Skip to content
Data and privacy

Privacy Policy

Effective: 2026-04-28 · USCAPE Apparel, LLC

1. Who we are

USCAPE Apparel, LLC ("USCAPE", "we") operates the USCAPE Hub, an internal business platform used by USCAPE employees, contractors, sales representatives, and authorized customers. The Hub is not a consumer-facing product.

2. Information we process

  • Account information: name, email, role, hashed password.
  • Business data: orders, customers, sales reps, styles, shipping records, design requests, production status, warehouse receipts, financial data ingested from QuickBooks Online.
  • Operational telemetry: page views, audit log entries, IP address, user agent, timestamps — used for security and access control.
  • Third-party access tokens: OAuth refresh and access tokens for QuickBooks Online, Monday.com, Google Drive, and Dropbox. All tokens are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256).

3. How we use information

Information is used solely to operate the Hub: authenticating users, enforcing role-based access control, rendering reports, syncing data with authorized third-party services, and producing audit trails. We do not sell or rent personal information to anyone.

4. QuickBooks Online data

When an authorized USCAPE administrator connects QuickBooks Online to the Hub, the Hub reads chart of accounts, customers, vendors, items, invoices, bills, payments, and journal entries from the connected QBO company. This data is used exclusively to render Hub-internal financial reports (Profit & Loss and related statements). The Hub never writes back to QuickBooks Online in this version. QBO data is retained only as long as the QBO connection is active; on disconnect, OAuth tokens are revoked at Intuit and removed from our database, and synced QBO records are deleted on request.

5. Where data is stored

The Hub is hosted on Railway.app in a US region, with PostgreSQL provided by Railway. Backups are encrypted at rest. Access to the production environment is restricted to authorized USCAPE administrators.

6. Sharing

We do not sell or rent personal information. We share information only:

  • With third-party services that the user explicitly authorizes (QuickBooks Online, Monday.com, Google Drive, Dropbox).
  • With our hosting provider (Railway) to the extent necessary to run the Hub.
  • When required by law or to protect USCAPE's rights.

7. Security

Passwords are stored as bcrypt hashes (cost factor 12). Sessions are HttpOnly cookies with sliding 8-hour expiry. All mutation endpoints are CSRF-protected. OAuth tokens are encrypted at rest. Login attempts are rate-limited per IP. Every administrative action is recorded to an immutable audit log.

8. Retention

Account records are retained while the user's relationship with USCAPE is active. Audit logs are retained for at least one year. Business data is retained according to USCAPE's internal records-retention policy.

9. Your choices

Authorized users may request deletion of their personal account by contacting their USCAPE administrator. QuickBooks Online connections may be disconnected at any time from the Hub's Finance module or from within QuickBooks Online itself.

10. Changes to this policy

We may update this policy. The effective date at the top of this page reflects the most recent revision. Material changes will be communicated to authorized users via the Hub.

11. Contact

Privacy questions or data-deletion requests: alex@uscapeapparel.com.