This page is written for the sales manager who has to sign off on you using this. Plain English, no hedging.
What we store
- Your email address.
- The context you enter in Settings: what you sell, who buys it, your CRM fields.
- For each visit: the text of what you said, and the write-up generated from it. Nothing else.
- If you rate a write-up, the rating and any reason you tap. If you rewrite a card by hand, we keep the version we generated alongside your replacement, so we can see where the write-up fell short. That is your own text either way, stored under the same restrictions as everything else here, and it goes when your account goes.
- Product events: that a write-up was made, that a card was copied, which field you edited. No visit content in these.
What we do not store
- Audio recordings. We never write your audio to our database. It is sent to our transcription provider, and for opted-out requests they retain it only as long as needed to produce the transcript.
- One exception, and it is on your own phone: if you record with no signal, the audio is held on your device until it can be uploaded. It is deleted from your device as soon as the transcript comes back.
- Payment card numbers. Stripe handles those; we never see them.
- Anything from your CRM. Windshield has no connection to it.
Who can see it
No other Windshield user. Every row is scoped to the account that created it, and that restriction is applied by the database itself rather than only by application code, so another signed-in user cannot read your visits. We test this directly, by querying as one account and confirming another account’s records are not returned.
Being straight about the exception: we operate the service, so a small number of our own people can access the database when required to run it, fix a fault, or comply with the law. That is true of essentially every hosted product you use, and we would rather say it than imply otherwise.
Who we send it to
- Deepgram — processes your audio to create the transcript. Windshield opts every transcription request out of Deepgram’s Model Improvement Program, so those requests are not used for model training.
- Anthropic — processes the transcript and your Settings context to generate the write-up. Anthropic does not use commercial API inputs or outputs to train its models. Under their standard API retention policy, inputs and outputs are generally deleted within 30 days, subject to limited legal and safety exceptions.
- US Census Bureau geocoder — turns an account address into map coordinates. It receives the address only. No account name, no notes, nothing about you.
- OpenStreetMap (Nominatim) — tried only for the addresses the Census geocoder cannot find. It receives the address, and for the last-resort lookup the account name, because that is often the only way to find a shop the address databases have missed. Never your notes.
- Supabase — hosts the database, in Canada.
- Vercel — hosts and serves the app.
- Stripe — handles payment. Card details never reach us.
- Resend — sends your sign-in emails.
- Google Workspace — our own email, if you write to support.
We use no advertising networks, no third-party analytics, and no session recording or heatmap tools. The usage data described above is our own, stored in our own database.
Training
We do not train models on your data. Transcription requests are opted out of Deepgram’s Model Improvement Program, and Anthropic’s commercial API terms exclude inputs and outputs from training.
How long we keep it
Visits stay until you delete them or close your account. Closing your account deletes everything at once.
Deleting your account
There is a button in the app, under Settings. It deletes every write-up, every transcript and your sign-in from our live database straight away. No waiting period, no retention pitch, and no email to us required.
It is genuinely irreversible. We hold no copy set aside for this, so once you confirm it, we cannot restore your account either.
Two honest footnotes. Our database backups exist for disaster recovery and roll off on their own schedule, so a deleted account may persist in a backup snapshot until that snapshot expires — we do not restore from them to recover deleted accounts. And content already sent to our providers follows their retention, described above, rather than disappearing the moment you press delete.
Recording other people
Windshield is built for you to talk to yourself after a visit. We do not intend it for recording customers, and recording someone without consent may be illegal where you are. That is on you, not on us.