This privacy policy applies to ScoreACut, a brand operated by ClearShield Advisory LLC d/b/a ScoreACut.
Last updated: May 10, 2026
ClearShield Advisory LLC ("we", "us", "our"), operating the ScoreACut brand, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard information when you interact with our services. ScoreACut is an AI-powered voice receptionist for personal-grooming and salon professionals. Our platform answers inbound phone calls, books appointments, issues quotes, and — where the merchant has authorized it — issues payment links and invoices on the merchant's behalf. For privacy questions, contact us at support@scoreacut.com.
We serve two categories of people, and this policy addresses both:
Our voice agent integrates with third-party platforms on the merchant's behalf. The merchant explicitly authorizes each integration through a standard OAuth flow initiated from their ScoreACut portal. For each integration, we request only the permissions necessary to perform the merchant's requested functions.
When a merchant authorizes Google Calendar access, we receive an OAuth refresh token with the https://www.googleapis.com/auth/calendar scope. We use this token solely to create, update, and read appointment events on the merchant's primary calendar during a live call. We do not read unrelated calendar data, and we do not use calendar contents for any purpose other than appointment booking on that specific merchant's behalf. Refresh tokens are stored encrypted at rest.
Google API Services User Data Policy — Limited Use disclosure: ScoreACut's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Specifically, ScoreACut does not use Google Workspace API data to develop, improve, or train generalized AI/ML models; we do not transfer this data to third parties except as necessary to provide or improve user-facing features that are prominent in our application's user interface; we do not allow humans to read this data unless we have the merchant's affirmative agreement, it is necessary for security purposes, or it is required by law; and we do not use this data for serving advertisements.
When a merchant connects Stripe, we use the Stripe Connect OAuth flow to obtain the merchant's Stripe account ID. All payment link and invoice creation is performed via Stripe's API using our platform's credentials together with a Stripe-Account header identifying the merchant's connected account. We never receive or store the merchant's own Stripe secret key. Funds from payment links and invoices flow directly from the payer to the merchant's Stripe account — we do not touch the money.
When a merchant connects Square, we obtain OAuth access and refresh tokens from Square via the OAuth 2.0 flow, scoped to the minimum permissions required (PAYMENTS_WRITE, ORDERS_WRITE, INVOICES_WRITE, CUSTOMERS_WRITE, MERCHANT_PROFILE_READ). We use these tokens solely to create payment links, invoices, and related customer/order records during calls. Tokens are stored encrypted in AWS Secrets Manager, automatically refreshed before expiry, and revoked when the merchant clicks "Disconnect" in their portal. Funds flow directly from the payer to the merchant's Square account — we do not touch the money.
Merchants may revoke any integration at any time by clicking "Disconnect" on the relevant provider in their ScoreACut portal Settings page, or by revoking directly through Stripe's, Square's, or Google's own dashboards. Upon revocation, the associated tokens are deleted from our systems within 24 hours.
We do not store, process, or transmit cardholder data. When an end user pays a deposit or invoice generated through our platform, they interact directly with Stripe's or Square's hosted payment pages. The card number, expiry, and CVV are entered on the processor's infrastructure and never traverse our systems. This keeps us out of PCI DSS scope for cardholder data environments.
We send SMS messages only when an end user explicitly consents during a phone call with our voice assistant. Messages are limited to appointment confirmations, quote follow-ups, and payment/invoice links triggered by the same call. We do not send marketing, promotional, or recurring messages. You can opt out at any time by replying STOP to any message. Standard message and data rates may apply. Typical frequency: one message per booking or payment request.
Our phone system uses AI-powered voice assistants to handle inbound calls. This includes AI language models to conduct conversations, AI voice synthesis to generate spoken responses, and AI transcription to convert speech to text. Your call audio and transcribed text are processed by these AI service providers solely to facilitate the call and execute the merchant's requested actions (booking, quoting, payment link generation). We do not use your data to train AI models.
The specific service providers we use for these capabilities include:
Each provider receives only the minimum data needed to perform its function and is contractually bound to handle your data in accordance with their own privacy commitments.
We do not sell, rent, or trade personal information. We share information only with:
We implement technical and organizational measures to protect personal information, including encryption in transit (TLS) and at rest, IAM-scoped access to sensitive stores, OAuth token storage in AWS Secrets Manager, and the principle of least privilege for internal access. No method of transmission or storage is completely secure, but we follow industry-standard practices.
We retain personal information only as long as necessary to fulfill the purposes described in this policy or as required by law. Inbound call recordings and transcripts are retained for up to 12 months. OAuth tokens are deleted immediately upon disconnection. Billing records are retained as required by tax and accounting regulations.
Account cancellation: when a tenant cancels their subscription, the account enters a 30-day soft-delete window during which the data is hidden from active use but recoverable by support on tenant request. After 30 days, all tenant data — call recordings, transcripts, contacts, connected-account tokens, and billing history — is hard-deleted from our systems and is not recoverable.
You have the right to:
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:
See also our Terms & Conditions and SMS Consent Policy.