Privacy policy

1. The short version

• SuiteMemo stores the notes written about your NetSuite account's saved searches, plus what it needs to attach each note to the right search: the search's script id, numeric id, title and record type, and your NetSuite account number.
• It reads who is signed in from the NetSuite page (your NetSuite user id, email, name and role) so notes can say who edited them and so admins can be recognised. It never reads saved search results, NetSuite record data or your NetSuite login.
• Notes belong to the NetSuite account. Everyone on that account who has SuiteMemo sees the same notes. They sync to our servers once you press Continue on the first-run screen, with no sign-in needed. Local-only mode keeps them on your computer instead.
• Only the person who pays for Unlimited signs in with an email address.
• We do not sell data, show ads, or use analytics or trackers.
• You can download the data we hold about your sign-in and delete it yourself, from SuiteMemo's Settings page. Notes belong to the account, not to you, so they stay.

2. Who we are

SuiteMemo is provided by SuiteSQR LLC, a Florida limited liability company, PO Box 540282, Greenacres, FL 33454 ("we", "us"). We decide how the data described here is used. Contact: support@suitememo.com [mailbox not live yet].

SuiteMemo is not made by, affiliated with or endorsed by Oracle or NetSuite.

3. What SuiteMemo reads on NetSuite pages

The extension runs only on these five NetSuite page addresses, in any NetSuite account (https://<account>.app.netsuite.com):

• /app/common/search/savedsearchlist.nl (the saved search list)
• /app/common/search/search.nl and /app/common/search/savedsearch.nl (a search's edit page)
• /app/common/search/searchresults.nl and /app/common/search/savedsearchresults.nl (a search's results)

On those pages it reads: the search's internal id (from the page address or the list row), its script id, title and record type (from the list row or the edit page), and your NetSuite account number and environment from the page address (for example 1234567 is production and 1234567-sb1 is a sandbox of the same account). It also asks the page who is signed in: a small script runs in the page's own context, calls NetSuite's own nlapiGetContext() function, and passes back your NetSuite user id, email, name and role (the role's id, script id, name and center). That script reads nothing else and sends one message back to the extension. SuiteMemo then adds its own note line or notes panel to the page. It does not run on any other website and has no permission to read other pages.

Until you press Continue on SuiteMemo's first-run screen, which explains what is stored and where, the extension only checks the page address to show a "finish setup" bar. Nothing from the page is stored or sent before that.

4. Data we handle and why

We use this data only to provide SuiteMemo's single purpose, notes on NetSuite saved searches, and the account, billing, security and support that go with it.

5. What we never collect

• Saved search results, or any NetSuite record data.
• Your NetSuite password, session cookies or any other credential. The user id, name, email and role we read are what the NetSuite page already knows about you; we never read or store anything that could sign in to NetSuite.
• Your browsing history. SuiteMemo keeps, in your browser only, the ids of the searches that have appeared in your saved search list, so the running list shows only those. That list is never sent to us.
• Anything from websites other than the five NetSuite page addresses above.
• Analytics, advertising identifiers or tracking. The extension and this website load no third-party scripts.

We do not sell personal data, share it for advertising, or use it to decide creditworthiness or lending.

6. When data leaves your computer

1. When you press Continue on the first-run screen (nothing is sent before that), the extension contacts our server. That request carries the random install id and the extension version. Our server opens an anonymous session for it, which records the IP address and browser user-agent of the request.
2. After you press Continue and open a saved search page, the extension sends that account's number and environment, and the user id, email, name and role it read from the page, with its next plan check. After that, it checks the account's plan with the server every 6 hours and when you open a saved search page. Those checks carry the install id, the extension version and the account and user details above, never note text.
3. With local-only mode off, notes written on the account (with their search details) sync to our server about every 15 minutes, shortly after you save, and when you open a saved search page. No sign-in is needed for this.
4. When you sign in (only needed to pay), your email address goes to our server and to Resend, which emails you the code.
5. When you subscribe, you go to a Stripe checkout page. Stripe receives your email and the payment details you type there.

In local-only mode, step 3 never happens, but steps 1 and 2 still do, so the extension can check the account's plan. No note text is sent.

7. Service providers

We use these companies to run SuiteMemo. They process data on our behalf and only to provide their service to us. We do not give your data to anyone else, except where the law requires it.

Stripe's own privacy policy also applies to what you give Stripe at checkout.

8. How long we keep it

• Notes: until someone on the account deletes the note. A deleted note leaves a marker (no text) so other computers learn it was deleted; the marker and the note's earlier versions are removed after 90 days.
• Earlier versions of a note: kept with the note on every plan, deleted with it.
• The account's member list (name, email, role, last seen): a person's row is removed 180 days after they were last seen on the account.
• Device identities that never sign in (install id, anonymous session): removed 30 days after the device was last seen.
• Sessions (with IP address and user-agent): deleted when they expire (30 days after last use), when you sign out, or when you delete your sign-in.
• Sign-in codes: valid for 10 minutes; expired codes and the records that limit repeated attempts are deleted by a daily job within 2 days.
• Your sign-in (email) and payer link: until you delete your sign-in.
• The account's subscription record: for as long as the subscription exists, and afterwards in Stripe for as long as it and we are required to keep payment and invoice records by tax and financial law.
• Server logs: our API logs only the method, path, status and response time of each request, never request bodies, tokens or email addresses; deleting a sign-in logs its internal id. Render keeps logs for [Render log retention].
• Database backups: deleted data can remain in our database provider's restore history for up to [Neon restore window], after which it is gone.

9. Your controls and how to delete

• See and download: Settings, "Download my data" (you need to be signed in) gives you a JSON file with your sign-in, the accounts you are listed on and any subscription you pay for. Settings or the toolbar popup, "Export", saves an account's notes.
• Correct: edit or delete any note on the page where it appears, if you are an editor on the account. Deleting a note removes it for everyone on the account.
• Keep notes off our servers: Settings, "Local-only mode".
• Sign out: Settings. This ends the session on our server too.
• Delete your sign-in: Settings, "Delete my sign-in", then type your email to confirm. This immediately deletes, on our servers, your sign-in, your email, your sessions and your install record, and unlinks you from the account's member list and from any subscription you pay for. It does not cancel that subscription; it keeps running for the NetSuite account, so cancel it in the billing portal first if you want it to stop. Notes belong to the account and are not touched. Your name, email and role stay on the account's member list until 180 days after you were last seen there, and your name stays on notes you edited.
• Be removed from an account's member list sooner: email us.
• Notes in your browser are not touched by deleting your sign-in. Uninstalling SuiteMemo removes everything it kept in your browser.
• Anything else: email support@suitememo.com, from the address you signed in with if you have one. We answer access, correction and deletion requests within 30 days. Depending on where you live, you may have further rights under data protection law, including the right to complain to your local regulator. [owner: legal review for GDPR/UK GDPR/CCPA wording]

10. Notes are shared on a NetSuite account

• There is one note per saved search, shared by the whole account; there are no notes only you can see. A note is visible to everyone on that NetSuite account who has SuiteMemo and whose saved search list includes that search. Admins see every note on the account.
• Each note shows the name of whoever last edited it, read from the NetSuite page.
• Anyone with editor access on the account (the default) can edit or delete any note on it. Admins can set a person to viewer, who can read but not change notes.
• Admins see the account's member list: each person's name, email, NetSuite role, when they were last seen and in which environments. Admins are the people whose NetSuite role is in the account's admin role list; Administrator is there by default and admins can change the list.
• Production and sandboxes of one NetSuite account share the same notes and the same member list.

11. Security

• All traffic between the extension and our API uses HTTPS. Our API connects to the database over TLS with certificate checking.
• The database is encrypted at rest by Neon (AES-256, per Neon's documentation).
• The extension contains no keys or passwords for our database or providers. It holds only your own session token, which you can revoke by signing out.
• Sign-in codes are stored hashed, expire after 10 minutes and lock after 5 wrong tries.
• Every database query for notes is limited to the NetSuite accounts your browser has been seen on as a member.

If we learn of a breach that affects your data, we will tell you by email without undue delay.

12. Who can read your data

People on your NetSuite account read notes as described in section 10. Nobody at SuiteSQR LLC reads your notes, except:

• when you ask us to (for example, to help you recover a note), and only the data you point us to;
• when it is needed for security, such as investigating abuse;
• when the law requires it;
• in counts and totals that do not identify anyone, to run the service.

13. Chrome Web Store: Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

In plain terms: SuiteMemo's use of the data it handles through the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use it only to provide and improve SuiteMemo's single purpose. We transfer it only to the service providers in section 7, to run that purpose, or when the law requires it. We do not use or transfer it for advertising, and do not sell it to data brokers or anyone else. People read it only as described in sections 10 and 12.

14. Microsoft Edge users

This section is for people who installed SuiteMemo from the Microsoft Edge Add-ons website. It applies on its own; you do not need to read the rest of this page to understand it.

• What SuiteMemo does in Microsoft Edge: it adds notes to NetSuite saved search pages (the list, the edit page and the results page) and nothing else. It runs only on those NetSuite page addresses. Notes belong to the NetSuite account and are shared with everyone on that account who has SuiteMemo.
• What it reads on those pages: each search's script id, numeric id, title and record type; the NetSuite account number and environment from the page address; and, from the page's own script, your NetSuite user id, email, name and role.
• What it stores in Microsoft Edge: the account's notes, those search details, the NetSuite accounts you use it on, your NetSuite user details above, a random install id, the extension version, your SuiteMemo settings, a session token and, if you sign in to pay, your email. This is kept in Microsoft Edge's extension storage on your computer.
• What it sends to us: after you press Continue on the first-run screen: the install id, extension version, NetSuite account numbers and your NetSuite user id, email, name and role, to check the account's plan and list who has SuiteMemo on it; with local-only mode off, the notes with their search details, so everyone on the account sees them; your email if you sign in to pay. Our server also records the IP address and user-agent of each session.
• What it never reads: saved search results, NetSuite record data, NetSuite credentials, other websites, or your browsing history.
• Who else gets it: only our service providers Neon (database), Render (servers), Stripe (payments) and Resend (sign-in email), all in the USA, and only to run SuiteMemo. We do not sell or broker data and do not share it for advertising or for any other purpose.
• Your controls in Microsoft Edge: turn on "Local-only mode" in SuiteMemo's Settings to stop sending notes; "Sign out" to end your session; "Download my data" to get a copy of your sign-in data; "Delete my sign-in" to remove your sign-in, email and sessions from our servers immediately (notes belong to the account and stay). To stop all data handling, remove SuiteMemo from edge://extensions, which also deletes everything it kept in Microsoft Edge.
• Payments: SuiteMemo is sold by SuiteSQR LLC through Stripe. Microsoft is not the seller and does not receive your payment details from us.
• Retention and security: as in sections 8 and 11. Notes: until someone on the account deletes them. Member list rows: 180 days after last seen. Device identities that never sign in: 30 days after last seen. Sessions: 30 days from last use. All traffic over HTTPS; database encrypted at rest.
• Contact: support@suitememo.com.

15. Children, location, changes

SuiteMemo is a business tool for NetSuite users and is not meant for children under 16. We do not knowingly collect data from them.

Our servers and service providers are in the United States. If you use SuiteMemo from elsewhere, your data is transferred to and stored in the United States. [owner: transfer mechanism for EU/UK users, if selling there]

If we change this policy, we will update the effective date at the top. If a change affects how we use data we already hold, we will tell signed-in users by email before it takes effect, and the extension's first-run screen will be updated to match.

16. Contact

SuiteSQR LLC, PO Box 540282, Greenacres, FL 33454
Email: support@suitememo.com