Privacy Policy

Draft for review. This document is a working draft prepared to support third-party application review (including the Intuit Developer portal). It should be reviewed and approved by qualified legal counsel before it is relied upon.

1. Who we are and how to contact us

The data controller is Qubere, Inc., [registered address]. For privacy questions, requests, or complaints, contact us at privacy@qubere.ai.

2. Scope

This policy applies to information we process as a controller — for example, information about the representatives of our customers and prospects, and visitors to our website. When our customers use the Services to process data about their own customers, shipments, suppliers, and financial records, we act as a processor on the customer’s behalf, and that processing is governed by our agreement with the customer.

3. Information we collect

3.1 Information you provide

• Account and profile data — name, work email, phone number, employer, role, and authentication identifiers.
• Customer content — commercial invoices, packing lists, product and classification data, party master records, shipment and entry data, billing and rate data, and documents you upload or generate in the Services.
• Support and communications — messages, feedback, and correspondence you send us.

3.2 Information from connected third-party services

When you connect a third-party system to the Services, we receive data from that system as directed by you. This includes:

• QuickBooks Online / Intuit. With your authorization via Intuit’s OAuth 2.0 flow, we access your QuickBooks company (realm) identifier, company profile, and the accounting records needed to synchronize billing — including customers, items, accounts, tax codes, invoices, and payments. We request the com.intuit.quickbooks.accounting scope only.
• Other integrations — ERP, transportation, tracking, and accounting providers you choose to connect, limited to the data required for the feature you enable.

3.3 Information collected automatically

• Usage and log data — IP address, device and browser type, pages and features used, timestamps, referring URLs, and diagnostic/error data.
• Cookies and similar technologies — used for authentication, security, preferences, and aggregate analytics. We do not use advertising cookies.

4. How we use information

• Provide, operate, secure, and maintain the Services.
• Synchronize records between the Services and systems you connect (for example, creating or updating invoices, customers, and payments in QuickBooks Online at your direction).
• Authenticate users, prevent fraud and abuse, and enforce our terms.
• Provide customer support and respond to requests.
• Monitor, troubleshoot, and improve the Services, including aggregated and de-identified analytics.
• Comply with legal obligations and enforce our legal rights.

Where required by law, our legal bases for processing are performance of a contract, legitimate interests (operating and improving the Services and keeping them secure), consent (where requested), and compliance with legal obligations.

5. Use of Intuit / QuickBooks Online data

We specifically commit that:

• We access QuickBooks data only to provide user-requested functionality (billing synchronization and reconciliation).
• We do not use Intuit data for advertising, and we do not sell or rent Intuit data.
• We store the minimum QuickBooks data necessary to operate the integration and to show you sync history; OAuth tokens are encrypted at rest.
• When you disconnect QuickBooks, or on request, we revoke the connection and delete or de-identify the associated tokens and cached QuickBooks records within [30] days, except where retention is required for legal or audit purposes.
• Our processing of Intuit data complies with the Intuit Developer and API Terms of Service.

6. How we disclose information

We do not sell personal information. We disclose information to:

• Service providers / subprocessors that process data on our behalf under contract — including cloud hosting and infrastructure, database hosting, error and performance monitoring, email delivery, and AI/document-processing providers used to power platform features. A current list is available at [subprocessors URL] or on request.
• Systems you connect, such as QuickBooks Online, when you direct data to be sent there.
• Legal and safety — to comply with law, legal process, or lawful requests; to enforce agreements; or to protect the rights, property, or safety of Qubere, our users, or the public.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

7. International transfers

We are based in the United States and may process information in the United States and other countries. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses.

8. Data retention

We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Customer content is retained per our customer agreement; upon termination, customer content is deleted or returned within the period stated in that agreement. Backups are purged on a rolling schedule.

9. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit (TLS) and at rest, tenant isolation, least-privilege access controls, audit logging, and monitoring. No method of transmission or storage is completely secure.

10. Your rights and choices

Depending on your location, you may have the right to access, correct, delete, or port your personal information; to object to or restrict certain processing; and to withdraw consent. To exercise these rights, contact privacy@qubere.ai. If we process your information on behalf of a customer, we will refer your request to that customer. You may also have the right to lodge a complaint with a supervisory authority.

US state privacy rights. Residents of California and other US states with comprehensive privacy laws may exercise the rights described above. We do not “sell” or “share” personal information for cross-context behavioral advertising.

11. Children’s privacy

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will provide notice through the Services or by other means. The “Last updated” date above indicates when this policy was last revised.

13. Contact

Qubere, Inc. — privacy@qubere.ai — [registered address].