Privacy Policy

TSmartConnect is operated by [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS].

For anything in this policy, including a request to delete data, write to privacy@tsmartconnect.com.

The bracketed fields above are pending. This document is published so its substance can be reviewed; the corporate details are supplied by the operator before it is relied on.

When you connect a QuickBooks Online company, TSmartConnect requests the com.intuit.quickbooks.accounting scope, together with your name and email address for sign-in. We do not request the Payments scope and we do not process card payments through Intuit.

Within the accounting scope we read, and where you ask us to, write:

• Customers, vendors and employees
• Invoices, estimates, sales receipts and refund receipts
• Bills, bill payments, purchase orders and vendor credits
• Payments, credit memos, deposits and transfers
• Items, inventory adjustments and budgets
• Accounts, classes, departments and journal entries
• Payment methods, terms, tax codes, tax rates and tax agencies
• Company information

We read this data to present it alongside your sales channels and to keep the two in agreement. We do not use it to train models, we do not sell it, and we do not share it with anyone other than the processors listed below.

From Shopify and Amazon accounts you connect:

• Orders, including line items, buyer name and email, shipping and refund records
• Products, variants, SKUs, prices, images and collection membership
• Customer records, or where a marketplace does not expose one, buyer details aggregated from orders
• Inventory levels per location
• Discounts and customer segment definitions

Order and customer records contain personal data belonging to your customers. For that data you are the controller and we act on your instructions.

Your name and email address, the workspaces you belong to and your role in them, the API keys you create, an audit record of privileged actions, and a per-day count of API requests used for billing. If you subscribe, Stripe holds your billing details and we store only its customer and subscription identifiers.

Application servers run in Nuremberg, Germany. The PostgreSQL database and its backups are held on the same provider and in the same city. Your QuickBooks, Shopify and Amazon data does not leave Germany, other than to the processors named below.

Backups are taken daily and retained for 14 days, after which they are deleted automatically.

Data synchronised from a connected account is retained while that connection exists. Disconnecting a provider stops further synchronisation; the data already gathered remains until you ask for it to be deleted or you close the workspace, at which point it is removed within 30 days from live systems and within a further 14 days from backups as those rotate out.

Audit records of privileged actions are kept beyond that point, because their purpose is to show what was done to an account and deleting them on request would defeat it.

Measures currently in place:

• All traffic to the application and its API is encrypted in transit with TLS.
• API keys and workspace invitation tokens are stored only as SHA-256 hashes, so a database disclosure does not yield usable credentials.
• Provider connection credentials held in the connections store are encrypted at rest.
• Data is scoped by workspace at the query level; a request authenticated for one workspace cannot read another’s rows.
• Access to production infrastructure is restricted to key-based SSH by named operators.
• Privileged actions are recorded in an audit log.

No system is immune to compromise. If a breach affects your data we will notify you without undue delay, together with what we know and what we are doing about it.

You may ask us for a copy of the data we hold about you, to correct it, to delete it, or to stop processing it. Write to privacy@tsmartconnect.com and we will respond within 30 days.

You can disconnect any provider at any time from Connectors in the dashboard, which stops further synchronisation immediately. You can also revoke TSmartConnect’s access from within QuickBooks, Shopify or Amazon directly.

Where the data concerns your own customers rather than you, we act on your instructions: send us the request and we will carry it out.

If this policy changes materially we will say so on this page and, where the change affects how your data is used, contact account owners directly. The date at the top always reflects the current version.