Privacy Policy

Who we are and what this policy covers

Insightly LLC operates the private accounting data service at qbo.insightlybi.com (the “Service”). This policy explains how we handle information obtained through the Service, including connected QuickBooks Online companies and authenticated query clients.

We operate independently of Intuit and do not process this information on Intuit’s behalf. This policy describes our Service; Intuit, OpenAI and other independent providers have their own policies for the products and accounts they provide. Questions and privacy requests may be sent to admin@insightlybi.com.

Information we collect

• Company and accounting information. Company identifiers and settings, currencies, accounting preferences, chart of accounts, customers, vendors, items, classes or departments, supported recorded transactions, linked records and official financial reports. Records may include names, business contact details, addresses, amounts, dates, descriptions and other information contained in those accounting records.
• Connection and authorization information. Company connection identifiers, authorization tokens, expiry times and connection status. We do not collect your Intuit password.
• Service and security information. Administrator sessions, query-access credential digests, synchronization checkpoints, retrieval times, API usage counts, audit events and error codes. Network infrastructure may process IP addresses, request headers and connection details needed to deliver and secure the Service.
• Communications. Information you provide when contacting us about support, access or privacy requests.

The current integration does not request payroll records or unreviewed bank-feed transactions. Its actual contents depend on the connected companies and the fields returned by supported QuickBooks APIs.

Where information comes from

Accounting information comes from QuickBooks Online after a person with the necessary company permissions authorizes the connection. Other information comes from your use of the Service, your chosen query client, or communications you send to us. Each QuickBooks company requires its own authorization.

Only connect companies whose data you are entitled to access, and ensure that your organization has the permissions and notices required for the information it makes available.

How we use information

We use information to maintain authorized connections; retrieve, organize and update accounting records; provide reports and requested comparisons; answer authorized queries; identify stale or incomplete data; protect access; troubleshoot failures; respond to requests; and meet applicable legal obligations.

We do not sell accounting information, use it for targeted advertising, or operate advertising trackers on these pages. The application does not train its own AI models on your accounting records. If information is sent to an AI client at your request, that provider’s processing is governed by the applicable account terms and settings, as explained below.

When information is disclosed

• Authorized users and query clients. Information is returned to the person or application presenting valid access credentials. When you query through Codex, relevant results are transmitted to Codex / OpenAI for the requested analysis. Results may include transaction-level data, names and descriptions, not just aggregated totals.
• Infrastructure and support. The operator and authorized infrastructure providers may process information as necessary to host, secure, maintain and support the Service. Access is limited to the purpose and permissions of the relevant service.
• QuickBooks connectivity. Requests, company identifiers and authorization tokens are sent to Intuit as necessary for authorization and supported API operations.
• Legal and security purposes. We may disclose information where required by applicable law or reasonably necessary to investigate misuse, protect rights or respond to a security incident.

We do not promise that OpenAI or another query client has zero retention or that a particular account excludes all model training. Review your provider’s applicable terms, privacy controls and account configuration before making company data available. Copies in a chat or another client are managed separately from this Service.

Storage location and safeguards

The Service’s application database and local backups are hosted on a privately managed Linux virtual server in the United States. Query clients and other providers may process the information sent to them in locations described in their own terms and policies.

Safeguards include HTTPS for public connections, encrypted storage of QuickBooks authorization tokens, separate administrator and query credentials, restricted server-side configuration, and a dedicated database role. These safeguards do not mean that every database field or backup is individually encrypted. No system can guarantee absolute security.

Retention and backups

We retain the current synchronized dataset while needed for authorized reporting and until it is removed following an appropriate deletion or termination request, subject to applicable retention obligations. A current dataset can contain historical accounting records. Disconnecting a company does not automatically erase stored records.

• Superseded successful and abandoned synchronization snapshots become eligible for cleanup after seven days. The current published snapshot is retained for ongoing queries. Incomplete or failed runs may remain for recovery and troubleshooting until resolved or removed.
• Application audit events become eligible for cleanup after ninety days.
• Local database backups rotate on an approximately fourteen-day retention schedule. Deletion from the live database does not immediately remove existing backup copies; those copies expire through rotation. If a backup is restored, applicable deletion requests must be reapplied before normal use resumes.
• Administrator sessions expire after eight hours. Expired session and authorization-state records are removed by maintenance.

These are configured retention targets. Cleanup depends on scheduled maintenance running successfully; interruptions can delay removal. We may retain limited information longer where required by law or necessary to resolve a security incident or dispute, with access restricted to that purpose.

Your choices and privacy requests

You may disconnect a company through the administrator interface or revoke the app’s connection in QuickBooks to stop future access. Successful disconnection through the Service revokes and removes the stored authorization tokens. To request deletion of synchronized data, an available copy of your information, correction of Service records, or clarification of our processing, contact admin@insightlybi.com.

We may verify your identity and authority for the company before acting. Rights, exceptions and response periods depend on applicable law. Corrections to underlying accounting entries must be made in QuickBooks by an authorized person; this Service does not write accounting changes back to QuickBooks.

We cannot delete copies in your own exports, Codex conversations or other independent clients on your behalf. Manage those copies through the relevant provider. Please do not email passwords, access tokens or full financial records with an initial privacy request.

Cookies and similar technologies

The administrator interface uses a necessary session cookie for authentication and session security, with an eight-hour lifetime. The cookie is configured to be inaccessible to page scripts and is transmitted over HTTPS in production. Logging out clears the browser cookie and invalidates the Service session.

These pages do not use advertising cookies or third-party analytics scripts. Intuit’s authorization pages and any independent query client may use their own cookies under their policies.

Intended audience

The Service is intended for authorized business use by adults, not for children. We do not knowingly solicit information from children. If you believe information has been provided without appropriate authority, contact us so we can review and address the issue.

Policy updates and language

We may update this policy when our processing practices, Service or applicable requirements change. The effective date and version are displayed on this page. We will provide additional notice or obtain consent when required. Material changes to data use must be reflected in the policy before they take effect.

The English version is the primary text; the Chinese version is provided for convenience. If the versions differ, the English text governs to the extent permitted by applicable law.

Contact and related documents

Use of the Service is governed by our End User License Agreement. For independent providers, see Intuit’s Privacy Statement and OpenAI’s Privacy Policy, together with the terms applicable to your account.