QuickBooks Online Privacy Policy

This Policy covers businesses that connect a QuickBooks Online company to their Hub account; the data the Hub reads from, writes to, or keeps about that company through Intuit's QuickBooks Online Accounting API ("QuickBooks Data"); and the authorization credentials Intuit issues for the connection. It does not cover anything a business does directly in QuickBooks Online outside the Hub.

The Hub asks Intuit for one permission: accounting access. It never asks for access to QuickBooks Payments, Payroll, or bank connections.

Data the Hub writes to the connected company:

• Customers: display name, first and last name, email address, phone number, and billing address, taken from the business's own Hub records.
• Products and services: service items for the business's services, and the income account each one books to.
• Invoices and sales receipts: line descriptions, quantities, unit prices, discounts, sales tax, transaction and due dates, the document number where the company numbers its own documents, and a memo with the Hub's invoice number.
• Payments: the amount, date, and reference recorded in the Hub, applied to the matching invoice.
• Voids: an invoice the Hub sent is voided when the business voids it in the Hub.

Data the Hub reads from the connected company:

• The company's name and country.
• Its sales tax and document numbering settings.
• Existing customers and items, looked up by email address, phone number, or name, so the Hub links to a record that already exists instead of creating a duplicate.
• Its active income accounts, to choose where a new service item books.
• Once, when a business first connects: the names and types of its accounts, and its sales receipts and deposits from the previous 30 days, to check whether a card processor already sends its sales to QuickBooks so nothing is recorded twice. The Hub keeps only the name of any processor it finds.

Other than that one-time check, the Hub does not read the company's transactions. It never reads reports, payroll, or financial statements, and it does not keep a copy of the company's books.

We use QuickBooks Data only to provide the integration the business turned on:

• to send the business's customers, invoices, sales receipts, payments, and voids from the Hub to its QuickBooks Online company;
• to avoid duplicate customers, items, documents, and payments;
• to confirm that each document's total in QuickBooks matches the Hub's to the cent, and to tell the business when something could not be sent;
• to show the business the status of its connection and of each document in its Hub dashboard; and
• to keep the connection secure, diagnose errors, and comply with the law.

We do not sell, rent, or trade QuickBooks Data. We do not use it for advertising, marketing, or profiling. We do not share it with other Hub customers, and we do not use it to train artificial intelligence or machine-learning models.

A connection starts only when the business owner signs in to Intuit and grants the Hub access on Intuit's own authorization screen. The Hub never asks for or stores a QuickBooks or Intuit username or password.

The business can disconnect at any time, in the Hub (Settings, QuickBooks, Disconnect QuickBooks) or from the connected apps in QuickBooks Online. Either way, the Hub stops sending and reading data immediately. A disconnect in the Hub deletes the stored authorization at once and asks Intuit to revoke it. A disconnect in QuickBooks revokes the authorization at Intuit, so the Hub can no longer use it, and the Hub deletes its stored copy when Intuit's disconnect notice reaches it.

The QuickBooks Data the Hub keeps is stored in our application database, hosted in the United States. We protect it with safeguards suited to its sensitivity, including:

• TLS encryption for all communication with Intuit;
• AES-256 encryption at rest for Intuit's access and refresh tokens, kept in storage no customer-facing interface can read;
• separation of each business's data, so one business can never see another's;
• access limited to the Hub's own servers and to authorized 904 Digital Media personnel; and
• the Hub's own Intuit credentials kept only in encrypted server-side configuration, never in the browser.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Hub keeps only what it needs to keep the integration accurate: the encrypted authorization tokens and when they expire; the QuickBooks company ID and name; QuickBooks' reference IDs for the customers, items, invoices, sales receipts, and payments the Hub created, with the amounts sent; the status of each and any error message; and the business's integration settings.

We do not sell QuickBooks Data. We share it only:

• with Intuit, to operate the integration the business authorized;
• with the providers that host and monitor the Hub (application hosting, database, and error monitoring), who process it only on our behalf;
• with the business's own authorized Hub users;
• with 904 Digital Media personnel, only to support the business or fix a problem at its request;
• when required by law or valid legal process, or to protect the rights, property, or safety of the business, our users, or others; and
• in connection with a merger, acquisition, or sale of assets, under confidentiality and the same limits as this Policy.

• Authorization tokens are deleted when the business disconnects in the Hub, or when Intuit's notice of a disconnect made in QuickBooks reaches the Hub.
• QuickBooks reference IDs are kept while the business uses the Hub, so its records stay consistent and nothing is sent twice if it reconnects.
• On a written request from the business, we delete the QuickBooks Data the Hub keeps within 30 days, except where the law requires us to keep it.
• Deleting data from the Hub never deletes anything from the business's QuickBooks Online company. To change or delete data in QuickBooks, the business uses QuickBooks or contacts Intuit.

If we learn of a security incident affecting QuickBooks Data in our systems, we will investigate and contain it promptly, notify affected businesses without undue delay as the law requires, and cooperate with Intuit and the authorities.

The Hub and its QuickBooks integration are for businesses. They are not directed to children under 13, and we do not knowingly collect personal information from children.

The Hub and the data it keeps are hosted in the United States. The integration is available to QuickBooks Online companies based in the United States.

QuickBooks Online is provided by Intuit under Intuit's own terms and its privacy statement at intuit.com/privacy. We are not responsible for Intuit's practices. 904 Digital Media is not affiliated with Intuit, and Intuit does not sponsor or endorse the Hub.

We may update this Policy. We will post the new version on this page with a new effective date, and tell connected businesses about material changes.

Questions, deletion requests, and disconnection requests: ryan@weare904digitalmedia.com. 904 Digital Media LLC, Jacksonville, Florida.