1. Who we are
Smartnatic is provided by INVERT LLC, a limited liability company registered in the State of Wyoming, United States, 5830 E 2nd St, Ste 7000 #6984, Casper, WY 82609, United States ("we", "us"). For anything about privacy, write to privacy@smartnatic.com.
2. Two kinds of data, two different roles
Account data. Information about the people who use Smartnatic: name, email, role, sign-in records. For this we decide how it is used, so we are the controller. If you choose to sign in with Microsoft or Google, we receive your name and verified email address from that provider; we never see your password there.
Practice data. Everything your firm puts into Smartnatic: projects, clients, contacts, fees, invoices, timesheets, drawings, documents and files. Your firm decides what goes in and who sees it. Your firm is the controller and we process it only on your firm's instructions, as a processor. If you are a client or consultant of a firm that uses Smartnatic and have a question about your data, please contact that firm first.
3. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email, a hashed password (we never store the password itself), role in the firm, language | You, or the person who invited you |
| Firm details | Firm name, address, phone, website, licence and tax numbers, logo, plan and billing cycle | The firm's owner or principals |
| Practice data | Projects, phases, deliverables, tasks, time entries, fees, invoices, contracts, contacts, uploaded files and images | People in your firm |
| Technical records | Sign-in time, the page a problem report was sent from, browser type | Created automatically when you use the service |
| Public site analytics | The public pages you open, an approximate location worked out from your IP address, browser and device type, and the site that sent you | Google Analytics, and only if you accept it on the cookie banner |
| Messages to us | Problem reports, feature requests, emails | You |
We do not ask for, and you should not upload, special categories of personal data such as health information, unless your firm has a lawful reason and has told us.
4. Why we use it, and our legal basis
- To provide the service you signed up for: sign you in, show your projects, produce your documents and invoices. Basis: our contract with your firm.
- To send service emails: invitations, password resets, and the notifications you have switched on. Basis: contract, and your own notification settings.
- To keep the service secure and working: prevent abuse, find and fix faults. Basis: our legitimate interest in a safe service.
- To bill your firm and keep the records the law requires. Basis: contract and legal obligation.
- To answer you when you write to us. Basis: legitimate interest.
- To see which public pages help: which pages people read before they start a trial, so we write better ones. This covers the public website only. Basis: your consent, given on the cookie banner and withdrawable at any time.
We do not use practice data to train AI models, to build advertising profiles, or for any purpose other than running the service for your firm.
The AI Advisor
When you ask the AI Advisor a question (with an Advisor seat, or with the small monthly taster firms without Advisor seats get), the question, together with the project figures needed to answer it, is sent to our AI provider to produce the answer. It is used for that answer only.
Support access
Our support staff cannot look inside your firm's workspace on their own. They can work in it only after an owner or a principal of your firm gives access in Settings, Support access, either on their own or by accepting a request from us that says why we ask. Nobody at Smartnatic can give that access for you.
While access lasts, support can see and change your firm's practice data (projects, tasks, files, time, finance and clients) to help with your request. Support cannot change your plan or billing, your team members or their roles, your API keys, webhooks or storage connections, and it cannot delete the firm. Access ends by itself after the time chosen, at most 24 hours, and an owner or principal can end it at any time. Every page support opens and every change it makes is recorded, and your firm can see that record in Settings, Support access for one year. With it we keep the consent itself: who gave it, when, for how long, and a one-way code in place of the IP address it came from. The support session uses one short-lived cookie in the support person's own browser, never in yours.
5. Cookies
The app sets one essential cookie: the session cookie that keeps you signed in. It holds no advertising or tracking identifier and the service does not work without it, so it does not need consent.
The app also stores a few preferences in your browser's local storage, such as whether the side panel is open. These never leave your device.
Analytics on the public pages
Our public pages (the home page, pricing, the construction page, the developer pages and these legal pages) can load Google Analytics 4. Nothing is loaded until you press Accept on the banner at the bottom of the page. If you press Decline, or leave without choosing, the Google script is never fetched and no analytics cookie is set. It never runs on a signed-in screen, so it never sees anything about your firm or its projects.
If you accept, Google Analytics sets its own cookies (named _ga and _ga_ followed by our property code) and records the public pages you open, an approximate location worked out from your IP address, your browser and device type, the site that sent you, and a few named actions such as starting a trial or opening the developer documentation. It does not record your name or your email address, and we do not connect it to your account.
The processor is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which may also process the data outside the European Economic Area under the European Commission's standard contractual clauses. We use Google's consent settings so that advertising storage, advertising user data and ad personalisation stay switched off for everyone, because we do not advertise; accepting turns on the analytics setting alone. Google keeps the underlying visit records for no longer than the retention period set on our property, which Google Analytics caps at 14 months; the summary reports we read hold no personal data.
Your choice is kept in your browser's own storage for six months, not in a cookie, and it is never sent to us. To change it, use the Cookie settings link in the footer of any public page, and choose again. Clearing your browser storage clears it too, and the banner will ask again. Because the basis is consent, you can withdraw it whenever you like, and that has no effect on anything collected before.
We use no advertising or social media cookies anywhere, and none at all inside the app.
Our public pages load their typeface from Google Fonts, which means your browser contacts Google to fetch the font files and Google receives your IP address. We plan to host the fonts ourselves.
6. Who we share it with
We never sell personal data. We share it only with the providers that help us run the service, each under a contract that limits them to our instructions:
| Provider | What for |
|---|---|
| Vercel (Frankfurt, Germany) | Running the application |
| Neon (Frankfurt, Germany) | Storing your data |
| Vercel Blob (Frankfurt, Germany) | Storing the files you upload: drawings, documents, images, receipts |
| Resend (European Union region) | Sending service emails (invitations, password resets, notifications) |
| Anthropic, PBC (United States) | AI Advisor answers, only when a user asks the Advisor a question. The question, the earlier messages of that conversation and the project data the Advisor looks up to answer it are sent to Anthropic. The conversation itself is stored in Smartnatic. |
| Google Ireland Limited (Ireland) | Google Analytics on the public website, for visitors who accept it on the cookie banner. Never on a signed-in screen. |
| Our payment provider | Taking card payments, once online payment is switched on. We never see or store full card numbers. |
Connections your firm switches on
Your firm can choose to connect Smartnatic to other services, for example OctopusWave, CallSophia or Postspool. When a firm does this, the project details needed for that connection are sent to that service, under that service's own terms and privacy policy. Nothing is sent until someone in your firm connects it, and it can be disconnected at any time in Settings, Integrations.
Your firm's own file storage
Your firm can choose to keep its project files (deliverable evidence, drawing sheets and receipts) in its own Microsoft OneDrive or SharePoint, or its own Google Drive, instead of Vercel Blob (Frankfurt, Germany). When a firm connects one, those files are stored in the firm's account with Microsoft or Google, under the firm's own agreement with that provider, and Smartnatic reads them from there when someone with access opens them. Logos, project covers and website images stay with Vercel Blob (Frankfurt, Germany). The firm can disconnect at any time in Settings; files already saved stay where they are.
When the law requires it
We may disclose data if a court or authority with the power to demand it requires us to. Where we are allowed to, we will tell your firm first.
7. Where your data is kept
Your data is stored in the European Union: the application runs on Vercel (Frankfurt, Germany), the database is Neon (Frankfurt, Germany) and uploaded files are kept in Vercel Blob (Frankfurt, Germany). This applies to every customer, wherever they are based. The one exception is a firm that connects its own Microsoft or Google storage: its project files are then kept wherever that firm's account with Microsoft or Google keeps them.
INVERT LLC itself is based in the United States. When our staff support the service, or when a provider outside the European Economic Area is involved, personal data can be accessed from, or transferred to, the United States or another country. For those transfers we rely on a lawful mechanism, such as the European Commission's standard contractual clauses and the UK addendum to them, together with the safeguards described under Security below.
8. How long we keep it
- While your firm has an account: for as long as the account is open. If a trial ends without a plan, the account becomes read-only and nothing is deleted.
- After the account is closed: your firm can export everything first. We delete practice data within 90 days of closure, and from backups as those backups expire.
- Billing records: for as long as tax and accounting law requires, usually up to ten years.
- Public site analytics: held by Google for no longer than the retention period set on our property, which Google Analytics caps at 14 months. Your accept or decline choice sits in your own browser for six months.
- People who leave a firm: their sign-in is switched off. The work they recorded (time, approvals, documents) stays with the firm, because it is part of the firm's project record.
9. Your rights
Depending on where you live, you have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how it is used, to receive it in a portable format, and to withdraw any consent you have given.
For account data, write to privacy@smartnatic.com and we will answer within one month. For practice data held by a firm that uses Smartnatic, please ask that firm. We will help the firm respond.
You also have the right to complain to your local data protection authority. We would appreciate the chance to put things right first.
If you live in California, you have the rights described above under California law. We do not sell or share personal information as those terms are defined there.
10. Security
Passwords are stored only as salted hashes. Invitation and password reset links are single-use and expire, and only their hashes are stored. Keys your firm saves for connected services are encrypted. Access inside the app is controlled by role, and every approval and plan change is recorded. Our own staff reach a firm's workspace only through support access that the firm gave. No system is perfectly secure, so if we ever learn of a breach affecting your data we will tell your firm without undue delay.
11. Children
Smartnatic is a tool for professional firms. It is not intended for anyone under 16 and we do not knowingly collect their data.
12. Changes to this policy
If we make a change that matters, we will tell firm owners by email or in the app before it takes effect. The date at the top shows when this page last changed.
13. Contact
INVERT LLC, 5830 E 2nd St, Ste 7000 #6984, Casper, WY 82609, United States. Privacy questions: privacy@smartnatic.com. Everything else: hello@smartnatic.com.
