Privacy Policy

Effective date: 2026-05-14

1. Data collected

The Service collects and stores: (a) OAuth refresh tokens issued by Intuit on behalf of the operator's QuickBooks Online realms (access tokens are never persisted — they are refreshed on each API call and held only in volatile memory for the duration of the request); (b) the realm ID and company name returned by Intuit during the OAuth callback; (c) request logs (timestamps, IP address, requested route) retained for 7 days for operational debugging.

2. Storage and security

Tokens are stored in a Cloudflare Workers KV namespace accessible only to the Worker runtime. Secrets (client ID, client secret) are stored using Cloudflare's encrypted secret store. No QuickBooks data (invoices, customers, transactions, etc.) is persisted by the Service; data is fetched from Intuit on demand and returned to the MCP client, then discarded.

3. Sharing

No data is shared with third parties. The Service does not transmit data to any service other than (a) Intuit's QuickBooks Online API (on behalf of the operator), and (b) the MCP client initiated by the operator.

4. Data retention and deletion

Tokens are deleted immediately upon disconnect via the manage page or revocation from the QuickBooks Online admin panel. Operational logs are deleted after 7 days.

5. Contact

Data requests: benjamin@rhizom.io