PrivacyPolicy

Section OneScope

The Software is a private internal tool. It is used only by McDonald Collision LLC and connects only to QuickBooks Online company files owned by McDonald Collision LLC. It has no public users, no customer accounts, and no sign-up. It is not listed on the QuickBooks App Store.

Section TwoWhat the Software accesses

Vendor records (names and IDs) from QuickBooks Online, to match a receipt to the correct existing vendor. Chart of accounts from QuickBooks Online, to post each bill to the correct expense account. Existing bill and expense records, to detect duplicates before recording anything. Vendor receipts and invoices supplied by McDonald Collision, to read the vendor, date, amount, and invoice number. OAuth access and refresh tokens issued by Intuit, to maintain the authorized connection to QuickBooks Online.

The Software accesses only the accounting scope. It does not request or receive payroll data, payments data, banking credentials, or Intuit account sign-in information.

Section ThreeWhat the Software writes

The Software creates Bill and Purchase (expense) records in the company’s own QuickBooks Online file and may attach the source receipt to the record it creates. It does not delete records, does not modify existing records it did not create, and does not make payments or move money of any kind.

Section FourPersonal information

The Software is not designed to collect personal information. It processes business-to-business documents: vendor company names, invoice numbers, dates, and amounts. A vendor receipt may incidentally contain an individual’s name, such as a salesperson or a customer reference on a parts ticket. Such information is used only to record the transaction, is not extracted into any separate database, and is not used for any other purpose. The Software does not build profiles, does not perform analytics on individuals, and does not use any data for advertising or model training.

Section FiveStorage and security

OAuth tokens are encrypted at rest with AES-256-GCM. The encryption key is stored separately from the encrypted token, so neither is usable alone. Client credentials for the Intuit application are held in encrypted configuration and are never written to logs or exposed in a browser. Receipts and invoices remain in McDonald Collision’s own Google Workspace account, under the company’s existing access controls. Processing happens in an ephemeral, isolated environment that is destroyed after each run, and QuickBooks data is not retained after a run completes. Transport to and from Intuit is over TLS. Error logs record the Intuit correlation identifier, the endpoint, and the status code, so failures can be diagnosed and reported to Intuit support; logs do not contain tokens or client secrets.

Section SixRetention

Records created in QuickBooks Online are retained by McDonald Collision under its normal accounting retention practices. Source receipts are retained in the company’s Google Workspace account. OAuth tokens are retained only while the connection is active and are destroyed when the connection is revoked. Run logs are retained for troubleshooting and then discarded.

Section SevenSharing and disclosure

McDonald Collision does not sell, rent, trade, or share data accessed by the Software with any third party. Data is transmitted only between the company’s own systems and Intuit’s QuickBooks Online API in order to perform the functions described above. The only exception is disclosure required by law, subpoena, or other valid legal process.

Section EightThird-party services

The Software relies on Intuit’s QuickBooks Online API and on Google Workspace for document storage. Each of those providers handles data under its own privacy policy, available at intuit.com/privacy/statement and policies.google.com/privacy.

Section NineRevoking access

An administrator of the QuickBooks Online company can revoke the Software’s access at any time from within QuickBooks Online, under Settings and then Manage Connected Apps. Revocation takes effect immediately and stored tokens become permanently unusable.

Section TenChildren

The Software is a business accounting tool. It is not directed to children and does not knowingly process data from anyone under 18.

Section ElevenChanges to this policy

If this policy changes, the updated version is posted at this address and the effective date above is revised.

Section TwelveContact