SheetsSync ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our QuickBooks to Google Sheets synchronization service.
1. Information We Collect
1.1 Account Information
When you connect SheetsSync, we collect:
- Google Account: Your Google email address for authentication
- QuickBooks Company: Your QuickBooks realm ID and company name
1.2 OAuth Tokens
We store OAuth access and refresh tokens on our servers to maintain your QuickBooks connection. They are encrypted at rest (AES-256-GCM, with a key kept outside the database) before they are written to our database, refreshed automatically, and never sent to the add-on.
1.3 Sync Logs
We maintain logs of synchronization operations, deleted automatically after 180 days, including:
- Timestamp of sync operations
- Entity types synced (e.g., Invoices, Customers)
- Record counts
- Error messages (if any)
1.4 Two-Way Sync Push Logs
When you push a row from your sheet to QuickBooks (Two-Way Sync), we log the values sent and the record QuickBooks returns, so a failed or disputed change can be traced. The values sent and QuickBooks' reply are erased after 30 days; the rest of the entry (time, record type and ID, outcome, any error message) is kept until you request account deletion. Edits waiting to be pushed are queued inside your spreadsheet, not on our servers.
1.5 Billing
For paid plans we store your plan, subscription status, trial dates, Stripe customer and subscription IDs, and any cancellation reason you give. We also keep a copy of each billing event Stripe sends us, which can include your billing email, name and invoice amounts. Its full contents are erased after 90 days; the event ID, type and processing status are kept so the same event is never applied twice. Card details are held by Stripe, not by us.
Important: Records and reports pulled from QuickBooks pass through our servers during a sync and are written to your Google Sheet. We don't keep a copy; only the record count is logged. The exceptions are the push logs in 1.4, whose values are erased after 30 days, and QuickBooks change notices (record type and ID only), which are deleted after 30 days.
2. How We Use Your Information
We use collected information to:
- Authenticate your identity and authorize access
- Maintain your QuickBooks connection
- Perform synchronization operations you request
- Troubleshoot errors and improve our service
- Communicate important service updates
3. Data Security
| Security Measure | Implementation |
|---|---|
| Encryption in Transit | TLS 1.3 for all connections |
| Encryption at Rest | QuickBooks OAuth tokens encrypted with AES-256-GCM before storage |
| Access Control | Row Level Security (RLS) in database |
| Infrastructure | Vercel and Supabase (enterprise-grade infrastructure) |
4. Data Retention
- OAuth Tokens and Connection Data: Retained until you disconnect, or until QuickBooks reports the tokens expired or revoked
- Sheet Settings: Retained until you remove the sheet's setup or request account deletion (kept if you disconnect)
- Sync Logs: Automatically deleted after 180 days
- Push Logs: Values sent and QuickBooks' reply automatically erased after 30 days; the remaining entry is retained until you request account deletion
- QuickBooks Change Notices: Automatically deleted after 30 days
- Stripe Billing Events: Full event contents automatically erased after 90 days; event ID, type and status retained until you request deletion
- Account and Billing Data: Retained until you request deletion
5. Data Sharing
We do NOT sell, trade, or rent your personal information. We may share data only:
- With Intuit (QuickBooks) as required for OAuth authentication
- With Google as required for Sheets API access
- When required by law or legal process
- To protect our rights or safety
6. Your Rights
6.1 Access and Export
You may request a copy of all data we store about you by contacting us at support@getsheetssync.com.
6.2 Deletion
You may delete your data at any time by:
- Using the disconnect feature in the add-on
- Contacting us to request complete account deletion
6.3 Disconnect
You can disconnect SheetsSync from your QuickBooks at any time. This will immediately delete your OAuth tokens and connection data from our systems. Your account, sheet settings and logs stay until you request deletion or their retention period in Section 4 ends; see the opt-out page.
7. California Privacy Rights (CCPA)
If you are a California resident, you have the right to:
- Know what personal information we collect
- Request deletion of your personal information
- Opt-out of the sale of personal information (we do not sell data)
- Non-discrimination for exercising your rights
8. European Privacy Rights (GDPR)
If you are in the European Economic Area, you have rights including:
- Access: Request copies of your personal data
- Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your data
- Portability: Request transfer of your data
- Objection: Object to certain processing activities
9. Cookies and Tracking
SheetsSync does not use cookies or tracking technologies. We do not collect analytics or behavioral data through our landing pages.
10. Children's Privacy
SheetsSync is not intended for use by children under 13. We do not knowingly collect information from children under 13.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of significant changes by posting a notice on our website or sending you an email.
12. Contact Us
For privacy-related questions or to exercise your rights:
- Email: support@getsheetssync.com
- Website: getsheetssync.com