Privacy Policy
Cohost QuickBooks (the "App") lets authorized Altri team members connect QuickBooks Online companies so that we can read accounting information for the companies we manage or advise. This policy explains what information the App handles, why, and the choices you have.
1. Who this applies to
- Altri team members who sign in to the App.
- QuickBooks company owners and administrators who authorize the App to access their company through Intuit.
2. Information we handle
- Connection details: the QuickBooks company ID (realm ID) and company name, an optional nickname set by the team member, the Intuit account identifier and email address of the person who authorized the connection, which team member made the connection, and timestamps and status.
- Authorization tokens: the OAuth access token and refresh token Intuit issues when you authorize the App. These are stored encrypted (AES-256-GCM) and are never shown in the user interface or logs.
- Team member account information: name and email, provided through our sign-in provider, to identify who is using the App.
- QuickBooks accounting data: when a team member uses the App, it requests information from QuickBooks (for example company information, customers, vendors, invoices and accounts) using the access you granted. The App uses read-only access. At this time the App retrieves this data on request and does not keep a copy of it in its database. If that changes, we will update this policy before it does.
3. How we use it
We use this information only to operate the App: to keep the connection to your QuickBooks company working, to show our team the connections they have made, and to retrieve accounting information for the internal purposes for which the connection was authorized. We do not sell your information, and we do not use it for advertising.
4. Who we share it with
We share information only with service providers that run the App for us, under their own security commitments:
- Intuit - the source of your QuickBooks data and the authorization service.
- Render - application hosting.
- Supabase - database hosting (encrypted tokens and connection details).
- Clerk - sign-in for team members.
We may also disclose information when required by law.
5. Security
Tokens are encrypted at rest and each one is cryptographically bound to the company it belongs to. All traffic uses HTTPS. A team member can see and use only the companies they connected themselves. Access to our production systems is limited to authorized personnel.
6. Retention and deletion
- Disconnecting: when a team member disconnects a company in the App, we revoke the authorization with Intuit and delete the stored tokens immediately. A minimal record (company ID, name, status and dates) is kept as an audit trail.
- Revoking from QuickBooks: you can also remove the App at any time from your Intuit account (the "My Apps" page). After that the App can no longer access your company.
- Inactivity: Intuit refresh tokens expire after 100 days without use, after which the connection must be re-authorized.
- Deletion requests: to have the remaining connection record removed, contact us at the address below.
7. Your choices and rights
You may ask us what information we hold about your connection, ask us to correct or delete it, or withdraw your authorization at any time as described above. Contact us using the details below.
8. Changes to this policy
We will post any changes on this page and update the effective date above.
9. Contact
Altri · admin@altri.ai