Privacy policy
Your business data stays yours.
Effective 12 October 2026. Modern Mustard Seed LLC ("we") runs Owner's Desk. This policy covers desk.modernmustardseed.com and the Owner's Desk MCP server.
What Owner's Desk does
It connects systems you own (Stripe, Google Calendar and Google Business Profile) to AI assistants you approve, such as Claude or ChatGPT, so you can ask about your business and prepare invoices, events and review replies that run only after you confirm them.
What we store
- Your sign-in: your email address, used to send sign-in links and codes.
- Business details you enter: business name, time zone and default currency.
- Credentials for connected systems: Stripe access and refresh tokens or the restricted key you provide, and Google access and refresh tokens. Each is encrypted with AES-256-GCM before it is stored and bound to your account. They are never shown to you, to an assistant, or in logs.
- Drafts: while a draft waits for your confirmation, we keep a summary (for an invoice, the customer, lines and total) and the exact write, encrypted. The encrypted write is erased one day after the draft is confirmed, cancelled or expires; the summary and outcome stay in your account until you delete it.
- Your audit log: for each action, the time, the app that asked, the system, the outcome and the id of the object touched (for example an invoice id). It never contains message content, review text, invoice text, customer names, emails or phone numbers.
- Authorization records: the apps you approved and hashed copies of the tokens we issued them.
What we read but do not store
To answer a question, Owner's Desk reads from your connected systems at that moment: payments, invoices and customers from Stripe; events from your primary Google Calendar; reviews from your Google Business Profile location. The answer goes to the assistant you asked and is not saved by us. Your conversations with the assistant are never sent to us beyond the arguments of each tool call.
What we never do
- We do not sell data, share it for advertising, or use it to train AI models.
- We do not read your connected systems except to answer a tool call you or your assistant made, or to run an action you confirmed.
- We do not let our staff read your business data. Support never needs it.
Google user data
Owner's Desk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the access each feature needs: calendar.events to list and create events on your calendar, and business.manage to read reviews and post replies you approve. Google data is used only to provide those features to you, is not transferred to others except the assistant you direct it to, and is not used for advertising or model training.
Logs
Our hosting logs record, for each tool call, the tool name, your account id, the outcome and how long it took. They do not record arguments, message content or customer details. Hosting logs are kept by Vercel for a limited period under its retention settings.
Who processes data for us
- Supabase (database and sign-in), United States.
- Vercel (hosting), United States.
- Resend (sign-in emails).
- Stripe and Google, only as the systems you chose to connect.
Security
Every database table has row level security. Credentials are encrypted at rest with keys held outside the database. Every change to a connected system needs a separate confirmation with a single-use token. Rate limits are per account. Report a security issue to sarah@modernmustardseed.com; see security.txt.
Deleting your data
On your desk page, or by asking your assistant to use delete_my_data and confirming, Owner's Desk revokes every connection, signs out every app, and deletes your sign-in, credentials, drafts, business details and audit log right away. You can also disconnect one system at a time. Nothing inside Stripe or Google changes. Encrypted database backups held by Supabase roll off within its backup window. To ask about your data, write to sarah@modernmustardseed.com.
Children
Owner's Desk is for business owners and is not directed to anyone under 18.
Changes
If this policy changes in a way that matters, we will email account holders before the change takes effect.
Contact
Modern Mustard Seed LLC, Kalispell, MT 59901. sarah@modernmustardseed.com.