Privacy Policy
Who we are
SGC ("we", "us") operates a private back-office platform for the businesses it serves. This policy covers the SGC Back-Office QuickBooks Integration (the "Integration"), which connects a business's QuickBooks Online company to that business's own back-office with the business's explicit authorization.
Data we access
With a business administrator's OAuth consent, the Integration reads the following from the business's QuickBooks Online company via Intuit's official API: company information, customers, vendors, products & services, chart of accounts, invoices, payments, and bills. Access is read-only; the Integration does not write to QuickBooks. We do not access QuickBooks login credentials, and payment-card or bank credentials held by Intuit never pass through the Integration.
How we use it
The data is used solely to provide reporting and business-performance dashboards to the same business the data belongs to, and to operate and support that business's back-office under our service relationship with it. We do not sell personal or business data, we do not share it with third parties except as required to operate the service or by law, and we do not use it for advertising.
Storage and protection
- Data is stored on private, access-controlled infrastructure operated by SGC in the United States.
- All communication with Intuit and with users occurs over TLS (HTTPS).
- OAuth tokens are encrypted at rest; the encryption key is held outside the database.
- Access to the mirrored data is restricted by role-based access control to administrators and to authorized users of the connected business only. Each business's data is isolated from every other business's.
- Administrative access to the platform requires single sign-on through our identity provider; network-level restrictions further limit exposure.
Retention and deletion
Mirrored data is retained while the QuickBooks connection is active, to provide the reporting service. Disconnecting (see Disconnecting) revokes our access at Intuit immediately and purges stored tokens. Mirrored records can be deleted at any time on request to [email protected].
Intuit
Data is obtained through the Intuit QuickBooks Online API under the business's explicit consent and is also subject to Intuit's own terms and privacy practices. A business can review or revoke this Integration's access at any time from Intuit's Connected Apps page.
Changes and contact
We may update this policy; the effective date above reflects the current version. Questions and requests: [email protected].