CaptivateClick Accounting Connector Privacy Policy

Effective date: October 20, 2026

Operator and scope

CaptivateClick, Inc., a Delaware C Corporation, operates the CaptivateClick Accounting Connector (the “Connector”). Our business address is 1111B S Governors Ave STE 50889, Dover, DE 19904, United States. Our EIN is 36-5161221. Contact team@captivateclick.com for privacy, security, or deletion requests.

This policy applies to the hosted Connector at quickbooks.captivateclick.com and its access to QuickBooks Online for authorized internal business accounting. It covers company administrators and personal information about customers, suppliers, employees, and other people appearing in connected accounting records. It does not replace the privacy notices of Intuit, an assistant provider, or a separately operated service. CaptivateClick operates independently of Intuit.

Information processed

When an administrator authorizes a company through Intuit’s OAuth process, the Connector receives the company identifier and authorization credentials, including access and refresh tokens. We do not request or store the administrator’s Intuit password.

Depending on the requested tools and permissions, the Connector can process company information, accounts, balances, invoices, bills, payments, purchases, journal entries, tax information, items, attachments, financial reports, and customer, supplier, and employee records. These records may include names, contact details, addresses, transaction descriptions, amounts, and other information entered into QuickBooks. Access to employee records does not itself provide access to a payroll service.

We process requests and results needed to perform the requested operations. The Connector does not maintain a separate general-purpose copy of the company’s accounting database. Results may nevertheless be present in memory, network requests, downloaded documents, assistant conversations, or operational error records. Connected clients may retain the information returned to them.

The hosted service and its infrastructure also process technical information such as IP addresses, request URLs, timestamps, response codes, cookies, authentication attempts, and error information. Error records can contain incidental accounting details. Authorization callback metadata may appear in platform request logs. Do not include unrelated sensitive information or credentials in tool inputs or support messages.

Purposes and legal bases

We use information to connect authorized QuickBooks companies, retrieve and review accounting information, produce reports and exports, and perform requested changes where the corresponding tools are enabled. We also use information to authenticate users, maintain service reliability, investigate errors, prevent misuse, provide support, respond to requests, and meet applicable legal duties.

We do not sell personal information obtained through the Connector or use connected accounting information for advertising, targeted advertising, or profiling for unrelated purposes.

Where applicable data protection law requires a legal basis, processing may be necessary for our legitimate interests in administering and securing our business accounting, compliance with legal obligations, performance of an applicable agreement, or consent where required. We consider the rights of affected individuals when relying on legitimate interests. QuickBooks authorization provides technical permission to access a company; it does not replace the notices, authority, or legal basis required for personal information within that company’s records.

Hosting, storage, and access controls

Public HTTPS requests pass through Cloudflare to Google Cloud Run in the europe-west1 region. OAuth credentials are stored in a private Supabase PostgreSQL schema and encrypted at the application level using AES-256-GCM. The separate encryption key and service credentials are held in Google Cloud Secret Manager. Database connections use TLS with certificate verification.

Management actions require an administrator session established with the administrator password, a Cloudflare Turnstile verification, and an authenticator or one-use recovery code. Authenticator seeds are encrypted in the private database; recovery codes are stored as hashes. A temporary MFA setup challenge expires after ten minutes. MFA enrollment remains associated with the administrator after QuickBooks disconnect, so reconnecting does not remove account security. Turnstile processes browser and technical signals to prevent automated sign-in abuse. MCP API access requires a bearer key. The Cloud Run origin additionally requires a private key supplied by the Cloudflare proxy. The runtime uses a dedicated Google service account and a database role restricted to the Connector’s schema and permitted operations. These measures reduce risk but do not guarantee absolute security.

Access keys and authorized assistant accounts must be protected by their operators. Exported information and copies stored by a client are subject to that client’s access controls. Report suspected compromise to team@captivateclick.com. We investigate reported incidents and make notifications when required by applicable law and applicable service agreements.

Providers and disclosures

We disclose information to authorized personnel and service providers as needed for the purposes above. The deployed infrastructure uses:

• Intuit: QuickBooks authorization and accounting APIs. See the Intuit privacy statement.
• Cloudflare: public HTTPS routing, proxying, and network security. Requests, authorization callbacks, and responses pass through its infrastructure. See the Cloudflare privacy policy.
• Google Cloud: application hosting, secret storage, operational logging, and infrastructure administration. See the Google Cloud privacy notice.
• Supabase: the PostgreSQL database used for encrypted credentials and connection-management information, including provider-managed database operations and backups where enabled. See the Supabase privacy policy.

Authorized operators may use approved MCP clients and assistants, including OpenAI’s Codex. When a client invokes a tool, the tool inputs and returned accounting information are available to that client and may be processed or retained by its provider. See the OpenAI privacy policy when an OpenAI client is used. A client’s processing location, retention, and contractual protections depend on the selected service, account, and settings. The Connector does not control those separate systems. Operators must review the provider’s terms and settings before granting access.

We do not use connected QuickBooks information or derived information to train or fine-tune AI or machine learning models. Authorized users must not connect a client under terms or settings that permit such use of Connector data. Third-party AI access must also satisfy applicable Intuit permissions and restrictions before it is enabled. This policy does not grant permission on Intuit’s behalf or represent that any particular client has been approved by Intuit.

We may disclose information to comply with a binding legal obligation, respond to lawful requests, investigate misuse, or protect legal rights. If a business transaction affects the Connector, information may be transferred subject to applicable confidentiality and data protection duties; we will provide any notice required by law.

International processing

CaptivateClick is a United States company. Application execution is configured in Google Cloud’s europe-west1 region, but this does not guarantee that all processing remains in that region. Intuit, Cloudflare, Google Cloud, Supabase, authorized operators, and selected assistant providers may process information in the United States, the European Economic Area, or other countries in which they operate.

Where a transfer requires additional legal safeguards, the applicable processing must use an available lawful transfer mechanism, such as an adequacy decision or appropriate contractual safeguards, including standard contractual clauses where applicable. Contact team@captivateclick.com for information about the safeguards applicable to a particular processing activity. We do not describe the service as exclusively local or exclusively EU-resident.

Retention

Retention depends on the information and purpose:

• Connection credentials remain in the active database while the connection is authorized and needed. A successful hosted disconnect revokes the authorization and deletes the active credential record. Revoking access through Intuit also stops future use of that authorization, but contact us if you also want retained Connector records removed.
• OAuth flow cookies and authorization states are valid for up to ten minutes. A valid callback consumes its state. Expired database states are cleared during subsequent connection attempts.
• Admin session cookies expire after one hour. Temporary MFA enrollment records expire after ten minutes and are purged at the next sign-in or by scheduled cleanup. Login-rate counters cover minute intervals; entries older than one hour are removed on a subsequent login attempt.
• The active connection record includes the versions and timestamp of the legal notices accepted during authorization. This metadata is removed with the connection record when hosted disconnection completes.
• Connector diagnostic records in private Supabase tables retain timestamps, operation names, HTTP status, sanitized error codes/messages and Intuit transaction identifiers (`intuit_tid`) for up to 30 days of access. Expired records become inaccessible to the runtime immediately and are permanently purged every 15 minutes. These diagnostic records may remain after disconnect until expiration. We exclude credentials, request payloads and successful accounting response bodies, and redact sensitive values from error details. Authorized administrators can download diagnostic records for troubleshooting and choose whether to share them with support. Developer support is available at adam@captivateclick.com.
• The project’s ordinary Google Cloud application and request log bucket is configured for 30 days of retention. Google-required infrastructure audit logs have a separate 400-day retention period. These logs are subject to platform access controls and are distinct from an accounting database or assistant conversation history.
• The Connector does not provide an archive for exported accounting documents. Exported files, client-side working copies, and assistant conversations are retained under the relevant operator’s or provider’s policies and account settings. Request deletion through the applicable client or provider as well as contacting us where appropriate.
• Provider-managed backups, if enabled, expire under the applicable service plan and backup settings. Removing an active record does not immediately erase every backup copy. Backup copies remain subject to access restrictions; revoked credentials must not be restored for active use without renewed authorization.
• Support correspondence, security evidence, and records needed for accounting, tax, dispute, or other legal obligations may be kept as long as reasonably necessary for those purposes or for a legally required period. We restrict further use to the applicable purpose and remove information when it is no longer needed.

We do not promise a single retention period for all information or immediate deletion from independent providers’ systems. Deleting a Connector copy does not delete the original QuickBooks record.

Disconnecting, deletion, and privacy rights

An authorized administrator may use the disconnect page or QuickBooks connected-app controls to revoke access. The hosted disconnect page requires administrator authentication to protect the company. Disconnection does not reverse completed accounting actions or automatically delete exported documents, assistant history, or records subject to legal retention.

Send privacy and deletion requests to team@captivateclick.com. Describe the relevant company or information without sending passwords, access keys, or unnecessary accounting records. We may verify identity and authority before acting and respond within applicable legal deadlines.

Depending on applicable law, you may have rights to access, correct, delete, restrict processing, obtain a portable copy, object to processing, or withdraw consent where processing relies on consent. Withdrawal does not affect the lawfulness of earlier processing. You may use an authorized representative where permitted and complain to a competent data protection authority. We do not discriminate against individuals for exercising applicable privacy rights. Where another business controls the underlying accounting record, we may direct the request to that business or assist it as appropriate.

Cookies and website use

The Connector uses an HTTP-only, secure administrator session cookie and a temporary HTTP-only, secure OAuth flow cookie. They support authentication and connection security and use SameSite=Lax. The public policy and EULA pages do not require a login or an application session cookie. Cloudflare may process technical information and use security features to protect the service. We do not install advertising trackers or analytics scripts on the Connector’s legal pages.

Changes and contact

We publish updates here with a revised effective date and provide notice of material changes as required. If a new use requires consent, we obtain that consent before the new use. Updated policies do not authorize otherwise prohibited processing.

Privacy and security contact: team@captivateclick.com

CaptivateClick, Inc., a Delaware C Corporation
1111B S Governors Ave STE 50889
Dover, DE 19904, United States
EIN: 36-5161221