Privacy Policy

Last Updated: August 9, 2026

1. Introduction

NoAdmin, operated by BaseBranch LLC ("we," "our," or "us"), respects your privacy and is committed to protecting your personal data. This privacy policy explains how we look after your personal data when you use our application and informs you about your privacy rights and how the law protects you.

2. Data We Collect

We may collect, use, store, and transfer different kinds of personal data about you which we have grouped together as follows:

  • Identity Data: First name, last name, username (via Clerk authentication).
  • Contact Data: Email address.
  • Transaction Data: Details about payments (via Stripe) and invoices you generate.
  • Usage Data: Information about how you use our application.
  • Local Data: Invoices generated are stored locally on your device unless explicitly shared.

3. How We Use Your Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • To provide the invoice generation service.
  • To manage your account and authentication.
  • To process payments via our secure third-party processor (Stripe).
  • To access your calendar events (via Google API) strictly for the purpose of populating invoice line items.

4. Data Security

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way. We use secure third-party providers such as Clerk for authentication and Stripe for payments to ensure high standards of security.

5. CCPA and GDPR Rights

Under the CCPA (California Consumer Privacy Act) and GDPR (General Data Protection Regulation), you have rights including:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request that we correct inaccurate data.
  • Deletion: Request that we delete your personal data ("Right to be Forgotten").
  • Opt-out: We do not sell your personal data.

To exercise these rights, please contact us.

6. Local Storage

This application uses a hybrid storage model to maximize both convenience and privacy. While the structural data of your invoices (such as amounts, dates, and non-sensitive metadata) is securely stored on our servers, all Protected Health Information (PHI)—specifically client full names and email addresses—is encrypted and stored exclusively in your browser's Local Storage. This sensitive information is never transmitted to or stored on our servers, ensuring a "Zero-Footprint" architecture for your clients' identities. You retain full control to clear this local data via your browser settings at any time.

7. Use and Disclosure of Google User Data

NoAdmin's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We are committed to the protection of your Google user data:

  • Limited Use: We only use your Google calendar data to provide and improve user-facing features that are prominent in the NoAdmin interface (i.e., populating your unbilled sessions list).
  • No Human Review: We do not allow humans to read your Google user data unless we have obtained your affirmative agreement to view specific data (e.g., for technical support), it is necessary for security purposes, or to comply with applicable law.
  • Ephemeral Processing: We do not store Google user data on our servers. Your calendar events are fetched in real-time and processed ephemerally on your device or within our secure runtime to generate invoice previews.
  • No Sharing or Transfers: We do not share, transfer, or disclose your Google user data to any third-party entities, including advertising networks or data brokers, except as required for security or by law.
  • Prohibited Uses: We do not sell your Google user data. We do not use Google user data to serve advertisements, determine credit-worthiness, or for lending purposes.

8. Use and Disclosure of Venmo Data (via Chrome Extension)

The NoAdmin Venmo Bridge Chrome Extension is designed with a strict "Single Purpose" policy to import your financial history into the NoAdmin application.

The use of information received from Venmo APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

  • Collection on Trigger: The extension only collects Venmo transaction history (Date, Description, Amount) when explicitly triggered by you via the "Connect Venmo" button. It does not run in the background or monitor your browsing activity.
  • Local Processing: Data fetched by the extension is passed directly to the NoAdmin application running in your browser. It is processed locally to match payments with clients.
  • No Third-Party Sharing: NoAdmin does not share, sell, or transfer your Venmo data to third-party advertising platforms, data brokers, or lending institutions.
  • Security: The extension utilizes strict host permissions (limited strictly to the API download endpoint) and does not handle or store your Venmo login credentials.

9. NoAdmin Notes App (Desktop and Mobile) — On-Device Data

NoAdmin Notes is a separate desktop and mobile application for capturing and structuring clinical session notes. It follows a local-only model that differs from the web service described above:

  • Your notes stay on your device. Recordings are transcribed on your device, and the resulting notes — which may contain Protected Health Information (PHI) about your clients — are stored locally, encrypted at rest with a key held in your device's keychain. We never receive, host, or have access to readable copies of your notes.
  • No server; no BAA needed. Because your notes and your clients' PHI never reach our servers, we are not a "business associate" with respect to NoAdmin Notes, and no Business Associate Agreement is required.
  • Device-to-device sync only. If you sync notes between your own devices, the transfer happens directly over your local network and is re-encrypted under the receiving device's own key. Nothing is sent to us or to any third party in the process.
  • On-device transcription. Speech-to-text uses your device's built-in, on-device transcription; the audio is processed on the device and deleted after the note is produced.
  • You are the custodian. You control this data and are responsible for your device's security and for backing up your notes (see our Terms of Service). We cannot access, export, restore, or delete notes stored on your device on your behalf.