Privacy Policy

Information we collect

• Account information — your name and email, handled through our authentication provider when you sign up.
• Workspace data — the clients (consolidation groups), connected companies, and the account, customer and vendor mappings you create.
• Billing information — handled by our payment processor. We never see or store your full card number.
• Diagnostics — error reports and basic product analytics, used to keep the service working and improve it.

Your QuickBooks data

When you connect a QuickBooks Online company, you authorize Flatbooks — through Intuit’s API — to access that company’s accounting data: its trial balance, balance sheet, profit & loss, and chart of accounts; its company details (its legal name and accounting settings, such as when its fiscal year starts); the names of its customers and vendors, to find the other connected companies among them, and, for a customer or vendor that is one, its open balance and its sales or purchases by account; its journal entries, to find and check the corrections Flatbooks posts and undoes; and, when you compare two companies’ ledgers, the general ledger entries in their intercompany accounts (for a connected company kept as a customer or vendor, its entries in receivables or payables), including each entry’s name and memo. We use this only to build the consolidation, detect intercompany breaks, and produce the export. Our product analytics hears only how those checks came out (whether a consolidation tied out, and how many breaks it found), never an amount, an account, or a company’s name.

The one-click fix writes a single correcting journal entry back to a company — and only after you have reviewed and approved the exact entry. You can undo a posted fix. We request the minimum scope needed (accounting only). We store the OAuth tokens Intuit issues — encrypted at rest — never your QuickBooks username or password.

How we use it

To provide the service (consolidate, detect, fix, export), process billing, provide support, and keep the service secure and reliable. We do not sell your data or your clients’ data, and we do not use it for advertising.

Storage & security

QuickBooks tokens are encrypted at rest (AES-256-GCM). Data is transmitted over HTTPS. Connection and financial data is accessible only by our server, never exposed to the browser.

Cookies

We use a small number of first-party cookies, and no advertising or cross-site tracking cookies.

• Signing you in — a session cookie set by our authentication provider so you stay signed in. Strictly necessary.
• Connecting QuickBooks — four short-lived cookies (about ten minutes) that carry a one-time security token, remember which client you were connecting, and — when you use Reconnect — which company that button meant, so the connection can’t be forged, misrouted, or quietly swapped for a different company. They also remember the report month to return you to after connecting. They’re removed as soon as the connection finishes.
• Remembering your reporting month — the month you last selected, kept for 45 days, so returning mid-close doesn’t reset your practice to the current calendar month. A preference, nothing more.

Our product analytics runs on our server. On our public pages, and not in the app, we count visits with Vercel Web Analytics, which sets no cookies: each page view is recorded anonymously (the page, the referring site, approximate location, and device and browser type) and isn’t tied to you or your IP address. The hash it counts visitors with is discarded after 24 hours, and links are recorded without their personal parts: only campaign tags and referral codes are kept. There is no advertising script and no tracking cookie on any page. Blocking or clearing cookies won’t break the app, though you’ll be signed out and your reporting month will reset.

When you create a workspace, we keep the campaign tag of the link you first followed to Flatbooks (for example, utm_source=linkedin), or the name of the website that sent you, so we know which channels bring bookkeepers to us. The tag travels in the links themselves, so nothing is stored in your browser. It’s kept with your account and workspace, included in your record export, and deleted with your account.

Service providers

We rely on a small set of providers, each processing data only to perform their function:

• Intuit (QuickBooks Online) — the source of the accounting data you connect.
• Authentication, payments, database, hosting, and error monitoring providers — to sign you in, bill you, store your workspace data, run the app, count visits to our public pages, and detect faults.
• Email delivery (Resend) — to send the waitlist confirmation, and to tell our team when someone joins the waitlist or creates a workspace. It receives the email address and, with those notices, the number of multi-entity clients and the note given on the waitlist form, or the campaign tag or referring site a new workspace came from.
• Product analytics (PostHog) — to count, from our server, how the app is used. It receives an event each time a client’s books are consolidated afresh, keyed to your workspace and client ids, that says how the checks came out and never an amount, an account, or a company’s name; and a count of waitlist submissions that identifies no one.

Your choices

• Disconnect any time — disconnecting a company removes the connection and revokes Flatbooks’ access at Intuit. QuickBooks gives Flatbooks one grant per company, so if another Flatbooks workspace still has that company connected, we delete your copy and the grant stays with that workspace until it disconnects too.
• Delete your account — delete it yourself any time from Account settings; this disconnects your companies as above and permanently removes your data, except the billing records our payment processor, Stripe, keeps as the law requires. You can also email us.
• Access & correction — email us to access or correct your information.
• On the waitlist but not a customer — you have no account to delete; email founder@flatbooks.io and we’ll take your address off the list. The confirmation email carries the same link.

Data retention

We retain your workspace and connection data while your account is active. When you disconnect a company we remove the connection and its token, and revoke the token at Intuit unless another Flatbooks workspace still has that company connected; when you delete your account we delete your data. The one exception is billing: your billing and payment records (your email address, invoices and payments) are kept by our payment processor, Stripe, as the law requires.

Changes

We may update this policy; we’ll revise the date above when we do.

Contact

Questions about privacy: founder@flatbooks.io. See also our Terms of Service.