Privacy Policy

1. About this policy

This Privacy Policy explains how 1001286238 ONTARIO INC. ("we", "us"), an Ontario, Canada corporation, handles personal information on the website qboc.hdcola.org (the "Website") and in the QuickBooks Online Agents Connector (the "Service"), which connects your QuickBooks Online account to the AI agents you choose.

We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws. We have designated a Privacy Officer who is accountable for our compliance; contact details are in section 13.

The Service is independent. QuickBooks is a registered trademark of Intuit Inc.; we are not affiliated with or endorsed by Intuit.

2. What we collect

Depending on how you use the Website and the Service, we collect:

• Website visits: technical information such as IP address, browser type and pages requested, processed by Cloudflare to deliver and protect the Website. We also use Cloudflare Web Analytics, which does not use cookies and does not track you across sites, to see aggregate traffic.
• Beta sign-up: your email address, the language of the page you used, and the date and time of your request.
• Bot protection: when you submit the sign-up form, Cloudflare Turnstile checks browser and network signals to tell people from bots.
• Connecting QuickBooks: the OAuth tokens (access token and refresh token) and company ID (realm ID) issued by Intuit when you authorize the connection. They are stored encrypted. We never see your Intuit password.
• Service logs: operational records of when an operation ran, its type, and whether it succeeded or failed. These logs do not contain your accounting content.

3. Your QuickBooks data

We do not store your QuickBooks business data (such as transactions, customers, invoices or reports). When your AI agent makes a request, the data passes through the Service in real time between QuickBooks and your agent and is not saved by us.

4. How we use information

We use personal information only to:

• provide the Service and carry out the actions you ask your AI agent to perform in your QuickBooks account;
• send beta invitations and service notices directly related to the beta (for example, the beta ending or changes to our terms);
• keep the Website and the Service secure and prevent abuse;
• understand aggregate use of the Website; and
• meet our legal obligations.

We do not send marketing emails, we do not sell personal information, we do not use it for advertising, and we do not use your QuickBooks data to train any AI model.

5. Your AI agent

When you use the Service with an AI agent such as Claude, ChatGPT or Gemini, the data QuickBooks returns to that agent is processed by the agent's provider under that provider's own terms and privacy policy. We do not control those providers. Please review their policies before you connect.

6. Who we share information with

We share information only with:

• Intuit, to operate the QuickBooks connection;
• Cloudflare, which hosts the Website, runs our database and Worker, and provides Turnstile and analytics;
• the AI agent provider you choose to use with the Service, as described in section 5;
• authorities or other parties where the law requires or permits it; and
• a successor, if our business is merged or sold, who must continue to protect your information under this policy.

7. Where information is processed

Our providers operate global infrastructure. Your information may be stored or processed in Canada, the United States or other countries, where it may be accessible to courts and authorities under local law.

8. How long we keep information

• Beta sign-up emails: until 12 months after the beta ends. Addresses of people who have not become users are then deleted.
• OAuth tokens and company ID: until you disconnect or revoke access, or ask us to delete them. We delete them within 30 days.
• Service logs: 90 days.
• Website technical logs: according to Cloudflare's retention practices.

9. Your rights and choices

You may ask to access, correct or delete your personal information, or withdraw your consent, by writing to privacy@hdcola.org. We respond within 30 days. You can also revoke the Service's access at any time from your Intuit account.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

If you live in the United States, we do not sell your personal information or share it for cross-context behavioral advertising. You may request access to or deletion of your personal information using the same address, and we will not treat you differently for doing so.

10. Cookies and local storage

We do not use advertising or tracking cookies and do not show a cookie banner. The Website stores your chosen language in your browser's local storage, only on your device and only to remember that choice. Cloudflare Turnstile may use browser storage when you submit the sign-up form, under Cloudflare's own policies.

11. Security

We protect information with reasonable safeguards, including encryption of stored tokens, encrypted connections (HTTPS) and access controls. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected people and the authorities as the law requires.

12. Children

The Website and the Service are for business use by adults and are not directed to anyone under 18. We do not knowingly collect personal information from them.

13. Changes and contact

We may update this policy. The effective date above shows the latest version, and we will tell beta users by email about material changes.

Privacy Officer, 1001286238 ONTARIO INC., Ontario, Canada. Email: privacy@hdcola.org.