Effective Date: April 9, 2026
AZ Finance ("we," "us," or "our") operates the AZ Finance Dashboard application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, including our integration with Intuit QuickBooks Online.
1. Information We Collect
Account Information: When your account is created by AZ Finance, we store your company name and a hashed version of your login password. We do not collect personal names, email addresses, or phone numbers through the dashboard.
QuickBooks Online Data: With your authorization, we access financial data from your QuickBooks Online account through Intuit's official OAuth 2.0 API. This includes:
- Profit and Loss reports
- Balance Sheet reports
- Statement of Cash Flows
- Accounts Receivable and Accounts Payable aging reports
- Company information (company name)
Usage Data: We may collect basic usage information such as login times and pages viewed within the dashboard for the purpose of improving the Service.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the financial dashboard Service
- Display your financial reports and analytics in real time
- Authenticate your identity and manage your dashboard session
- Improve and enhance the Service
- Comply with legal obligations
3. How We Access QuickBooks Data
We access your QuickBooks Online data exclusively through Intuit's official OAuth 2.0 API. This means:
- We never see, collect, or store your Intuit/QuickBooks username or password
- You grant access through Intuit's secure authorization process
- We only request the minimum permissions necessary (read-only access to accounting data)
- You can revoke our access at any time through your Intuit account at accounts.intuit.com
- Access tokens are stored securely and refreshed automatically
4. Data Storage and Security
We take the security of your data seriously:
- Encryption: All data transmitted between your browser, our servers, and QuickBooks is encrypted using HTTPS/TLS
- Session Security: Login sessions are protected with secure, HTTP-only cookies and expire after 30 minutes of inactivity
- Password Security: All passwords are hashed using bcrypt and are never stored in plain text
- Minimal Storage: Financial data is retrieved in real time from QuickBooks and is not permanently stored on our servers. We only cache data temporarily to improve dashboard performance
- Access Controls: Each client can only access their own financial data. There is no cross-client data access
- Two-Factor Authentication: Optional 2FA is available for all user accounts via authenticator apps or email verification codes. Admin access requires mandatory 2FA.
- Content Security Policy: Our application implements strict Content Security Policy headers to prevent cross-site scripting and injection attacks.
- Audit Logging: All administrative actions, including client modifications, user management, and system access, are logged to a secure audit trail.
- Rate Limiting: API rate limiting is enforced to prevent abuse and protect against brute-force attacks.
5. Data Sharing and Disclosure
We do not sell, trade, rent, or otherwise share your financial data with third parties. We may disclose information only in the following circumstances:
- With your consent: When you explicitly authorize us to share information
- Legal requirements: When required by law, subpoena, court order, or governmental regulation
- Service providers: We use Railway for hosting. These providers are bound by their own privacy policies and do not have access to your QuickBooks data
6. Data Retention
We retain your account information for as long as your dashboard account is active. QuickBooks financial data is retrieved in real time and is not permanently stored. If your account is terminated:
- Your dashboard login will be deactivated immediately
- Any cached financial data will be deleted within 30 days
- QuickBooks API access tokens will be revoked
7. Your Rights
You have the right to:
- Request information about what data we access from your QuickBooks account
- Revoke our access to your QuickBooks data at any time
- Request deletion of your dashboard account and any associated data
- Contact us with any privacy-related questions or concerns
8. Children's Privacy
The Service is not intended for use by individuals under the age of 18. We do not knowingly collect information from children.
9. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised effective date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.
10. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at:
AZ Finance
Email: arman@armanzand.com