Privacy Policy

Hull is an AI finance operations tool for small ecommerce businesses. It connects to the accounting and commerce platforms you already use, reads the bills and records you give it, and answers questions about your costs and margins.

The service is operated by Hull Technologies, Inc.. For anything in this policy, contact us at clayton@hull.tools.

This policy covers the Hull application. It does not cover QuickBooks, Shopify, or any other service you connect — those remain governed by their own privacy policies and your agreements with them.

Two roles are worth separating. For your own account and workspace data, we are the controller. For the business records we read out of your connected accounts on your instruction, including your Shopify store data, we are your processor: you decide what we may access, and we process it only to give you the functionality described below.

Everything below is data you give us or that we retrieve on your instruction. We do not buy data about you, and we do not track you across other websites.

Account and sign-in

Your name, email address, and a hashed password (we never store the password itself). If you sign in through a third-party provider, we store the access tokens that provider issues us. We also record your profile image URL if you set one, and whether your email has been verified.

Session and technical

When you sign in we store a session token, the IP address, and the browser user-agent string of the session, plus timestamps. This is how sessions expire and how you can tell an unfamiliar sign-in from your own. We use only the cookies needed to keep you signed in, plus a short-lived one for platform administrators. No analytics or advertising cookies.

Your company workspace

The company name, legal name, timezone, and the people you invite, along with their email addresses and roles.

Data from accounts you connect

When you connect QuickBooks, we read bills, vendors, items, the chart of accounts, expenses, and bill payments. When you connect Shopify, we read products and variants (titles, SKU codes, prices, images), inventory levels, orders and their line items, payouts, and balance transactions. Connections are read-only — Hull never writes to your accounting platform or your store. What an order tells us about the customer is covered in the next section.

Documents you upload

Supplier bills, invoices, bills of materials, rate cards, and loan documents. We store the file itself along with its filename, file type, size, a SHA-256 checksum, page count, and which user uploaded it. These documents routinely contain business information, and can contain personal information where your suppliers put it there — a contact name on an invoice, for example.

What we derive

The line items, cost classifications, product mappings, cost layers, allocation rules, projections, debt facilities, certifications, and trade classifications that Hull builds from the above.

Operational records

An audit log of significant actions — who did what, when, the old and new value, whether AI suggested it, and whether a human approved it. AI usage metering (token counts, which model ran, an estimated cost). And error diagnostics through our monitoring provider, sampled, to find and fix faults.

Hull exists to tell you what a unit costs and what it earns. That calculation runs on orders, line items, and settlement records. It does not run on the identity of the person who placed the order, so we ask Shopify for as little of that as the math allows.

What we request

From the Shopify Admin API we read order-level records: the order's number, dates, and financial and fulfillment status; its totals — subtotal, discounts, tax, shipping, and total; the destination country and state or province; and each line item's product, SKU, quantity, and price. Separately, from Shopify Payments, we read payouts and balance transactions. Shopify classifies order data as protected customer data because an order can be linked back to the person who placed it. We use it for exactly one purpose: to compute landed cost, cost of goods sold, contribution margin, and revenue by product and variant, and to answer your questions about those numbers.

What we do not request

We do not request the protected customer fields — name, email address, phone number, or street address — and we do not request Shopify's customer records or customer identifiers at all. The only geography we keep is the destination country and state or province, used to allocate duties and shipping cost. We do not build customer profiles, we do not score or segment individuals, and we do not enrich store data against any outside source.

Consent

Hull performs no marketing, no advertising, no profiling, and no sale or sharing of personal information, so nothing it does depends on a customer's marketing consent, and there is no sale for a customer to opt out of. If a customer has exercised an opt-out with you, nothing Hull does with your data works against it.

Automated decisions

Hull does not use automated processing or AI to make decisions that produce legal or similarly significant effects about any individual. It classifies business costs and drafts records for a person to approve. If we ever introduce a feature that would, it will be off by default, we will describe it here before it ships, and it will carry a per-workspace opt-out.

Requests to see or delete customer data

Shopify sends us three compliance requests, and we act on all of them:

• A request to view a customer's data. Within 30 days we tell you what we hold that is linked to that customer — which, given the above, is order lines with no identifying fields — so you can answer them.
• A request to delete a customer's data. Within 30 days we delete or irreversibly anonymize anything linked to that customer.
• A request to delete your store's data, which Shopify sends 48 hours after you uninstall Hull. When it arrives we delete the orders, order lines, payouts, and balance transactions synced from that store. Your products, and the bills and costs you built in Hull, remain, because they are your records rather than Shopify's; delete the workspace to remove them.

Deletions propagate to backups as those backups age out, within 30 days of the deletion.

To run the service: read and classify your documents, sync your connected accounts, compute costs and margins, produce forecasts, and answer your questions. To operate accounts, memberships, and permissions. To keep the service secure and diagnose faults. To communicate with you about the service.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use your business data to advertise to you, and we do not use one customer's data to serve another. We do not use your data, or your store's customer data, to train any AI model, our own or anyone else's.

AI is central to how Hull works, so it is worth being specific about what that means.

What is sent to an AI model

When Hull reads a document, classifies a cost, suggests a product mapping, drafts a message to a supplier, or answers a question in the assistant, the relevant content is sent to a third-party AI provider for processing. That can include the contents of documents you upload and the business records in your workspace that are relevant to the request.

Which providers

Our default provider is Anthropic (Claude models). We also support Google's Gemini models, which are disabled by default and can be enabled per feature. We use paid API tiers under terms that do not permit the provider to train its models on the content we submit.

AI never has the last word

AI output is always a draft that a person approves. Extracted bills sit in a review queue; nothing becomes a final record in your workspace without someone explicitly approving it. Every figure Hull shows you names the document or record it came from, and where it cannot answer from real data it says so rather than estimating.

Scope

An AI request is scoped to the single company workspace you are working in. It cannot read another customer's data, and it cannot read another workspace of your own that you are not currently in.

Automated decisions

Hull does not use AI to make decisions that produce legal or similarly significant effects about any individual. It classifies business costs and drafts records for human approval.

We use the following providers to run the service. Each processes data only to provide their service to us, under a written agreement that holds them to confidentiality and security terms at least as protective as this policy.

We will update this list before adding a provider that handles your data, and account owners are notified by email when it changes.

Encryption

Data is encrypted in transit using TLS 1.2 or better, and at rest using AES-256 or equivalent, at both the database and object-storage layer. Database backups and snapshots are encrypted at rest with the same standard. Secrets and API credentials are held in the hosting platform's managed secret storage, never in source code.

Separation

Each company's data is isolated, and every read and write in the application is scoped to a single company. Local development runs against separate databases seeded with synthetic data; production data is not copied into them.

Preventing data from leaking

Uploaded documents are stored privately and served only through short-lived signed links to signed-in members of the company that owns them. They are never publicly accessible. Credentials for your connected accounts are held by a specialist provider rather than in our own database. Outbound AI requests carry only the records relevant to the request, scoped to one workspace. Application logs are configured to redact credentials, session cookies, and email addresses, and error reports are stripped of request headers, cookies, bodies, and user details before they reach our monitoring provider. We request the narrowest API scopes that deliver the functionality, and we review them when the product changes.

Access

Access within a company is role-based. On our side, access to production systems and to customer data is limited to the people who need it to operate or support the service, which today means one person, granted on a least-privilege basis and revoked when no longer needed. So that setup help needs nothing from you, that person's account is a read-only member of every workspace from the moment it is created. It appears in your Members list marked “Hull support”, every action it takes is recorded in your audit log under its own name, and an owner can remove it at any time; once removed it is not added back. Administrative accounts use unique credentials from a password manager, a minimum length of 16 characters with no reuse across services, and multi-factor authentication on every account that supports it.

Logging

Significant actions in the application are recorded in an audit log, kept for 24 months. Every opening of the platform administration console is recorded there too, with who and when.

If something goes wrong

We maintain a written security incident response policy covering detection, containment, assessment, notification, and post-incident review, and it is reviewed at least annually. No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you without undue delay and in any case within 72 hours of confirming it, with what we know about scope, cause, and remediation. Where the breach affects data we process for you as your processor, we will give you what you need to meet your own notification obligations.

Audits and certifications

Hull has not yet undergone a third-party security audit or certification. We will state it here when it does.

We keep data only as long as it serves the purpose it was collected for. Current retention periods:

When you delete a company, every record and document belonging to it is permanently removed. When you delete your account, your identity records are removed, and any company where you were the last remaining member is deleted with you.

Deleted data may persist in encrypted backups for up to 30 days before those backups age out. Aggregate, de-identified operational metrics that cannot be linked back to you may be retained.

You can access and correct most of your data directly in the app. You can delete your company or your account at any time from Settings → Company (company) or Settings → General (your account). You can disconnect any connected account at any time from Settings → Connectors.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and how we use it, to request deletion or correction, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising these rights. We do not sell or share personal information, so there is nothing to opt out of. To make any other request, email clayton@hull.tools. We will verify your request against your account before acting on it.

If you are in the UK or the EEA, you have rights of access, rectification, erasure, restriction, portability, and objection under the GDPR. The same address reaches us, and you may also complain to your local supervisory authority.

Hull is a business tool. Where we process business records that contain another person's information — a contact name on a supplier invoice, or an order in your Shopify store — we act on your instructions as your service provider, and you remain responsible for having the right to give us that data. If one of your customers contacts us directly, we will refer them to you and support you in answering them rather than acting on our own.

Hull is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

If we make a material change — a new category of data, a new AI provider, a new purpose — we will update the effective date above and notify account owners by email before it takes effect.

Questions, requests, or complaints: clayton@hull.tools.