Privacy Policy

1. Introduction

Noah's Accounting ("we", "us", "our") respects your privacy and is committed to protecting your personal and financial data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service.

By using Noah's Accounting, you consent to the data practices described in this policy.

2. Data We Collect

2.1 Information You Provide

2.2 Information Generated by the Service

2.3 Automatically Collected Data

3. How We Use Your Data

We use your data solely for the following purposes:

• Service Delivery — Parsing documents, generating journal entries, creating financial reports
• QuickBooks Integration — Syncing data with your authorized QBO account
• Communication — Sending notifications about journal entries requiring review, receivables alerts, and service updates
• Service Improvement — Monitoring system performance, fixing bugs, and developing new features
• System Learning — Improving parsing accuracy, journal entry classification, and account mapping through human review corrections and anonymized usage patterns (see Section 5.3 for details and opt-out)
• Security — Detecting unauthorized access, preventing fraud, and maintaining system integrity
• Legal Compliance — Meeting regulatory requirements and responding to legal processes

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your data based on:

• Contractual necessity — To provide the Service you subscribed to
• Legitimate interest — Security, fraud prevention, and service improvement
• Consent — Marketing communications (if opted in) and non-essential cookies
• Legal obligation — Tax and regulatory compliance requirements

5. Data Sharing

5.1 We Share Data With

5.2 Document Processing & Google Vertex AI

Receipt and invoice documents are temporarily transmitted to Google Vertex AI (Enterprise) for parsing and classification. This transmission is governed by Google's Cloud Data Processing Addendum (CDPA).

Google does not use, store, or analyze your data for its own purposes:

• No Training Use — Under Google Vertex AI's Enterprise terms, customer data is never used to train or improve Google's models or algorithms. This is legally guaranteed by Google's Enterprise Service Level Agreements.
• No Permanent Storage — Documents are processed in real-time and deleted immediately from Google's servers upon completion of the parsing task. No data remains on Google's systems.
• Encryption in Transit — All data transmitted to Vertex AI is encrypted in transit using TLS 1.3.

⚠️ IMPORTANT: This data protection guarantee applies because we use Google's Enterprise-grade Vertex AI. Free tier tools (like Google AI Studio) do not offer these protections. We do not use free or consumer-grade tools under any circumstances.

5.3 System Learning & Service Improvement

We use technology that improves over time through the following learning mechanisms:

What we learn from:

• Journal entry corrections made during human review (e.g., reclassifying a misidentified expense category)
• Per-customer vendor/account mapping patterns (e.g., a specific vendor is consistently classified as "Office Supplies")
• Anonymized and aggregated patterns across multiple customers (e.g., common account structures for specific business types)

What we NEVER use for learning:

• Personal identifiable information (names, email addresses, phone numbers, physical addresses)
• Individual financial amounts tied to identifiable persons
• Raw document images after parsing is complete
• QuickBooks OAuth tokens or credentials

How we protect learning data:

• Learned mappings and patterns are stored as statistical models — individual transactions cannot be reverse-engineered from the learned data
• Vendor names are hashed before being used in cross-customer learning
• Aggregated patterns require a minimum threshold of 10 customers before being incorporated

Your right to opt out:

• You may opt out of having your data used for system learning at any time by contacting noooa004@gmail.com or adjusting the setting in your dashboard
• Opting out will not affect the quality of service you receive — your documents will still be processed with the same capabilities
• Opting out means your correction data and mapping patterns will not be used to improve the system for other customers
• You may opt back in at any time

5.4 We Do NOT

• Sell your personal or financial data to third parties
• Share your data for advertising purposes
• Use your financial data to train models for third parties
• Use your financial data to train or improve our own models without explicit consent (see Section 5.3 for opt-out details)
• Provide government access to your data except as required by law

5.5 Sub-processor Changes

We will notify users at least 30 days before adding or replacing sub-processors that handle personal data. A current list of sub-processors is available upon request by contacting noooa004@gmail.com.

5.6 Data Processing Agreements

All third-party service providers are bound by data processing agreements that require:

• Equivalent data protection standards
• Processing solely for the purposes we specify
• Prompt notification of any data breach
• Deletion of data upon termination of services

6. International Data Transfers

6.1 Transfer Scenarios

Your data may be transferred to and processed in countries other than your country of residence, including:

• United States — QuickBooks/Intuit, Google Cloud (Vertex AI), Cloudflare
• South Korea — Primary data storage (Supabase region)
• Singapore/Japan — Potential CDN edge locations

6.2 Safeguards

We ensure appropriate safeguards for international transfers through:

• Standard Contractual Clauses (SCCs) where required
• Data Processing Agreements with all recipients
• Encryption of data in transit and at rest

7. Data Security

7.1 Technical Measures

• Encryption at Rest — All financial data stored in Supabase is encrypted using AES-256
• Encryption in Transit — All data transmissions use TLS 1.3
• Access Control — Role-based access with minimum privilege principle
• Authentication — JWT-based authentication with short-lived tokens
• Security — Rate limiting, input validation, and CORS policies

7.2 Organizational Measures

• Access to production data is restricted to authorized personnel only
• Regular security reviews and vulnerability assessments
• Incident response plan with 72-hour notification commitment
• Employee training on data protection and security

7.3 QuickBooks Authorization Security

• OAuth tokens are encrypted at rest and stored separately from user data
• Tokens are scoped to minimum required permissions
• Users can revoke access at any time through their QuickBooks account settings
• We do not store QuickBooks login credentials

7.4 Limitations

While we implement industry-standard security measures, no system is completely secure. We cannot guarantee absolute security of your data.

8. Data Retention

Post-Cancellation:

• You may export all your data before cancellation
• After 90 days post-cancellation, all data is permanently and irreversibly deleted
• You may request immediate deletion by contacting us

9. Your Rights

9.1 General Rights

• Access — Request a copy of your personal data
• Rectification — Request correction of inaccurate data
• Deletion — Request deletion of your data
• Portability — Export your data in standard formats (CSV, JSON, XLSX) via the dashboard export feature
• Objection — Object to processing based on legitimate interest
• Restriction — Request limitation of processing in certain circumstances

9.2 GDPR-Specific Rights (EEA Users)

• Right to withdraw consent at any time
• Right to lodge a complaint with your local Data Protection Authority
• Right not to be subject to automated decision-making with legal effects

9.3 CCPA-Specific Rights (California Users)

• Right to know what personal information is collected
• Right to request deletion of personal information
• Right to opt out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising your rights

9.4 Exercising Your Rights

Contact us at noooa004@gmail.com. We will respond to requests within 30 days.

10. Cookies & Tracking

10.1 Essential Cookies

10.2 Analytics (If Enabled)

We may use privacy-respecting analytics that do not track individual users across sites. Analytics are disabled by default and require your consent.

10.3 Third-Party Cookies

QuickBooks Online OAuth may set cookies during the authorization flow. These are governed by Intuit's privacy policy.

11. Children's Privacy

Our Service is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a minor, we will delete it promptly.

12. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms:

• We will notify affected users within 72 hours of becoming aware of the breach
• Notifications will include: nature of the breach, data affected, measures taken, and recommended actions
• We will notify the relevant supervisory authority where required by law
• For QBO-related breaches, we will coordinate with Intuit's breach response procedures

13. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be notified via:

• Email notification to registered users
• Dashboard notification
• Updated "Last Updated" date on this page

Continued use after the effective date constitutes acceptance of the updated policy.