TRUST CENTER
Where your data actually goes
Every line on this page is checked against the code that runs Stinger, not written from a policy template. Where the code doesn't answer a question, this page says so instead of guessing.
1 · Who receives what
A few outside providers touch your data. Here's exactly who, and for what.
| Data | Recipient | Why | Which apps |
|---|---|---|---|
| Photos of documents, receipts, and signatures | xAI | To read the text and pull out the details so you don't have to type them | Bound, Cage, Chair, Galley, SINET |
| Chat, drafts, and the work Annabelle does with you | Anthropic (Claude) | Command Center's own AI runs on Claude, a different provider from the document-reading pipeline | Command Center |
| Signer name and email address | Resend | To deliver a signing link or document to your customer | SINET, Galley (hands off to SINET's mail path) |
| Nothing: Bound only opens your own email client | None | Bound's "send" is a mailto: link you send yourself; its server never emails on your behalf | Bound |
| Sign-in identity | Google or X, via a shared sign-in broker | So you can log in without a new password; the apps never see your Google/X password, only your name and email | Bound, Cage, Chair, Galley, SINET, Somnus, Stinger Desk (S.D.) |
| Model, token count, and cost per request, no document content | Stinger Command Center (internal) | Cross-app usage metering, so one shared spend ceiling can't be blown by any single app | All sibling apps report to Command Center |
2 · Does it train AI models
Neither provider trains on your data.
xAI (document scanning)
The document-reading pipeline (Bound, Cage, Chair, Galley, SINET) sends photos to xAI's API under an enterprise account. xAI's Enterprise Terms of Service (the company now does business as SpaceXAI LLC) last updated August 14, 2026 state:
"SpaceXAI will not use any User Content to train any foundation models, large language models, or other artificial intelligence systems or to develop any new products, services, or features, subject to disclosures to Customer and Customer-controlled user settings."
Read directly from x.ai/legal/terms-of-service-enterprise.
xAI auto-deletes submitted content within 30 days of the session in which it was submitted, unless a different period is agreed in an order form, required by law, or reasonably necessary for safety and compliance.
The "subject to disclosures to Customer and Customer-controlled user settings" clause is a real qualifier: it means the no-training default could change if an account setting is changed. We have not audited every setting on our own xAI account against this clause; that audit is on the list, not done yet.
Anthropic (Command Center AI)
Command Center's own AI (the part you talk to directly, not the document scanners) runs on Anthropic's Claude. Anthropic's Commercial Terms of Service state:
"Anthropic may not train models on Customer Content from Services."
Read from anthropic.com/legal/commercial-terms.
3 · What we keep, and for how long
What we keep, and for how long, in plain terms.
Jobsite evidence photos: 10 years
Set in Command Center to match Florida's construction-defect statute of repose with headroom (Fla. Stat. § 95.11(3)(b)). Deletion is blocked while a record is inside that window, and a legal hold can extend it further.
Job-scheduler run history: last 500
Command Center prunes runs older than the most recent 500 per job. This is a count cap, not a time-based one.
Meeting audio: deleted once the minutes are written
Command Center transcribes meeting-line audio and then deletes the recording. Transcripts and minutes are kept until you delete them.
Chat history: kept until you delete it or ask us to
Your chats with Annabelle stay until you delete them or ask us to. Facts Annabelle saved to memory are stored separately from chats.
AI Team Room chats: deleted automatically by plan
AI Team Room chats are deleted automatically after 30 days on Launch, 12 months on Ignite, and 90 days on standalone Teams. On Accelerate they are kept until you delete them.
Server logs: as long as needed for security and performance
Server logs are kept as long as needed for security and performance monitoring.
Backups: gone within 12 months
When you delete your account, your data is deleted from the live system right away. Copies in backups are gone within 12 months as backups roll off.
Everything else: kept until you delete it
We looked for automatic expiration on uploaded photos, documents, e-signatures, and account data across every app and did not find one in the code. Your data stays until you or your account removes it: no hidden auto-purge, and no invented retention number. The exceptions are listed above.
4 · How to delete your account and data
In-app account deletion in every app, Command Center included.
Bound, Cage, Chair, Galley, SINET: each has a working in-app account-deletion function. A solo house (you're the only member) is destroyed in full: every row scoped to that house, including session history and stored sign-in tokens, is hard-deleted in one database transaction. A shared house survives; only your seat and your invites are removed. If you're the last owner of a shared house, it blocks the delete and tells you which house needs a new owner first.
Somnus: in-app account deletion removes jobs, audit trail, deliveries, hooks, daemon config, your user row, and verification. Sessions and OAuth tokens cascade-delete automatically.
Stinger Desk: in-app account deletion removes saved boards, customer-approval proof links (including pending ones), seats, your user row, and verification. Proofs created while signed out or before the owner column existed are out of reach of this delete: the UI says so.
Command Center: in-app account deletion removes your settings, chats, sessions, and your user record. It is deleted from the live system right away; copies in backups are gone within 12 months as backups roll off. Individual records (a single photo, job, or document) can also be removed from inside the product.
5 · Where it lives
Our servers and databases are in the United States.
The apps run on Vercel. Render runs the Command Center backend and its own database. Bound, Cage, Chair, Galley, SINET, Somnus, and Stinger Desk each connect to their own Neon Postgres database, separate from Command Center's. The AI providers we use process requests on their own systems.
6 · How your data is protected
What's encrypted, how, and who can decrypt it.
Every credential you connect: encrypted at rest
Your Stripe key, your connected mailbox, Google Drive, Dropbox, and your social account tokens (Facebook, Instagram, YouTube, TikTok, X) are sealed with AES-128-CBC and an authenticated HMAC (Fernet) before they ever reach storage, never written in the clear. A tampered or wrong-key value fails to decrypt rather than being silently used.
Photos, documents, and Stinger Proof records: sealed on disk
Jobsite photos, uploaded documents, and Stinger Proof records are encrypted with AES-256-GCM. Each file gets its own random key, and that key is itself wrapped by the same master key that protects your credentials, so rotating the master key never means re-encrypting every file.
One master key today, not yet a key per business
The wrapping key is one key for the whole system, not a separate key per tenant. Every file and credential still gets its own random encryption key underneath it, and tenant isolation is enforced separately, in how records are scoped and read.
In transit: HTTPS, enforced
Every response carries a header that tells your browser to only ever use HTTPS with us for the next year, so a connection can't be quietly downgraded to plain HTTP.
Ordinary business records, your CRM entries and Annabelle conversation history, are kept separate per business by how the system reads and writes them, not by a second layer of field-level encryption on top of that. We are not claiming SOC 2, HIPAA, or any other certification here: this section names the mechanism in the code, and nothing more than that.
What we could not verify
What this page does not claim.
We'd rather tell you what we don't know than guess:
- Where the AI providers process requests. We state that our servers and databases are in the United States. The AI providers we use process requests on their own systems, and we do not state where those systems are.
- Anthropic's specific API data retention period. Their commercial terms confirm no training on customer content, but we did not find an explicit numeric retention window for Claude API inputs and outputs on the page we checked.
- Whether Render or Neon encrypt the underlying disk. Our own code seals credentials and files as described above; whether the hosting providers additionally encrypt the disk or database volume itself is a provider setting we have not confirmed in our own repositories.
Policies
The agreements published on this site.
Talk to Vincent
Questions about a specific document? Ask directly.
Email StingerIndustries1@gmail.com or call (772) 529-4144.