Privacy Policy — Carpco Connection

Effective Date: April 30, 2026 Last Updated: April 30, 2026

Carpenter & Company, CPA ("we," "us," or "our") operates Carpco Connection, an internal accounting practice management platform used exclusively by Carpenter & Company staff to serve our firm's clients. This Privacy Policy describes how we collect, use, store, and protect data accessed through our QuickBooks Online integration.

1. Who This Policy Covers

This platform is an internal business tool operated by and for Carpenter & Company, CPA. It is not a public application and is not available to the general public. Access is restricted to authorized staff of Carpenter & Company, CPA.

Our firm's clients authorize our access to their QuickBooks Online company data by completing the Intuit OAuth consent flow. This policy governs how we handle that data once authorized.

2. Data We Access from QuickBooks Online

When a client authorizes our connection, we access the following data from their QuickBooks Online company via the Intuit OAuth 2.0 API:

  • Chart of Accounts — account names, numbers, types, and hierarchy
  • Customers and Jobs — names, addresses, contact information, balances
  • Vendors — names, addresses, contact information, balances
  • Employees — names, contact information, employment dates
  • Items (Products and Services) — names, descriptions, pricing
  • Classes — classification lists used for transaction categorization

We access only the data scopes necessary to perform accounting services for the authorizing client. We do not access transaction history, banking credentials, payroll data, or any data beyond the reference lists listed above unless separately authorized.

3. How We Use This Data

Data accessed from QuickBooks Online is used solely to:

  • Populate our internal platform with reference data for accounting engagements
  • Prepare financial statements, trial balances, and tax workpapers for the authorizing client
  • Support journal entry preparation and chart of accounts management
  • Enable export of data back to QuickBooks Desktop or QuickBooks Online as part of our accounting workflow

We do not sell, rent, share, or disclose client data to any third parties. We do not use client data for advertising, marketing, or any purpose unrelated to the accounting services we provide to that client.

4. How We Store and Protect Data

  • Data is stored in a Supabase PostgreSQL database hosted on infrastructure provided by Supabase, Inc. (hosted on AWS us-east-1).
  • All data is encrypted at rest using AES-256 encryption and in transit via TLS 1.2 or higher.
  • OAuth access tokens and refresh tokens are stored encrypted in the database and are never exposed to the browser or logged.
  • Access to the platform is restricted to authenticated Carpenter & Company staff via email/password login. Row-level security policies ensure staff can only access client data they are authorized to view.
  • Tokens are automatically refreshed before expiration and revoked upon disconnection.

5. Data Retention

  • QuickBooks Online OAuth tokens are deleted immediately upon disconnection or when a client engagement ends.
  • Reference data synced from QuickBooks Online (accounts, customers, vendors, etc.) is retained for the duration of our accounting engagement with the client and deleted upon written request or at engagement end.
  • We do not retain data beyond what is necessary to perform our accounting services.

6. Client Rights and Control

Clients who have authorized our QuickBooks Online connection may:

  • Revoke access at any time through their QuickBooks Online account settings under Authorized Apps, or by contacting us directly.
  • Request deletion of their data from our platform by contacting us at the address below.
  • Request a summary of what data we have stored for their company.

Revoking access through Intuit will invalidate our OAuth tokens. We will cease accessing their QuickBooks Online data immediately upon revocation.

7. Third-Party Services

We use the following third-party infrastructure providers:

Provider

Purpose

Privacy Policy

Intuit Inc.

QuickBooks Online OAuth 2.0 API

https://www.intuit.com/privacy/statement/

Supabase, Inc.

Database hosting and authentication

https://supabase.com/privacy

Vercel, Inc.

Application hosting

https://vercel.com/legal/privacy-policy

We do not integrate with any other third-party services that receive client QuickBooks Online data.

8. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated to affected clients. The effective date at the top of this document reflects the most recent revision.

9. Contact

If you have questions about this policy or wish to exercise your data rights, contact:

Carpenter & Company, CPA Wade Carpenter, Managing Partner wcarpenter@carpentercpas.com

Carpco Connection is an internal tool of Carpenter & Company, CPA. It is not affiliated with or endorsed by Intuit Inc.