Privacy Policy

• To provide bookkeeping, reconciliations, financial reporting, and the Deliverables under your selected tier.
• To generate AI-assisted summaries and insights, which are reviewed by our team before they are finalized.
• To connect to and sync data with the accounts you authorize.
• To operate, secure, support, and improve the Service and our systems.
• To administer your account, process billing, and communicate with you.
• To meet legal, tax, and accounting obligations.

Our legal bases for handling personal information are: your consent; performing our contract with you; meeting our legal obligations; and our legitimate interests in operating and securing the Service. We do not sell your data, we do not share it for targeted (cross-context) advertising, and we do not use your financial data for advertising.

We share information only as needed to run the Service, and never with unrelated third parties for their own marketing:

We do not export your QuickBooks or banking data to unrelated third parties, and we do not sell your personal information.

• We access QuickBooks Online, banking, and payroll data only after you authorize the connection through the provider's secure flow.
• You are responsible for your own subscriptions and for complying with the terms of those third-party platforms.
• You can disconnect any connected account at any time, from within the Service or from that provider's settings. Disconnecting stops future access; data already received is handled under Section 16 (Retention).

We use Plaid Inc. ("Plaid") to connect your bank or financial institution to the Service. When you link an account through Plaid, you authorize Plaid to collect financial information from your institution and share it with us so we can provide bookkeeping and reporting. Plaid handles your information under Plaid's own end-user privacy policy.

By connecting an account, you also agree to Plaid's End User Privacy Policy, available at plaid.com/legal/#end-user-privacy-policy.

We request only the data needed to deliver the Service, and we protect it as described in Section 14. You can revoke Plaid's access at any time through your connection settings in the Service or through Plaid's portal at my.plaid.com.

We maintain administrative, technical, and physical safeguards designed to protect your data, including:

• Encryption of data in transit using TLS 1.2 or higher, and encryption of stored data — including connection tokens — at rest using strong, industry-standard encryption (such as AES-256).
• Multi-factor authentication and role-based, least-privilege access controls, so access to Client Data is limited to authorized personnel and vetted subcontractors who need it to deliver the Service.
• Secrets and encryption keys held in a managed key/secret store, not in our application code.
• Logging, monitoring, and regular vulnerability scanning and patching of our systems.
• A written information security program, access reviews, and security training for our team, reviewed on a regular basis.
• Due-diligence and confidentiality requirements for the service providers we use.

No method of transmission or storage is perfectly secure, and you are responsible for keeping your own login credentials confidential and using strong authentication.

We keep your data only as long as we need it to provide the Service and to meet legal, tax, and accounting requirements. When data is no longer needed, we delete or de-identify it, except records we must keep by law. General guidelines:

On termination, we provide your final completed Deliverables and may revoke access to the software, as described in your agreement. You may request deletion of your personal information as described in Section 17, subject to records we must retain by law.

Depending on where you are located, you may have the right to access, correct, delete, or receive a copy of your personal information, to withdraw consent, and to ask how we handle your data. We do not discriminate against you for exercising these rights.

Canada (PIPEDA)

Canadian clients are covered by the Personal Information Protection and Electronic Documents Act (PIPEDA). You may access and correct your personal information and file a complaint with our Privacy Officer or with the Office of the Privacy Commissioner of Canada.

United States (state privacy laws)

If you are a U.S. resident in a state with a privacy law (such as California, Colorado, Connecticut, Virginia, Utah, and others), you may have the right to know what we collect, to access, correct, and delete your information, to opt out of "sale" or "sharing" for targeted advertising, and to appeal a decision. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of — but you may still contact us to confirm. California residents may also request the categories of information we collect and disclose.

How to exercise your rights

• Email privacy@ironbooks.com or admin@ironbooks.com with your request.
• We will verify your identity before acting, to protect your data.
• An authorized agent may submit a request on your behalf with proof of authorization.
• We respond within the timeframe required by law (generally 30 days under PIPEDA and 45 days under most U.S. state laws), and will tell you if we need more time.
• Some records we are required to keep by law may not be deletable.

Disconnecting QuickBooks:

You can revoke the Service's access at any time inside the app, or from your Intuit account under Settings → Apps → Connected apps.

Disconnecting bank data via Plaid:

You can revoke access inside the Service or at my.plaid.com.