Legal
Privacy Policy
The short version: we read your QuickBooks data to write your summaries, we never sell it, and deleting your account erases it and revokes our access to your books immediately.
This policy explains what [PIVOT LEGAL ENTITY] ("Pivot", "we", "us") collects when you use the Pivot website, dashboard, Messenger, report downloads and email newsletters, why we collect it, who else sees it, and the choices you have.
1. What we collect
Information you give us
- Email address, used to sign you in, send your sign-in codes, and deliver your newsletters.
- Password, stored only as a salted hash. We never store or see the password itself.
- Questions you type into Messenger, along with the answer Pivot gave.
Information from QuickBooks
When you approve the connection, Intuit gives us a read-only access token for your company. Using it, we read:
- Your company name and QuickBooks company ID (realm ID), and your fiscal year start
- Profit and loss, statement of cash flows, balance sheet, and receivables and payables aging reports
- Bank and credit card account names with their posted balances
We do not request or use write access. Pivot has no ability to create, edit or delete anything in your QuickBooks company.
Information collected automatically
- Session cookie, required to keep you signed in.
- Trusted-device cookie, set only if you complete a sign-in code, so that browser can skip the code for 30 days. Stored as a hash on our side.
- Server logs, including IP address, timestamps and which pages or endpoints were called, kept for security and debugging.
We do not use advertising cookies, third-party analytics, tracking pixels or session recording.
2. How we use it
- To generate your dashboard figures, weekly newsletter, Messenger answers and report PDFs
- To sign you in and protect your account with two-factor codes and rate limits
- To send transactional email: sign-in codes, password resets, deletion confirmations and your newsletters
- To keep the Service working: diagnosing errors, preventing abuse, and improving reliability
We do not sell your personal information or your financial data, we do not share it for advertising, and we do not use your accounting data to train AI models.
3. Who else processes your data
We use a small number of service providers. Each one only receives what it needs:
| Provider | Purpose | What it receives |
|---|---|---|
| Intuit (QuickBooks Online) | Source of your accounting data | Our API calls and your access token |
| Anthropic (Claude API) | Writes the summaries and Messenger answers | The report figures for the period being analyzed, and your question text |
| Resend | Delivers transactional email | Your email address and the message content |
| Render | Application hosting and database | All stored data, held on their infrastructure |
We may also disclose data if the law requires it, to protect our rights or someone's safety, or as part of a merger or acquisition, in which case we will tell you before your data moves to a new controller.
4. Where your data is held
Our application and database run in [HOSTING REGION, e.g. Render's Oregon, USA region]. Our providers may process data in other countries. If you are in the EEA or UK, transfers rely on the safeguards in our providers' data processing terms.
5. How long we keep it
- Account data, QuickBooks tokens, Messenger history: until you delete your account.
- Cached report data: refreshed at least every 15 minutes while you use Pivot, and deleted with your account.
- Pending question jobs: deleted automatically within about two days.
- Sign-in codes: expire after 10 minutes. Trusted devices: expire after 30 days, and are revoked when you reset your password.
- Server logs: kept for a short operational period by our hosting provider.
6. How we protect it
- QuickBooks tokens are encrypted at rest, so a copy of the database alone does not grant access to your books.
- All traffic runs over HTTPS.
- Passwords and sign-in codes are stored as hashes.
- Sign-in requires a second factor by email, and sensitive endpoints are rate limited.
- Our QuickBooks integration is read-only, so a compromise cannot alter your accounting records.
No system is perfectly secure. If a breach affects your data we will notify you and any regulator as the law requires.
7. Your choices and rights
- Delete everything: the settings page deletes your account immediately, revokes our QuickBooks access at Intuit, and erases your tokens, cached reports and chat history.
- Disconnect QuickBooks only: revoke Pivot in your Intuit account settings.
- Stop the newsletters: delete your account, or ask us and we will switch them off.
- Access, correction, portability or objection: email us and we will respond within the period the law allows. Depending on where you live you may also have the right to complain to your data protection authority.
We do not sell or share personal information as those terms are defined under California law, so there is nothing to opt out of.
8. Children
Pivot is a business tool and is not directed at anyone under 18. We do not knowingly collect information from children.
9. Changes to this policy
If we make a material change we will email the address on your account or show a notice in the app before it takes effect. The date at the top always reflects the current version.
10. Contact
Privacy questions or requests: [PRIVACY CONTACT EMAIL]. Postal address: [POSTAL ADDRESS].