Privacy Policy

1. Who we are and our role

• The App connects a merchant's Shopify store to the merchant's own QuickBooks Online company. It syncs the records the merchant chooses between the two.
• For data about the merchant (the store's account and contact details), Techmarbles is the controller.
• For data about the merchant's customers, the merchant is the controller (or "data fiduciary" under India's Digital Personal Data Protection Act, 2023). Techmarbles is the processor: it processes that data only on the merchant's behalf, to provide the sync, as the merchant's App settings direct.

2. Information we process

2.1 About the merchant and the store

From Shopify, when you install the App:

• the store's domain, name, contact email, country, currency and time zone;
• your Shopify plan, and your subscription and billing status for the App.

From QuickBooks Online, when you connect it:

• the QuickBooks company's ID, name, country, currency and connection status.

Settings you enter in the App:

• your sync choices and account mappings;
• the email addresses that receive the App's notifications.

2.2 Access tokens

• These are the tokens that Shopify and Intuit give the App so it can call their services for you.
• They are stored encrypted (AES-256-GCM).
• We never see or store your Shopify or QuickBooks password.

2.3 Records you choose to sync

Depending on your settings, the App reads and writes the following data between Shopify and QuickBooks Online:

The App holds this data only as long as it needs to sync it. It also keeps the links between matching records in the two systems, such as "this Shopify order is that QuickBooks sales receipt".

2.4 Sync history and technical data

• Sync history: what was synced, when, and how it ended. It is stored with record IDs only, never customer names, emails or addresses.
• Technical logs: error messages, request timings and counts. Logs are written without personal information.
• Support requests: what you send us when you contact support.

2.5 What we do not collect

• We do not collect or store payment card numbers, bank account numbers or bank login details.
• We do not track your customers on your storefront, use cookies on your storefront, or collect data about your store's visitors.
• We do not knowingly collect data about children.

3. Why we process it (and legal bases)

We never sell personal information, or share it for cross-context behavioral advertising. We do not use it for advertising, for profiling, or to make automated decisions about people. We do not use data obtained from QuickBooks Online or Shopify for any purpose other than providing the App to you.

4. Who we share it with

We share data only with the following parties:

These service providers ("sub-processors") act only on our instructions and are bound by confidentiality and data protection obligations. We will tell you before adding a new sub-processor that processes customer personal data.

5. How long we keep it

Records written to your QuickBooks company or Shopify store belong to you and stay there. They are governed by Intuit's and Shopify's own policies.

6. How we protect it

• Encryption in transit: all traffic to and from the App uses HTTPS (TLS).
• Encryption at rest: access tokens and sensitive details are encrypted with AES-256-GCM.
• Verified messages: every incoming webhook from Shopify and Intuit has its signature checked before it is accepted.
• No personal data in logs: application logs exclude personal information. Emails and support reports are scrubbed of email addresses and phone numbers.
• Least privilege: the App asks only for the Shopify and QuickBooks permissions the sync needs. Staff access to production systems is limited to the people who need it.
• Separated environments: development and test systems use their own databases, never real merchant data.
• Data isolation: each store's data is kept separate, and every request is checked against the store that made it.

No system is completely secure. If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and the authorities where the law requires.

7. Your rights

7.1 Merchants

You can:

• see and change your sync settings and notification emails in the App at any time;
• disconnect QuickBooks at any time from the App's Connection page;
• uninstall the App at any time. Your data is then deleted as described in section 5.

Depending on where you live, you may also have the right to:

• access, correct or delete your personal data;
• object to or restrict its processing;
• data portability;
• withdraw consent;
• complain to your data protection authority.

To use any of these rights, email [email protected]. We will answer within 30 days, or sooner if the law requires.

7.2 Your customers

Your customers should send privacy requests to you, as the controller. Shopify forwards these requests to us automatically, and we act on them:

• Data request (customers/data_request): we report to you what we hold about that customer.
• Deletion request (customers/redact): we delete what we hold about that customer.
• Store deletion (shop/redact): we delete everything we hold about your store.

If a customer contacts us directly, we will refer them to you, and help you respond.

7.3 California residents (CCPA / CPRA)

We act as a "service provider" for the personal information we process for merchants. We do not sell or share personal information, and we do not use it for any purpose other than providing the App. California residents may request access to or deletion of their personal information through the merchant, or by contacting us.

7.4 India (DPDP Act, 2023)

Individuals in India may exercise their rights under the Digital Personal Data Protection Act, 2023, and raise grievances with our Grievance Officer (section 11).

8. International transfers

Techmarbles is based in India. Our servers are hosted in India. Shopify and Intuit may process data in other countries under their own policies. Where personal data is transferred across borders, we rely on appropriate safeguards required by applicable law, such as the European Commission's Standard Contractual Clauses where they apply.

9. Third-party services

Your use of Shopify and QuickBooks Online is governed by their own privacy policies:

• Shopify Privacy Policy
• Intuit Global Privacy Statement

We are not responsible for how they handle data.

10. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date. For material changes, we will tell you in the App or by email before they take effect.