Privacy Policy

Effective: April 2026 · Kaizen CFO Services LLC · Miami, FL

1. Overview

This Privacy Policy describes how Kaizen CFO Services LLC ("Kaizen," "we," "us") collects, uses, shares, and protects information when you use the Kaizen API service ("Service") to connect your QuickBooks Online account to AI-powered tools.

Kaizen does not process User Data on Intuit's behalf. We are an independent controller of the data we access through the QuickBooks Online API, and Intuit is an independent controller of data within the QuickBooks Online platform.

2. Information We Collect

2a. Account Information (stored)

• QuickBooks company identifier (realm ID) and company name
• OAuth tokens (access and refresh tokens for QBO API access)
• API key hash (SHA-256 — we never store your raw API key)

2b. Usage Data (stored)

• Audit logs: API action performed, HTTP method, path, response status, duration, IP address, timestamp
• Entity references: type and ID of QBO entities accessed (e.g., "Invoice #1234")

2c. QuickBooks Financial Data (NOT stored)

• Financial transactions, entities, reports, and other QBO data are passed through in real time to your AI tool and are not stored by Kaizen
• This data resides in QuickBooks Online (controlled by Intuit) and in your AI tool's context window

3. How We Use Your Information

We use your information solely to provide the functionality of the Service:

• OAuth tokens: to authenticate API calls to QuickBooks Online on your behalf
• API key hash: to authenticate your requests to the Kaizen API
• Audit logs: to maintain a security record of all actions performed through your account
• Company identifier: to route requests to the correct QuickBooks company

We do not use your data for advertising, profiling, marketing, or any purpose unrelated to providing the Service.

4. Third-Party Data Sharing

We share data with the following categories of third parties:

Third Party	Purpose	Data Shared	Retention
Anthropic (Claude API)	AI inference — analysis, categorization, automation	QBO financial data (pass-through)	7 days (API logs), never trained on
Google Cloud Platform	Infrastructure — Firestore, Secret Manager, Cloud Run	OAuth tokens, tenant records, audit logs	Until deletion
Intuit (QuickBooks API)	Data source — read/write QBO data	OAuth tokens, API queries	Per Intuit's terms

We do not sell your data. We do not share your data with any party not listed above. If we add new third-party processors, we will update this policy.

5. Data Security

We protect your data with:

• Encryption at rest: OAuth tokens stored in Google Secret Manager (AES-256)
• Encryption in transit: All communication over HTTPS (TLS 1.2+)
• Key security: API keys hashed with SHA-256 before storage; raw keys shown once and never stored
• Access control: 26 granular scopes limit what each API key can access
• Tenant isolation: each connected company's data is isolated by realm ID
• Audit trail: every API action is logged with timestamp, IP, and action details
• Guardrails: configurable limits on financial operations (e.g., max invoice amount, JE balance enforcement)

6. Your Rights

You have the following rights regarding your data:

• Disconnect: Revoke Kaizen's access to your QuickBooks data at any time by disconnecting through the Service or through QuickBooks Online (Settings > Manage apps)
• Data deletion: Request deletion of all your data (tenant record, API keys, audit logs, OAuth tokens) by contacting administrator@kaizencfo.com
• Data access: Request a copy of the data we hold about your account
• Correction: Request correction of inaccurate account information

Upon disconnection, we immediately revoke all API keys and delete OAuth tokens. Additional data (audit logs, tenant record) is retained until you request full deletion.

7. Data Retention

• OAuth tokens: deleted immediately upon disconnection
• API keys: revoked immediately upon disconnection; key hashes retained for audit purposes until full deletion is requested
• Audit logs: retained until you request deletion
• Tenant record: retained until you request deletion
• QBO financial data: not stored by Kaizen; passed through in real time

8. International Data Transfers

The Service is hosted on Google Cloud Platform in the United States (us-central1 region). If you are located outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

For users subject to GDPR: Kaizen and the user are independent controllers (not joint controllers) of personal data, as outlined in the Intuit Developer Terms of Service (Section 12.4).

9. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Service. The "Effective" date at the top of this page indicates when the policy was last updated.

11. Contact

For privacy inquiries, data deletion requests, or questions about this policy:

Kaizen CFO Services LLC
Email: administrator@kaizencfo.com
Miami, FL