Hue Studios LLC ("we," "our," or "us") operates Earnest, a business management platform that helps agencies, studios, freelancers, and small businesses run their operations in one place — including customer relationships (CRM), projects and tasks, invoicing and payments, proposals and contracts, marketing, and an AI assistant (the "Director's Office") that reads across your workspace to draft and automate work. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use Earnest.
By accessing or using Earnest, you agree to this Privacy Policy. If you do not agree with its terms, please do not use the platform.
1. Your Data and Your Customers' Data
Earnest is a workspace where you manage your own business, which often includes information about your clients, contacts, and team. For the information about your account, we act as the data controller. For the business and client data you add to your workspace, we act as a service provider (processor) that handles that data on your behalf and under your instructions. You are responsible for having an appropriate basis to collect and store information about the people you add to Earnest.
2. Information We Collect
2.1 Information You Provide
- Account & Organization Information: Your name, email address, password (stored only as a secure hash), role, and workspace/organization details when you create or join an account.
- Business & Client Data: The records you create in Earnest — contacts, clients, leads, organizations, projects, tasks, notes, proposals, contracts, and related documents — which may include personal information about third parties you do business with.
- Financial Data: Invoices, expenses, payments, and billing records you manage in Earnest, and, if you enable bank sync, transaction data retrieved through our payment processor (Stripe).
- Content & Communications: Messages, meeting notes, files, marketing content, and anything you upload or create, plus information you provide when you contact us for support.
2.2 Information From Integrations
When you connect a third-party account (for example, a social media, calendar, bank, or payment service):
- Profile & Account Identifiers: Usernames, display names, profile pictures, and account IDs from the connected service.
- Authentication Tokens: OAuth access and refresh tokens that let Earnest act on your behalf. These tokens are encrypted using AES-256-GCM before storage. We never receive or store your passwords for connected services.
- Service Data: Data returned by the connected service that is needed to power the feature you enabled — for example, social analytics (followers, reach, engagement) or financial transactions.
2.3 Automatically Collected Information
- Log Data: IP address, browser type, operating system, referring URLs, pages viewed, and access times.
- Device Information: Device type, unique device identifiers, and network information.
- Cookies: We use essential cookies for authentication and session management. We do not use advertising cookies.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Earnest platform and its features
- Power AI features that read your workspace to draft, suggest, and (with your approval) automate work
- Process invoices, payments, and other transactions you initiate
- Sync with services you connect and act on your behalf where you authorize it
- Send you service-related notifications and respond to support requests
- Detect, prevent, and address fraud, abuse, security, and technical issues
- Comply with legal obligations
We do not sell your personal information, and we do not use it for third-party advertising.
4. AI Features and How Your Data Is Processed
Earnest uses artificial intelligence to read across your workspace and draft suggestions, decisions, and content for you. Here is how that works and what it means for your data:
- Grounding: To generate relevant output, Earnest processes the data in your workspace — such as contacts, projects, financial records, messages, and content you have added.
- Isolation between customers: Your workspace data is logically separated by organization. We do not use one customer's data to generate results for, or expose it to, another customer.
- Third-party AI provider: To produce AI output, we send the relevant context to our third-party large language model provider (Anthropic). We use Anthropic under business terms that prohibit it from using your data to train its models, and under which your data is retained only transiently to process each request.
- No model training on your data: We do not use your business or client data to train our own AI models.
- You stay in control: AI-generated actions that reach a client or move money are drafted for your review and require your approval before they take effect.
5. Data Storage and Security
We implement industry-standard security measures to protect your data:
- Encryption: OAuth tokens and sensitive credentials are encrypted using AES-256-GCM at rest; all data is transmitted over HTTPS/TLS.
- Access Controls: Access to production data is restricted to authorized personnel who need it to operate and support the service.
- Tenant Separation: Each organization's workspace is access-controlled so that only members you invite can see your data.
- Regular Review: We review our security practices and update them as needed.
While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
6. Third-Party Services and Sub-processors
We rely on trusted third parties to operate Earnest. They process data only as needed to provide their service to us and are bound by confidentiality and data-protection obligations. These include categories such as:
- Cloud hosting and infrastructure (Vercel and DigitalOcean) — to run the platform and store your data (United States).
- AI / large language model provider (Anthropic) — to generate AI output, under no-training business terms.
- Payment processing and bank sync (Stripe) — to process subscription and other payments and, if you enable it, retrieve bank transaction data. We do not store full card numbers.
- Email delivery (SendGrid) — to send transactional and notification emails.
- Social and calendar integrations you choose to connect (such as Instagram/Meta, TikTok, Google) — to power those specific features.
We only request the minimum access necessary to provide a feature, and you can disconnect an integration at any time. See our Data Deletion Instructions for how to disconnect accounts and delete data.
7. How We Share Your Information
We do not sell your personal information. We may share information only in these circumstances:
- Within Your Workspace: With other members of your organization and with people you explicitly share items with (such as clients you send a proposal, invoice, or portal access to).
- With Your Consent: When you authorize us to share information with a third party.
- Service Providers: With the sub-processors described above, subject to confidentiality obligations.
- Legal Requirements: When required by law, legal process, or a valid government request.
- Protection of Rights: To protect the rights, property, or safety of Earnest, our users, or others.
- Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.
8. Data Retention
We retain your information for as long as your account is active or as needed to provide the service. Specifically:
- Workspace & Account Data: Retained until you delete the item, or until you delete your account.
- Integration Tokens: Retained until you disconnect the integration or the tokens expire or are revoked.
- Financial Records: May be retained as needed to meet tax, accounting, and legal obligations.
- Activity & Security Logs: Retained for a limited period for security and audit purposes.
Upon account deletion, we will delete or anonymize your personal information within 30 days, except where retention is required by law.
9. Your Rights and Choices
Depending on your location, you may have the right to:
- Access a copy of the personal information we hold about you
- Correct inaccurate personal information
- Delete your personal information
- Export your data in a portable format
- Withdraw consent or disconnect integrations at any time
- Opt out of non-essential communications
To exercise these rights, contact us at hello@earnest.guru . If your request concerns data we process on behalf of one of our customers, we will direct the request to that customer.
10. California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- The right to know what personal information we collect, use, and disclose
- The right to request deletion of your personal information
- The right to opt out of the sale of personal information (we do not sell personal information)
- The right to non-discrimination for exercising your privacy rights
To make a request, contact us at hello@earnest.guru . We will verify your identity before processing your request.
11. International Data Transfers
Our servers are located in the United States. If you access Earnest from outside the United States, your information may be transferred to, stored, and processed in the United States. By using Earnest, you consent to this transfer.
12. Children's Privacy
Earnest is a business tool intended for use by individuals aged 18 and over. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will delete it promptly.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date. For material changes, we will provide additional notice, such as an email notification. Your continued use of Earnest after changes take effect constitutes acceptance of the updated policy.
14. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
15. Social Media Integration Disclosures
Earnest's Marketing features let you connect social media accounts to schedule and publish content and view analytics. When you connect these accounts, your use is also subject to the connected platform's own terms and privacy policy.
Instagram / Meta
We use the Instagram Graph API to publish content and retrieve analytics. Your use of Instagram through Earnest is also subject to Meta's Privacy Policy and Meta Platform Terms . We access only the data necessary to provide these features and do not store your Instagram password.
TikTok
We use the TikTok Content Posting API to publish content and view basic analytics. Your use of TikTok through Earnest is also subject to TikTok's Privacy Policy and Terms of Service . We access only the data necessary to provide these features.
You can revoke a connected account's access at any time from within Earnest or directly through the platform. See our Data Deletion Instructions for step-by-step guidance.