Steda

Privacy policy

Effective August 14, 2026

1. Who we are and what this covers

Steda is a service of SMB Solved LLC ("SMB Solved", "we", "us"), a Texas limited liability company. This policy describes what we collect through stedahq.com and app.stedahq.com (the "Service"), how we use and protect it, and the rights you have over it.

Steda is a business service. The company that subscribes (the "Customer") controls the accounting data it puts into the Service; we process that data on the Customer’s behalf to provide the Service.

2. What we collect

  • Account information: your name, email address, and role, provided when your administrator creates your account. Passwords are stored only as secure hashes.
  • Accounting data: the registers, transactions, documents, and configuration the Customer uploads to or creates in the Service.
  • QuickBooks connection data: when the Customer connects QuickBooks Online we receive OAuth tokens from Intuit, never your QuickBooks password. Credentials that must be stored for QuickBooks Desktop connections are encrypted at rest with AES-256-GCM envelope encryption.
  • Usage and log data: sign-ins, actions recorded in the audit trail, technical logs (IP address, browser type), and error reports, used to operate and secure the Service.
  • Billing information: handled by our payment processor. We keep invoicing records but never store full card or bank account numbers ourselves.
  • Communications: emails you send us, kept so we can support you.

3. How we use it

We use the information above to:

  • Provide, operate, and support the Service.
  • Secure the Service, including authentication, tenant isolation, and the audit trail.
  • Bill for the Service and communicate about the account.
  • Improve the Service using aggregate, de-identified usage patterns.

4. What we never do with it

  • We do not sell personal information or Customer data.
  • We do not use Customer data for advertising.
  • We do not use Customer data to train machine learning models.
  • We do not access Customer accounting data except to provide support, with the Customer’s knowledge, or as required to operate or secure the Service.

5. When we share it

We share data only with the service providers that run the Service, with third parties the Customer connects, and where the law requires it:

  • Infrastructure providers that host the application and database (currently Vercel and Supabase), bound by their own security and privacy commitments.
  • A payment processor for subscription billing.
  • A transactional email provider, for messages like invitations and password resets.
  • Intuit, when the Customer connects QuickBooks and instructs the Service to read from or post to it.
  • Authorities, where a valid legal demand requires it; we will notify the Customer unless the law forbids it.
  • A successor entity if SMB Solved is acquired or reorganized, with notice to the Customer.

6. How we protect it

  • All traffic is encrypted in transit with TLS; data is encrypted at rest.
  • Every table holding Customer data enforces row-level security in the database itself, keeping each company’s data isolated.
  • All data access is server-side; browsers never connect to the database.
  • Stored connection credentials are encrypted with AES-256-GCM envelope encryption.
  • The audit log is append-only and cannot be edited after the fact.

7. How long we keep it

We keep Customer data for the life of the subscription. After termination, the Customer can export everything for at least 60 days, after which we may delete it. We may retain limited records (such as invoices and audit records) where the law requires it.

8. Your rights

You may ask us to access, correct, export, or delete your personal information by emailing hello@stedahq.com. For accounting data controlled by a Customer, we will refer the request to that Customer and support them in fulfilling it. We answer requests within 30 days.

9. Cookies

The Service uses only the cookies required to sign you in and keep your session secure. We do not use advertising cookies or cross-site tracking.

The marketing site embeds a product walkthrough video hosted by YouTube in its privacy-enhanced mode (youtube-nocookie.com), which does not set tracking cookies unless you play the video; when you play it, YouTube processes your viewing under the Google privacy policy.

10. Children

The Service is for businesses and is not directed to children. We do not knowingly collect information from anyone under 16.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced to the Customer’s account owner by email or in the Service before they take effect. The current version is always at stedahq.com/legal/privacy.

12. Contact

SMB Solved LLC. Privacy questions: hello@stedahq.com.