Privacy Policy

Information we collect

• Account information — your name, email address, and login credentials, collected and managed by our authentication provider, Clerk. If you sign in with Google, we receive your name, email address, and profile image from Google; we never receive your Google password. Tabba does not store passwords.
• QuickBooks Online data — when you connect your QuickBooks Online company, we read financial data (invoices, expenses, balance sheet, profit and loss, and related reports) through Intuit's official API to build your dashboard, and we write the documents you upload into that company as attachments. We request read and write access to accounting data only (the com.intuit.quickbooks.accounting scope). We do not request access to QuickBooks Payments, Payroll, or your Intuit profile.
• Uploaded documents — receipts, invoices, and other files you upload through the portal, along with their file name, size, type, and a content fingerprint used to detect duplicate uploads.
• Connection records — the QuickBooks authorization tokens issued to us when you connect, your QuickBooks company ID and company name, and timestamps.
• Usage and technical information — server logs generated when you use the Service, including timestamps, request paths, and error details, used to operate, debug, and secure the Service.

We do not collect payment card or bank account numbers through the portal, and we do not ask for Social Security numbers or other government identifiers in the portal.

How we use your information

We use your information only to:

• Sync the documents you upload into your QuickBooks Online company.
• Display your financial dashboard from your QuickBooks data.
• Authenticate you and keep your account secure.
• Operate, monitor, troubleshoot, and improve the Service.
• Communicate with you about your account and the bookkeeping work we do for you.
• Comply with legal, tax, and professional recordkeeping obligations.

We do not sell or rent your information. We do not share it for cross-context behavioral advertising. We do not use your QuickBooks data or your uploaded documents for advertising, and we do not use them to train machine learning or artificial intelligence models — neither our own nor any third party's.

How your information is stored and protected

• QuickBooks tokens are encrypted at rest with AES-256-GCM before they are written to our database, using a key held only in our server environment and never in our source code. The database itself never holds a usable token.
• Everything is encrypted in transit over TLS, between your browser and the Service and between the Service and Intuit, Clerk, and our hosting providers.
• Your data is separated from other clients'. Every read and write of connection and document records is scoped to your account identifier, enforced in a single place in our code so the rule cannot be bypassed by an individual page or API route. This is covered by an automated test suite that runs against the data layer.
• Tokens are never written to logs, and error logs record messages rather than credentials.
• Access to production systems is limited to Tabba personnel who need it to operate the Service, through authenticated provider dashboards.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any regulators as required by applicable law.

How long we keep it

• Uploaded file contents are not retained. A file you upload is held only long enough to deliver it into your QuickBooks Online company — usually seconds. Once delivered, our copy is deleted and QuickBooks holds the only copy. If delivery fails, we retry automatically and keep the file until it succeeds or for up to 14 days, after which the file is deleted and the upload is marked as unsuccessful.
• Document records — the file name, size, type, status, and QuickBooks attachment ID — are kept for as long as your account is open, so you can see what synced.
• QuickBooks financial figures are not stored. Dashboard data is read live from Intuit on request and only briefly cached in memory to avoid redundant calls.
• Connection records and tokens are kept until you disconnect QuickBooks or delete your account, at which point they are deleted.
• Account information is kept by Clerk until your account is deleted.
• Server logs are retained by our hosting provider on a rolling short-term basis for operations and security.

Records that form part of our professional work product for your bookkeeping or tax engagement are retained separately from the portal, under the terms of that engagement and applicable professional and legal retention requirements.

Who we share information with

We share information only with the service providers that operate the Service on our behalf, and only as needed for them to do so:

• Intuit / QuickBooks Online — to read your financial data and store synced document attachments, under the access you authorize.
• Clerk — authentication and account management.
• Google — only if you choose to sign in with Google.
• Vercel — application hosting, temporary file staging, and server logs.
• Neon — the hosted Postgres database holding your account and document records.

We may also disclose information if required by law, subpoena, or other legal process, to enforce our agreements, or to protect the rights, safety, and property of Tabba, our clients, or the public. If Tabba is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction; we will notify you before it becomes subject to a different privacy policy.

Cookies and tracking

The portal uses cookies that are strictly necessary to operate it — principally session cookies set by Clerk to keep you signed in and to protect against cross-site request forgery. We do not use advertising cookies, and we do not track you across other websites. Blocking these cookies will prevent you from signing in.

Your choices and rights

• Disconnect QuickBooks at any time from your Account page. This revokes our access with Intuit and deletes the stored connection and tokens. You can also revoke access from within your Intuit account settings.
• Get a copy of your data. Email us and we will provide the account and document records we hold for you in a portable format.
• Correct your information. You can update your name and email in your profile, or ask us to correct anything else.
• Delete your account. Email us to request deletion. Deleting your account revokes the QuickBooks authorization at Intuit, deletes your connection and tokens, deletes your document records, and deletes any file still awaiting delivery. Attachments already delivered into your QuickBooks company remain there under your control — we cannot remove them, and you may delete them in QuickBooks. Records we must keep for professional or legal reasons are retained outside the portal as described above.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act — including the right to know what we collect, to delete it, to correct it, to receive it in a portable form, and not to be discriminated against for exercising those rights. We honor these requests from all clients regardless of residency. Because we do not sell or share personal information for advertising, there is nothing to opt out of. To make a request, email accounting@tabbaonline.com. We will verify your identity through your account before acting, and will respond within the time the applicable law requires.

Where your data is processed

The Service is operated from the United States, and our providers store and process your information in the United States. If you access the Service from elsewhere, you understand your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

Children

The Service is intended for businesses and their authorized representatives, and is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it.

Changes to this policy

We may update this policy from time to time. We'll update the "last updated" date above when we do, and for material changes we will notify account holders by email or through the portal before the change takes effect.

Contact us

Questions, requests, or privacy concerns? Email accounting@tabbaonline.com. Tabba is located in the State of Arizona, United States.