Privacy Policy

1. Overview

AccountingQB (“we,” “our,” or “us”) is a software product operated by NutriFitAI LLC, doing business as Vaspera Capital, a Delaware limited liability company. We are committed to protecting your privacy and being transparent about how we handle data. This policy explains what information we collect, how we use it, and your rights.

2. Zero-Knowledge Architecture

When you run AccountingQB locally (via the desktop extension or a self-hosted install), it operates with a zero-knowledge architecture. The MCP server runs locally on your machine and communicates directly with QuickBooks Online using your OAuth credentials. Your financial data — transactions, reports, account balances, and all QuickBooks content — never passes through our servers. We cannot see, access, or store your QuickBooks data.

Hosted Connector (mcp.accountingqb.com)

If you connect through our hosted remote connector instead, your QuickBooks OAuth tokens are held encrypted server-side so the connector can act on your behalf. QuickBooks data transits our service per-request and is never stored, logged, or used for analytics (“zero retention”). In both modes, we never store your books.

3. What We Collect

We collect only the minimum data necessary to operate the service:

Account information: When you start a trial or subscribe, we collect your email address and payment information (processed by Stripe — we never store card numbers).

License data: We store a license key, subscription tier, and status in our database to validate your subscription.

Usage metadata: For licensed deployments, we record which tools are run — the tool name, your QuickBooks company ID (an opaque identifier), an estimated time saved, and a timestamp — linked to your license key, to power your dashboard and improve the product. This data contains no financial information. If you run locally without a license key, no usage metadata is collected. See our Security page for details.

4. What We Do NOT Collect

We never store your QuickBooks data (transactions, reports, balances, vendor or customer information) or any financial data that flows between the MCP server and QuickBooks Online. On the local tier, that data never even reaches us; on the hosted connector, it transits per-request with zero retention. We never use your QuickBooks data for analytics.

5. How We Use Your Information

We use the information we collect to: provide and maintain the service, process payments and manage subscriptions, send transactional emails (purchase confirmations, license keys), improve the product based on aggregate usage patterns, and comply with legal obligations.

6. Third-Party Services & Sub-processors

We rely on a small set of vetted service providers (“sub-processors”) to operate AccountingQB. Each receives only the data it needs for its function. The current, itemized list — each provider, what it processes, and a link to its own policy — is maintained on our Sub-processors page. In summary: Stripe (payments), Vercel (hosting), Supabase (our database — license and billing metadata and encrypted OAuth tokens), Clerk (sign-in/identity), Resend (email delivery), PostHog (product analytics, no financial data), and Intuit (the QuickBooks connection itself). When you use AccountingQB inside an AI assistant, your prompts and the QuickBooks results you ask for are processed by that assistant's AI provider — for Claude that is Anthropic, whose commercial API does not train on or retain your data for model training. We never sell your personal information (see §10).

7. Data Security

On the local tier, QuickBooks OAuth tokens are encrypted at rest using Fernet symmetric encryption and stored locally on your machine with restricted file permissions (0600). On the hosted connector tier, OAuth tokens are held encrypted at rest on our servers and used only to fulfill your requests. License validation uses HTTPS for all API calls. We follow industry best practices for securing our infrastructure. We do not hold any security certification (such as SOC 2) today; our Security page describes exactly what we do and don't do.

8. International Data Transfers

AccountingQB is operated from the United States, and the account, license, and billing metadata we hold is stored and processed on US infrastructure (Vercel and Supabase). If you are located in Canada, the EU/UK, or elsewhere, using the service involves transferring that metadata to the United States. For Canadian customers, this means your personal information may be stored outside Canada and accessible to US authorities under applicable law (PIPEDA cross-border disclosure). Your QuickBooks financial data is not stored by us in any region — on the local tier it never reaches us, and on the hosted connector it transits per-request with zero retention.

9. Data Retention

We retain data only as long as needed for the purpose it was collected:

• QuickBooks financial data: not retained — local on your device, or zero-retention pass-through on the hosted connector.
• Account, license & billing metadata: for the life of your account and up to 90 days after cancellation, then deleted or anonymized (longer only where law requires, e.g. tax and payment records).
• Usage metadata: raw rows up to ~90 days; thereafter only aggregate, non-identifying totals.
• Audit & consent records (event logs, acceptance ledger): retained for the integrity of the audit trail; corrections are added as new rows rather than edits.
• Backups: rolling, and expire on their own schedule after the records above are removed.

10. Your Rights & Choices

Depending on where you live — including under the EU/UK GDPR, California's CCPA/CPRA, and Canada's PIPEDA — you have the right to access the personal data we hold about you, correct inaccurate data, request deletion, receive a portable copy, and withdraw consent. We do not sell or share your personal information, and we do not use it for cross-context behavioral advertising. To exercise any of these rights, use our privacy request form or email privacy@vasperacapital.com; we respond within 30 days and never discriminate against you for exercising a right. You can unsubscribe from marketing email at any time via the link in any such message.

11. Children's Privacy

AccountingQB is not intended for use by individuals under the age of 18. We do not knowingly collect information from children.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice on our website.

13. Contact Us

If you have questions about this privacy policy or our data practices, contact us at support@vasperacapital.com.

NutriFitAI LLC, d/b/a Vaspera Capital
12 Autumn Hill Ln
Southborough, MA 01772