Privacy Policy
This Privacy Policy describes how CST Group Inc. ("we", "us") handles data in connection with the CST Group QuickBooks Connector (the "App"), an internal application that connects to the QuickBooks Online account of CST Group Inc. through Intuit's official APIs.
1. What data the App accesses
With the authorization of the QuickBooks account administrator, the App accesses the following data from QuickBooks Online: invoices, customers, and products/items. The App does not access payroll, banking credentials, or employee data.
2. What the data is used for
The data is used exclusively to support CST Group Inc.'s own bookkeeping and billing operations: reading existing invoices and generating draft documents for review by our accounting staff. The App serves a single company (our own); it is not offered to the public and does not process data on behalf of other businesses or consumers.
3. Where the data is stored and how it is protected
Data retrieved from QuickBooks is processed and stored on servers controlled by CST Group Inc.. All communication with Intuit's APIs uses TLS (HTTPS). OAuth access tokens are stored encrypted, are never exposed in client-side code, and access to the servers is restricted to authorized personnel. We follow the principle of least privilege: the App only requests the QuickBooks scopes it needs.
4. Sharing with third parties
We do not sell, rent, or share QuickBooks data with third parties. Data is not used for advertising or profiling of any kind.
5. Data retention
Working copies of QuickBooks data are retained only as long as needed for the bookkeeping task at hand and for our internal record-keeping obligations, and are deleted or refreshed on each synchronization. Upon disconnection of the App (see below), stored QuickBooks data is deleted within 30 days, except where retention is required by law or legitimate accounting records.
6. Revoking access
The QuickBooks administrator can revoke the App's access at any time from Intuit's connected-apps panel (QuickBooks Online → Settings → Apps), or by contacting us at alerts@cstgrp.com. Revoking access invalidates the App's tokens immediately.
7. Changes to this policy
If we change this policy we will update this page and its "Last updated" date. The URL of this page is permanent.
8. Contact
CST Group Inc., 2364 Paseo de las Americas, Suite 104-1009, San Diego, CA 92154, USA. Email: alerts@cstgrp.com.