Privacy Policy

Effective date: September 8, 2026. Last updated: September 8, 2026.

This policy applies to the web portal operated at truecraft.thelightlabs.dev (the “Service”), including the client and contractor cost views connected to QuickBooks Online. The Service is operated by The Light Labs for Truecraft Builders, using the Ledgerline product branding for account and email notices.

This document is a working product policy so that users, contractors, and partners (including Intuit) can review how the portal is intended to handle data. It is not formal legal advice, is not a substitute for counsel, and may be updated as the product changes.

1. Who operates the Service

The Light Labs hosts and operates the Service. Truecraft Builders is the contractor business whose clients and job-cost information may appear in the portal. Ledgerline is the name used on sign-in and invitation emails. Questions about this policy or your information can be sent to otp@thelightlabs.dev.

2. Information we may collect

Depending on how you use the Service, we may process:

• Account information, such as your email address, display name, role (contractor, admin, or client), and invitation or access-grant records.
• Authentication and session data, including one-time sign-in codes, optional device PIN records, session cookies, and related security timestamps (for example, failed attempts or lockouts).
• QuickBooks Online–connected financial and job-cost data needed to run the portal. That may include customer and project labels, time activities, expenses, invoices, payments, and related line-item details that a connected company has authorized the Service to read.
• Operational logs needed to provide support, diagnose errors, rate-limit abuse, and record sync or webhook activity. We do not ask for an Intuit username or password; QuickBooks access uses Intuit’s OAuth consent flow.

Public pages such as this policy and the End User License Agreement do not require an account. Visiting them may still produce ordinary web request logs (for example, IP address, user agent, and the URL requested) as part of hosting and security.

3. How we use information

We use the information above to:

• Provide the Service, including sign-in, access control, and the cost views.
• Authenticate users, keep sessions, and send one-time codes or invitations.
• Synchronize authorized QuickBooks data into the portal’s read-only views.
• Provide support, investigate incidents, and maintain the security of the Service.
• Meet operational and legal obligations that apply to hosting the Service.

We do not sell your personal information. We do not use portal account or QuickBooks data to advertise unrelated products.

4. Third parties

The Service relies on third parties that process data as needed to operate:

• Intuit / QuickBooks Online. If a company connects QuickBooks, Intuit processes authentication and the company’s books. The portal requests access only as configured for the app and stores connection tokens in encrypted form. Intuit’s own terms and privacy policy apply to QuickBooks.
• Cloudflare. The Service is hosted on Cloudflare (including Workers, related storage, and email sending where configured). Cloudflare may process request, hosting, and email-delivery data under its terms.

Email notices (sign-in codes and invitations) are sent from an address on thelightlabs.dev, typically otp@thelightlabs.dev.

5. Cookies and sessions

The signed-in portal uses a session cookie (currently named portal_session) to remember that you are authenticated. That cookie is needed to use protected cost views. We do not use third-party advertising cookies on the portal. You can delete cookies in your browser; doing so will sign you out of the portal.

6. Security

We use reasonable administrative and technical measures appropriate to a hosted web portal, including encrypted storage of QuickBooks OAuth tokens, hashed one-time codes and device PINs, and access controls so that a client grant cannot be used to read another client’s records. No method of transmission or storage is completely secure. You are responsible for protecting access to your email and any device PIN you choose to save.

7. Retention

Account, session, grant, and synchronized QuickBooks-derived records are kept while they are needed to operate the Service for the connected company, to provide support, and to maintain security logs. When access is revoked or the Service is discontinued for a company, we will delete or de-identify personal data when it is no longer needed, except where we must retain information for security, dispute, or legal reasons.

8. Your rights and contact

Depending on where you live, you may have rights to request access, correction, or deletion of personal information we hold about you, or to ask us to limit certain processing. To make a request, or if you have a privacy question, email otp@thelightlabs.dev from the address associated with your account when possible. We may need to verify your identity before completing a request. Authorized users of a connected QuickBooks company should also use QuickBooks itself to correct source financial records.

9. Children

The Service is intended for business users (contractors, staff, and invited clients). It is not directed to children, and we do not knowingly collect personal information from children.

10. Changes

We may update this policy as the product, hosting, or legal requirements change. The effective date at the top of this page will be revised when we do. Continued use of the Service after an update means you should review the current version at /portal/privacy.

11. Disclaimer

This policy describes current product practice for the Truecraft / Ledgerline cost portal. It is provided so the Service can be reviewed and linked by users and partners. It is not legal advice and does not create rights beyond those required by applicable law or a separate written agreement.