Draft — contains unconfirmed details
Accounting Automation Hub — Privacy Policy
Effective date: [Publication date]
Operator: [Firm’s full legal name], doing business as [Trade name, if applicable] (“Firm,” “we,” “us,” or “our”)
Privacy contact: [Privacy contact email]
Business address: [Business mailing address]
1. Scope
This Privacy Policy explains how we collect, use, disclose, and retain personal information through Accounting Automation Hub (“Hub”), including its client portal, accounting workflows, Client Management features, and QuickBooks Online integration.
Separate engagement agreements, professional confidentiality obligations, and applicable law may also govern information we handle.
2. Information we process
Depending on the features used, we may process:
Account information: names, email addresses, organization affiliations, account identifiers, assigned permissions, and authentication information.
Client profile information: business names, contact details, addresses, services provided, relationship dates, and internal service notes.
Accounting and workflow information: uploaded documents, payroll and financial reports, checklist information, and generated outputs.
QuickBooks information: the connected company’s identifier and name; customer identifiers and details used to link clients; and invoice information such as invoice numbers, transaction dates, due dates, currency, totals, and outstanding balances.
Connection information: authorization tokens and connection records needed to maintain the QuickBooks integration.
Technical information: security and operational logs, error information, and browser or device information generated when the Hub is used.
Do not submit information that is unnecessary for the authorized task.
3. Sources and purposes
We receive information from users, Firm personnel, and connected services that an authorized administrator chooses to connect.
We use information to:
Authenticate users and apply access permissions.
Maintain client records and provide requested accounting workflows.
Match client profiles to explicitly selected QuickBooks customers and display invoice history.
Support users, diagnose problems, and maintain service reliability.
Detect and respond to misuse or security incidents.
Meet applicable legal, professional, and recordkeeping obligations.
[Confirm before publication: The Firm does not sell personal information or use QuickBooks data for advertising, unrelated profiling, or training general-purpose AI models.]
4. QuickBooks authorization and access
A Firm administrator authorizes the Hub’s connection through Intuit. The Hub uses that connection to retrieve information from the Firm’s selected QuickBooks Online company.
The current invoice history feature performs reads of company, customer, and invoice information. It does not create, send, modify, or pay QuickBooks invoices.
Client profiles are linked to QuickBooks customers through an explicit selection. Access to Client Management and invoice history is restricted to authorized staff using verified blazak.cpa accounts. Client portal users do not receive access to these internal CRM features.
Intuit’s own processing is governed by its privacy notices and terms.
5. Service providers and disclosures
We disclose information as necessary to service providers that support hosting, databases, authentication, storage, and operation of the Hub. The current platform uses Lovable and Supabase services.
[Confirm and complete the provider list, including any additional hosting, monitoring, document processing, or AI services that receive personal information.]
Information may also be disclosed:
To authorized Firm personnel and other recipients you authorize.
When required by law, legal process, or professional obligations.
As reasonably necessary to protect rights, investigate misuse, or respond to security incidents.
In connection with a business transfer, subject to applicable confidentiality and legal requirements.
6. Security
The Hub uses access controls to restrict information according to authorization. QuickBooks authorization tokens are encrypted in server-side storage and are not made available through ordinary user-facing database access.
These measures reduce risk, but no system can guarantee absolute security. Users must protect their accounts and promptly report suspected unauthorized access.
7. Retention and deletion
We retain information for the periods needed to provide services and satisfy applicable legal, professional, security, and recordkeeping obligations.
[Insert the Firm’s approved retention periods or criteria for client records, uploaded files, internal notes, technical logs, QuickBooks connection credentials, and backups. Confirm whether invoice responses are cached and, if so, for how long.]
Disconnecting QuickBooks stops future authorized retrieval once revocation takes effect. It does not automatically delete client records, previously retained information, or records held separately in QuickBooks.
To request deletion or removal of retained connection information, contact [Privacy contact email]. We will evaluate requests subject to applicable obligations and explain any information we must retain. Backup copies may remain until they expire under the applicable backup schedule.
8. Your choices and requests
You may contact [Privacy contact email] to request access to, correction of, or deletion of your personal information, or to raise a privacy concern.
An authorized administrator may revoke the Hub’s QuickBooks connection through Intuit’s connected-app controls. Contact us if assistance is needed.
Rights and available responses depend on applicable law, the information involved, and our legal or professional obligations. We may verify your identity and authority before fulfilling a request.
9. Cookies and browser storage
The Hub uses cookies or browser storage for authentication, session management, and security features, including the QuickBooks authorization flow.
[Confirm before publication whether analytics, advertising, or other optional tracking technologies are used, and describe any applicable choices.]
10. Processing locations
Our service providers may process information outside your state or country.
[Confirm applicable processing locations and any required cross-border transfer disclosures or safeguards.]
11. Policy changes and contact
We will post updates with a revised effective date and provide additional notice or obtain consent where required.
For privacy questions or requests, contact:
[Firm’s full legal name]
[Privacy contact email]
[Business mailing address]