This Privacy Policy explains how Cognyon (“we”, “us”) collects, uses, stores, and protects information in connection with Bookkeeper Connect (the “Service”), a web application that synchronizes worked hours from Connecteam into QuickBooks Online. We act as a data processor on behalf of the businesses that use the Service (our “Customers”).
1. Information we access
We only access the data required to synchronize worked hours, and only after you explicitly authorize each connection:
- From QuickBooks Online (Intuit), via OAuth 2.0 authorization: your company identifier (realmId), Employee records (name and, when available, email), and the Time Activity entries that the Service creates or updates on your behalf.
- From Connecteam, via the API key you provide: employee/user records (name, email) and time-clock data (worked hours per day).
- Account information: the name, email, role, and workspace membership of the users you create inside the Service.
2. How we use the information
We use the information solely to provide the Service to the Customer it belongs to — that is, to read worked hours from Connecteam and record them as Time Activity entries in that Customer’s QuickBooks Online company, and to provide observability (run history, error details) for troubleshooting.
- We do not sell your data.
- We do not share it with third parties for their own purposes.
- We do not aggregate, anonymize, or run modeling across Customers. Each Customer’s data is used only for the benefit of that same Customer.
3. Storage and security
- Data is stored in a managed PostgreSQL database. Secrets — API keys and OAuth tokens — are encrypted at rest (AES-256-GCM) and are never exposed to the browser or written to logs.
- Each Customer (workspace) is isolated at the database level through Row Level Security, so one Customer can never read another Customer’s data.
- Access to production data is restricted to authorized personnel operating the Service.
- All communication with Intuit and Connecteam happens over HTTPS.
4. Data retention and deletion
We retain data for as long as your account and connection remain active. When you disconnect QuickBooks Online (from within the Service or from your QuickBooks account), the related access and refresh tokens are deleted. You may request deletion of your account and associated data at any time by contacting us at fernando.f.oriano@gmail.com.
5. Sub-processors
The Service relies on the following providers to operate:
- Intuit (QuickBooks Online) — destination of the synchronized hours.
- Connecteam — source of the worked hours.
- Supabase — managed database, authentication, and hosting of application data.
- Application hosting provider — where the web application runs.
6. Your rights
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal data. To exercise these rights, contact us at fernando.f.oriano@gmail.com.
7. Intuit data
Data obtained from the Intuit QuickBooks Online API is used strictly to deliver the Service described above, in accordance with Intuit’s API Terms of Service. It is never sold, never shared with unrelated third parties, and never used for any purpose other than the benefit of the Customer who authorized the connection.
8. Changes to this policy
We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by notifying Customers.
9. Contact
Questions about this Policy can be sent to fernando.f.oriano@gmail.com.