we do not share it for third-party marketing or advertising. We share information only with:

• Service providers acting on our behalf under written agreements — cloud hosting and infrastructure providers (including Vercel, which hosts this portal, Neon, which hosts its database, and Upstash, which runs its job queue), Google Firebase (sign-in, crash reporting, and analytics in the Android app), Google Maps, Microsoft (optional Microsoft 365 sign-in), email delivery (Resend), SMS delivery providers, payment processing (Sola Payments / Cardknox for SquidERP subscriptions), and the build, deployment, and secrets-management tools we use to set up and run your workspace. These providers may only use the information to deliver the service to us.
• Payment processors chosen by your company— when you take a payment in the mobile app, to complete that payment.
• Your administrators— the organization that owns your tenant can view and manage data within that tenant.
• Legal authorities when required by law, subpoena, or to protect rights, safety, or property.
• Successors in the event of a merger, acquisition, or sale of assets, subject to this Policy.

7. Data retention and deletion

We retain account and operational data for as long as your subscription is active and for a reasonable period thereafter to meet legal, tax, and audit requirements. When a subscription ends, we keep the tenant’s data for a limited grace period so that it can be restored or exported, and then delete the workspace. The tenant owner can ask us to delete it sooner.

You can ask us to delete your account or your company’s tenant at any time by following the steps on our Account deletion page. We complete deletion within 45 days of a verified request and tell you when it is done, including any records we must keep (for example, billing and tax records) and why. Data on your device is removed when you uninstall the app. You may also request an export of your data by emailing hello@squiderp.com.

8. Security

We use TLS (HTTPS) to encrypt data in transit between your browser or the mobile app and our servers, role-based access control, network isolation between tenants, and routine backups. Payment card numbers for SquidERP subscriptions are handled by our payment processor rather than stored by us. Data the mobile app keeps on your device relies on the operating system’s app protection (see section 3.9). No system is perfectly secure; we encourage strong passwords, enabling two-factor authentication, and using a screen lock on your device.

9. Your choices and rights

Depending on where you live, you may have the right to access, correct, or delete your personal information, to object to processing, or to receive a portable copy. You can exercise these rights by emailing hello@squiderp.com from the address on your account. You can also unsubscribe from SMS at any time by replying STOP, and you can withdraw a mobile app permission at any time in your device settings. If your request concerns business records your company controls, we may refer it to your company’s administrator.

10. International users

Our servers are operated in the United States and the European Union. By using the service you understand that information may be processed in countries different from your own.

11. Children

SquidERP and the Squid ERP app are business tools intended for use by employees of our customers. They are not directed to children, and we do not knowingly collect personal information from children.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the new effective date at the top of this page, and material changes will be announced to account administrators by email.

13. Contact

Questions about this Policy can be sent to hello@squiderp.com. The Squid ERP app is published by SQUID ERP.