Privacy Policy

Effective date: September 28, 2026

This policy describes how NLC Consulting LLC ("NLC," "we," "us") collects and uses information in three places: when you visit nlc.consulting or contact us through it (Part A); when a business uses NLC Service, our operations platform for contractors at service.nlcportals.com and its public demonstrations at demo.nlcportals.com (Part B); and when a firm uses Forge, our referral CRM at www.nlcforge.com (Part C). Part B also explains what happens with QuickBooks Online data when a business connects its QuickBooks company to NLC Service. Part C explains what happens with Gmail, Google Calendar, Google Contacts, and Microsoft 365 data when a Forge user connects a mailbox.

Part A: This website

Information we collect

Information you give us. When you submit our contact form, we collect your name, email address, company (optional), and your message.
Information collected automatically. Like most websites, we use analytics tools (loaded through Google Tag Manager) that collect information about your visit, such as the pages you view, how you arrived at the site, your device and browser type, and your approximate location derived from your IP address. These tools use cookies and similar technologies.

How we use information

To respond to your inquiry and communicate with you
To provide and improve our services and this website
To measure how our marketing performs, including advertising conversion measurement

We do not sell your personal information.

Who we share information with

We use a small number of service providers to run this site, and they process information on our behalf:

Vercel: website hosting and delivery
SendLayer: delivers your contact form submission to our inbox by email
Google: Tag Manager, analytics, and (if you arrived through one of our ads) advertising measurement services. If you submit the contact form after clicking one of our ads, your email address is converted into an irreversible code (a hash) in your own browser and that code is sent to Google so it can tell which ad brought you here. Google never receives your actual email address this way.

We may also disclose information if required by law or to protect our rights.

Cookies and choices

You can control cookies through your browser settings, including blocking or deleting them. Google offers an opt-out browser add-on for Google Analytics.

Data retention

We keep contact form submissions and related correspondence for as long as needed to handle your inquiry and maintain our business records.

Part B: NLC Service

Who this part covers

Customersare the businesses that subscribe to NLC Service, and their staff who sign in ("users").
Customer recordsare the information customers enter about their own work: their clients, property owners, insurance carriers and adjusters, job sites, and jobs. NLC processes customer records on the customer's behalf and on its instructions. The customer decides what to enter and is responsible for having the right to do so.
Visitors are people who try the public demonstration. Demonstrations reset on a schedule; nothing entered into one is kept or private.

If your information appears in a customer's records (for example, you are that contractor's client), the customer is responsible for it. Contact the customer first; we will help them respond.

What we collect

Account and sign-in information. Your name, email address, and the identifier issued by the sign-in provider, plus your role and organization membership in NLC Service.
Customer records. Whatever the customer enters or uploads: companies and contacts; properties and addresses; job files; loss events and insurance claims, including claim and policy numbers; inspections; photos and documents; equipment readings; estimates; invoices and payments; notes and call logs; calendar entries.
QuickBooks Online data, only when a customer connects a QuickBooks company. The company name and identifier; the customers, invoices, and payments needed to keep NLC Service and QuickBooks consistent; sync status and error records; and the authorization tokens Intuit issues for the connection.
Technical information. IP address, browser and device details, request logs with timing and error diagnostics, and security records of sign-ins and significant actions.
Support communications. What you send us when you ask for help.

We do not collect payment card numbers. NLC invoices customers directly for their subscription; NLC Service does not process card payments.

How we use information

To provide, operate, secure, and support NLC Service
To synchronize records with QuickBooks Online when, and only as, a customer instructs by connecting its company
To troubleshoot problems, measure reliability, and improve NLC Service using technical information and aggregate, de-identified usage measures
To bill customers for their subscription and communicate about the service
To comply with law and enforce our terms

We do not sell personal information. We do not use customer records or QuickBooks Online data for advertising, for training models, or for any purpose other than providing NLC Service to that customer.

QuickBooks Online

Connecting a QuickBooks company authorizes NLC to access that company through Intuit's API with the accounting scope only. NLC Service pushes approved customers and invoices to QuickBooks and pulls payment and invoice status back. Authorization tokens are stored encrypted and are used only to make those calls. A customer can disconnect at any time from the integration settings in NLC Service or from Intuit's connected-apps page; disconnecting revokes our access immediately. Records already synchronized remain in NLC Service as part of the customer's own data. Intuit's own terms and privacy statement govern QuickBooks itself.

Who we share information with

We share information only with the providers we need to run NLC Service, and only what each needs:

Hosting and storage: DigitalOcean, LLC (United States) for servers, block storage, and encrypted backups
Sign-in: our identity provider, which authenticates users and returns the name and email address to us
Intuit Inc., when a customer connects QuickBooks Online
Monitoring: a telemetry provider that receives operational logs and performance data, with personal information removed where practical
Email delivery, when NLC Service sends notifications by email

We may also disclose information to professional advisers under confidentiality, when required by law or legal process, to protect the rights and safety of NLC, customers, or others, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply.

How we protect information

Encryption in transit (TLS) for every connection
Backups are encrypted before they leave our servers and stored in a separate region; integration tokens are encrypted at rest
Each customer's data is isolated from every other customer's by controls enforced inside the database, not only in the application
Role-based access within a customer's organization, deny-by-default permissions, and audit records of significant actions
Uploaded files are scanned for malware before anyone can download them
Access by NLC staff is limited to what operating and supporting NLC Service requires

If we learn of a security incident affecting a customer's data, we will notify that customer without undue delay and cooperate with its response.

How long we keep information

We keep customer records for as long as the customer subscribes, and for 30 days afterwards so the customer can export them, after which they are deleted. Encrypted backups age out on a schedule and are gone within 13 months of deletion. Audit records and billing records are kept as long as the law requires. Technical logs are kept for a limited period for security and troubleshooting.

Cookies

NLC Service sets one strictly necessary cookie to keep you signed in. It does not use advertising cookies or cross-site tracking. The public demonstration uses the same cookie.

Where information is processed

NLC Service is hosted in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States.

Platforms we operate for individual clients

NLC also builds and operates private software platforms for individual client businesses under separate agreements. When such a platform connects to QuickBooks Online, it does so through an Intuit app registered to NLC, and the rules in this Part apply to it in the same way: the accounting scope only, tokens stored encrypted, disconnection at any time, and no use of the data beyond operating that platform for that client. The client's own privacy policy governs its customers and staff; this policy governs NLC's handling.

Part C: Forge

Who this part covers

Customersare the firms that subscribe to Forge, and their staff who sign in ("users").
Customer recordsare what customers keep in Forge: contacts, companies, groups, opportunities, notes, and follow-ups. NLC processes customer records on the customer's behalf and on its instructions.
Visitors are people who try the public demo. The demo holds sample data only, resets every night, and cannot connect a mailbox.

If your information appears in a customer's records, the customer is responsible for it. Contact the customer first; we will help them respond.

What we collect

Account and sign-in information. Your name, email address, and role, and the firm you belong to.
Customer records. Whatever the customer enters, imports, or approves.
Mailbox data, only when a user connects a mailbox. What Forge reads and keeps is described in Connected mailboxes below.
Forwarded emails.When a user forwards an introduction to Forge, Forge reads that email and the user's note to create the contact, credit, and follow-up. It keeps what it creates, not the email.
Technical information. IP address, browser and device details, and request logs with timing and error diagnostics.
Support communications. What you send us when you ask for help.

Connected mailboxes

A user can connect a Gmail or Microsoft 365 mailbox. Forge's access is read-only: it cannot send, change, or delete mail, contacts, or calendar events. What Forge reads depends on the features the user uses:

Introductions.When the user starts a scan, Forge reads the messages received in the last 7, 15, or 30 days (the user chooses) to find introductions made to them. For each likely introduction, the message text goes to our AI provider to pick out the introduced person's name, email, phone, company, and similar details. Forge keeps each suggestion (those details, who made the introduction, and the email's subject, sender, date, and a short preview) until the user approves or rejects it. An approved suggestion becomes a contact, with a note naming the email it came from.
Missing contacts.When the user syncs contacts, Forge reads their saved contacts and the people they have emailed (Google "Other contacts" or Microsoft "People") and suggests the ones not yet in Forge, with the name, email, phone, title, company, address, and notes from the contact card. Nothing is added until the user approves it.
Recent email.A contact's page shows the latest messages between the user and that person, read from the mailbox when the page opens and not stored. On request, our AI provider summarizes the last few messages into what each side owes; the summary is held in memory for up to 15 minutes and not stored.
Relationship tracking, which each user can turn on or off. Forge reads the sender, recipients, and date of mail sent and received in the past year, and the attendees and start times of past calendar meetings, and records which people already in the user's contacts they exchanged mail or met with, and when. Forge never keeps a subject, message text, meeting title, or anyone who is not already a contact. These records produce a relationship score.
Weekly digest. An email to the user listing relationships that have gone quiet: names, companies, and how long since the last exchange. It contains no email content.

Recent email and its summaries are visible only to the user whose mailbox it is. Suggestions found in a mailbox can be reviewed by the other users at the same firm. From relationship tracking, colleagues see that the user knows a contact, the score, and the dates of their last exchanges, never the messages.

Google user data

Forge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google user data only to provide the features above to the user who connected the mailbox and to their firm.
We do not sell it, use it for advertising, or use it to develop, improve, or train generalized AI or machine-learning models.
We transfer it only to the service providers listed below, as needed to provide those features, to comply with the law, or as part of a merger, acquisition, or sale of assets with the same protections.
NLC staff do not read it, except with the user's permission for a specific support request, when needed for security, such as investigating abuse, or to comply with the law.

We apply the same commitments to data from Microsoft 365 mailboxes.

Artificial intelligence

Forge uses Anthropic's Claude API to find introductions in email text and forwarded emails, and to write summaries. Only the text a task needs is sent: up to about 12,000 characters of one message, or the last six messages with a contact for a summary. Anthropic processes it on our behalf under its commercial terms, which do not let it train its models on this data. We do not train AI models on customer data either.

How we use information

To provide, operate, secure, and support Forge
To run the mailbox features a user connects and turns on, and only as described above
To troubleshoot problems and measure reliability, using technical information
To bill customers for their subscription and communicate about the service
To comply with law and enforce our terms

We do not sell personal information.

Who we share information with

We share information only with the providers we need to run Forge, and only what each needs:

Hosting and storage: Render (application servers), Supabase (database), Vercel (the web app), and DigitalOcean (uploaded files), all in the United States
Anthropic, for the AI processing described above
Google or Microsoft, as the provider of a mailbox the user connects
Email: SendLayer delivers the email Forge sends, and SendGrid receives the email users forward to Forge
Monitoring: Sentry receives error reports, without the contents of the request
Analytics: Google Tag Manager and Google Analytics count page views in the Forge web app. They never receive customer records or mailbox data.

How we protect information

Encryption in transit (TLS) for every connection
Mailbox access tokens encrypted at rest (AES-256-GCM)
Read-only permissions on connected mailboxes
Each customer's data kept apart from every other customer's by checks on every request, with automated tests that try to cross between customers
Access by NLC staff limited to what operating and supporting Forge requires

How long we keep information and how to delete it

Disconnecting a mailboxin Forge's Settings deletes its access tokens, the relationship history recorded from it, and its pending suggestions. Suggestions already approved or rejected keep only an internal message reference, so the same email is not suggested twice; contacts the user approved stay in the customer's records. For Google mailboxes, disconnecting also revokes Forge's access, so Forge no longer appears in your Google Account. You can also remove Forge at myaccount.google.com/permissions or, for Microsoft, myapps.microsoft.com.
Relationship tracking can be turned off at any time. The history already recorded stays until the user deletes it from Settings, which removes all of it at once.
Customer recordsare kept for as long as the customer subscribes. When a subscription ends, we delete the customer's records and mailbox data within 30 days, or sooner on request.
Technical logs are kept for a limited period for security and troubleshooting.

Cookies and browser storage

Forge keeps you signed in with a token stored in your browser. The web app also loads Google Tag Manager and Google Analytics, which use cookies to count visits; see Part A for how to control them.

Where information is processed

Forge is hosted in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States.

All parts

Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete personal information we hold about you. Customers can view, correct, export, and delete their data from NLC Service, and can ask us for help doing so. Where the information is in a customer's records, we will direct the request to that customer and assist. To make a request, email info@nlc.consultingand we'll respond within the time the applicable law requires.

Children

This site, NLC Service, and Forge are intended for businesses and are not directed to anyone under 18. We do not knowingly collect information from children.

Security

We use reasonable technical and organizational measures to protect your information, described above for NLC Service and Forge. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. The effective date above reflects the latest revision. Material changes will be posted on this page, and customers of NLC Service and Forge will be notified before they take effect.

Contact us

NLC Consulting LLC
923 Haddonfield Rd., Cherry Hill, NJ 08002
info@nlc.consulting
(856) 522-4261

The terms that govern NLC Service are in our Terms of Service.