Privacy Policy

1Our role: controller and processor

Our role depends on the data:

• We act as a controller for information about your account with us — registration details, support communications, and usage analytics. We decide how and why that data is processed.
• We act as a processor (or “service provider”) for the QuickBooks data we access on your behalf. That data — including information about your customers, vendors, and employees — belongs to you. We process it only on your instructions to deliver the Application’s functionality.

If you are an individual whose data appears in a customer’s QuickBooks company file — for example, you are a client of a business using ClaudeBot — that business is the controller of your data. Please direct your privacy requests to them; we will assist them in responding.

2Information we collect

2.1 Information you provide

• Account information: name, business name, email address, phone number, password (stored hashed), job title.
• Support and communications: messages, attachments, and any information you share when contacting us.
• Preferences and configuration: settings, rules, mappings, and other choices you make in the Application.

2.2 Information we access from QuickBooks Online

When you authorize the connection, we access data through Intuit’s APIs within the scopes you approve. Depending on your configuration and the features you use, this may include:

• Company profile: company name, legal name, address, industry, fiscal year settings, currency, tax registration details.
• Chart of accounts and journal data: accounts, classes, locations, journal entries, ledger balances.
• Transactions: invoices, bills, payments, credit memos, estimates, purchase orders, expenses, deposits, transfers, and their line items.
• Contacts: customer and vendor records, including names, email addresses, phone numbers, billing and shipping addresses, tax IDs, and payment terms.
• Items and inventory: products, services, descriptions, pricing, quantities.
• [Employee and payroll records — include only if ClaudeBot requests payroll scopes, otherwise delete: names, employee IDs, compensation data, and related records.]
• [Banking and reconciliation data — include only if applicable: account names, masked account numbers, transaction feeds, reconciliation status.]
• [Attachments — include only if applicable: documents and images attached to records.]

2.3 Authentication data

We store OAuth 2.0 access tokens and refresh tokens issued by Intuit, along with your QBO company (“realm”) ID. We never receive, request, or store your Intuit username or password. Tokens are encrypted at rest and are used solely to make authorized API calls on your behalf.

2.4 Information collected automatically

• Log and device data: IP address, browser type and version, operating system, device identifiers, timestamps, and pages viewed.
• Usage data: features accessed, actions taken, sync frequency, error and performance events.
• Cookies and similar technologies: see Section 9.

2.5 Information from other sources

We may receive information from Intuit, such as your connection status, and from any analytics or identity providers you use to sign in.

3How we use information

We do not:

• Sell or rent personal information.
• Share personal information for cross-context behavioral advertising.
• Use your QuickBooks data for advertising or marketing to your customers.
• Use your QuickBooks data to train third-party machine learning models.

3.1 Aggregated and de-identified data. We may create aggregated or de-identified data that cannot reasonably be used to identify you or any individual, and use it for analytics, benchmarking, and product development. We will not attempt to re-identify it.

3.2 Legal bases (EEA/UK). Where GDPR applies, we rely on: contract performance (providing the Application), legitimate interests (security, service improvement, direct business communications), consent (where required, including non-essential cookies), and legal obligation.

4How we share information

We disclose information only as described below. We do not sell personal information.

4.1 Service providers (sub-processors). We use vetted vendors bound by written contracts limiting them to processing on our instructions:

A current list is available on request at [PRIVACY EMAIL]. We will provide notice of new sub-processors as described in our Data Processing Addendum.

4.2 Intuit. We exchange data with Intuit’s APIs as necessary to operate the connection you authorized. Intuit’s use of that data is governed by Intuit’s privacy policy and your agreement with Intuit.

4.3 At your direction. We share data with third parties you connect or instruct us to share with.

4.4 Legal and safety. We may disclose information when required by law, subpoena, or other legal process, or when we believe disclosure is necessary to protect our rights, investigate fraud, or prevent harm. Where legally permitted, we will notify you before disclosing your data.

4.5 Business transfers. In a merger, acquisition, financing, or sale of assets, information may be transferred as part of the transaction. We will notify you, and the recipient will be bound by terms no less protective than this Policy.

4.6 With your consent. For any other purpose disclosed to you at the time.

5Data retention and deletion

5.1 While connected. We retain data for as long as your account is active and the Application is connected to your QuickBooks company.

5.2 On disconnection. When you disconnect the Application from QuickBooks Online, we immediately revoke and delete the associated OAuth tokens and stop accessing your QBO data. We delete or de-identify cached QuickBooks data within [30] days, unless you have asked us to preserve it for a reconnection.

5.3 On account termination. We delete your account data within [90] days of termination, except as described in 5.4.

5.4 Exceptions. We may retain limited data longer where required for fraud prevention and security audit logs, resolution of disputes, enforcement of our agreements, and compliance with legal obligations. Retained data is isolated and access-restricted.

5.5 Backups. Data in encrypted backups is purged on our standard rotation cycle of up to [35] days after deletion from production systems.

5.6 On request. You may request earlier deletion at any time by emailing [PRIVACY EMAIL]. We will comply within [30] days unless retention is legally required.

6Security

We maintain administrative, technical, and physical safeguards designed to protect information, including:

• Encryption in transit (TLS 1.2+) and at rest ([e.g., AES-256]).
• Encrypted storage of OAuth tokens using [e.g., a managed key management service], with keys rotated on a [ ] schedule.
• Role-based access control and least-privilege access for personnel; access reviewed [quarterly].
• Multi-factor authentication for administrative and production systems.
• Logging, monitoring, and alerting on access to production data.
• Vulnerability management, dependency scanning, and [annual] penetration testing.
• Background checks and confidentiality obligations for personnel with data access.
• A documented incident response plan.
• [If applicable: SOC 2 Type II report available under NDA.]

Breach notification. If we become aware of a security incident affecting your personal data, we will notify you without undue delay and, where required, within the timeframes set by applicable law (for example, 72 hours under GDPR), and will notify Intuit as required under our developer obligations.

No system is perfectly secure. You are responsible for safeguarding your credentials and for using strong, unique passwords and multi-factor authentication.

7International transfers

We are based in the USA and process data in Oklahoma. If you are located outside those regions, your information will be transferred across borders. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses [and the UK Addendum]. Copies of relevant transfer mechanisms are available on request at [email protected].

8Your rights and choices

8.1 All users

• Access and correction: view and update your account information in the Application, or contact us.
• Disconnect: revoke access at any time in QuickBooks Online (Apps → Connected apps → Disconnect) or in the Application.
• Deletion: request deletion of your account and data.
• Communications: unsubscribe from product updates using the link in any such email. Service and security messages will continue.

8.2 EEA, UK, and Swiss residents (GDPR)

You have the right to access, rectify, erase, restrict, or object to processing; the right to data portability; the right to withdraw consent at any time; and the right to lodge a complaint with your supervisory authority. [If applicable: our EU Article 27 representative is [NAME/ADDRESS]; our UK representative is [NAME/ADDRESS]; our Data Protection Officer can be reached at [email protected]

8.3 California residents (CCPA/CPRA)

You have the right to know the categories and specific pieces of personal information we collect, the sources, purposes, and recipients; to delete; to correct; to opt out of sale or sharing; to limit use of sensitive personal information; and to be free from discrimination for exercising these rights.

We do not sell or share personal information as those terms are defined by the CPRA, and we do not knowingly collect personal information from individuals under 16.

Categories collected in the past 12 months: identifiers; commercial information; internet and network activity; professional or employment information; financial records accessed from your QuickBooks company file; and inferences drawn from usage. Categories disclosed for a business purpose: identifiers, commercial information, and financial records, disclosed to the service providers listed in Section 4.1.

To exercise your rights, email [email protected]. Authorized agents may submit requests with proof of authorization.

8.4 Other U.S. state laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws have similar rights, including the right to appeal a denied request. To appeal, reply to our response or email [email protected] with “Appeal” in the subject line.

8.5 How we handle requests

We will verify your identity before acting on a request, typically by confirming control of the account email. We respond within the period required by applicable law (generally 30 to 45 days) and will tell you if we need an extension. There is no fee unless the request is manifestly unfounded or excessive.

9Cookies and tracking

We use cookies and similar technologies within the Application for:

• Strictly necessary: authentication, session management, security, load balancing. These cannot be disabled.
• Functional: remembering preferences and settings.
• Analytics: understanding usage to improve the Application ([e.g., Plausible]).

You can control cookies through your browser settings. Disabling strictly necessary cookies will break core functionality.

Global Privacy Control. We honor GPC signals as a valid opt-out of sale or sharing where required by law.

10Children’s privacy

The Application is a business tool intended for users 18 and older. We do not knowingly collect personal information from children under 16. If we learn we have done so, we will delete it. Contact [PRIVACY EMAIL] if you believe a child has provided us information.

11Third-party services

The Application integrates with third-party services, including Intuit. This Policy does not cover their practices. Review their privacy policies before providing information to them.

12Changes to this policy

We may update this Policy. We will post the revised version within the Application and revise the effective date. For material changes, we will provide at least [30] days’ advance notice by email or in-app notice. Your continued use after the effective date constitutes acceptance.

13Contact us

The ArcLight Group, LLC
5272 S Lewis Ave, Suite 150
[email protected]

We aim to respond to all privacy inquiries within [10] business days.