QC Webworks LLC ("we", "us", "our") operates Total Control (the "Service"), a marketing command center platform accessible at portal.qcwebworks.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.
1. Information We Collect
1.1 Account Information
When you create an account or are provisioned as a user, we collect:
Name, email address, and username
Password (stored as a secure bcrypt hash — we never store plaintext passwords)
Role and organizational affiliation
1.2 Connected Platform Data
When you connect third-party services through our platform, we access and store data from those services on your behalf. This may include:
Google Ads: Campaign performance, keyword data, ad metrics, budget information, and conversion data
Microsoft Advertising: Campaign snapshots, keyword reports, search query data, and performance metrics
Google Analytics 4: Traffic data, page views, user demographics, device information, and conversion events
HubSpot CRM: Contacts, companies, deals, pipelines, and engagement data
WordPress Sites: Site content, pages, posts, plugins, themes, media, SEO data, and site health information
1.3 OAuth Tokens & Credentials
When you connect integrations via OAuth, we securely store refresh tokens and access tokens encrypted at rest using AES-256. We never store your third-party passwords. You may revoke access at any time by disconnecting the integration from your dashboard or revoking access directly in the third-party service.
1.4 Usage Data
We automatically collect:
Activity logs (actions taken within the portal, timestamps, IP addresses)
Uptime monitoring data for connected sites
Error logs for troubleshooting and service improvement
1.5 Feedback & Visual Bug Reports
If you use the visual feedback widget on connected sites, we collect screenshots, annotations, page URLs, browser metadata, and your written descriptions. This data is stored on our servers and accessible only to authorized users within your organization.
2. How We Use Your Information
We use collected information to:
Provide, maintain, and improve the Service
Display unified dashboards, reports, and analytics across your connected platforms
The Service may use artificial intelligence (including Claude by Anthropic) to generate insights, summaries, and recommendations based on your connected platform data. Your data is processed in real-time to answer queries and is not used to train AI models. AI-generated outputs are informational — you are responsible for any actions taken based on these insights.
4. Data Sharing & Disclosure
We do not sell your personal information or connected platform data. We may share data with:
Service Providers: Hosting providers, email delivery services, and payment processors who assist in operating the Service, bound by confidentiality obligations
Your Organization: Admins within your account can view data for users and sites under their management
White-Label Partners: If you access the Service through a white-label deployment, the deploying organization may have admin access to your account data
Legal Requirements: When required by law, subpoena, or to protect our rights, safety, or property
5. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. Upon account deletion:
Account information is deleted within 30 days
Connected platform data and OAuth tokens are deleted immediately
Activity logs are retained for up to 90 days for security purposes, then permanently deleted
Backups containing your data are purged within 60 days of deletion
6. Data Security
We implement industry-standard security measures including:
TLS/SSL encryption for all data in transit
AES-256 encryption for stored OAuth tokens and sensitive credentials
Bcrypt password hashing with appropriate cost factors
HMAC-SHA256 authentication for site-to-portal API communication
CSRF protection on all form submissions
Role-based access control (Admin, Client Admin, Client Viewer)
7. Your Rights
Depending on your jurisdiction, you may have the right to:
Session cookies: Required for authentication — expire when you close your browser or after inactivity
Theme preference: Stored in localStorage to remember your light/dark mode choice
We do not use third-party tracking cookies or advertising pixels.
9. Children's Privacy
The Service is not intended for individuals under 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us to have it removed.
10. International Data Transfers
Your data may be processed and stored on servers located in the United States. By using the Service, you consent to this transfer. We take reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Service after changes constitutes acceptance of the revised policy.
12. Contact Us
If you have questions about this Privacy Policy, contact us at: