Privacy Policy

• 1Who we are and what this covers
• 2Information we collect
• 3What we do not collect
• 4How we use information
• 5How we share information
• 6Professional confidentiality
• 7Disconnecting and deletion
• 8Data retention
• 9How we protect information
• 10Where data is stored
• 11Your privacy rights
• 12California privacy rights
• 13Cookies and analytics
• 14Children's privacy
• 15Changes to this policy
• 16Contact us

1. Who we are and what this covers

Crosby & Kaneda CPAs (“Crosby & Kaneda,” “we,” “us,” or “our”) publishes the CKCPA Report Generator (the “App”), an application that connects to QuickBooks Online to allow clients to easily prepare and submit required information for tax, audit or review preparation services, leveraging their investment in QuickBooks. This Privacy Policy explains what information the App collects, how we use and protect it, who can see it, and what choices you have.

This policy covers the App and the websites and support channels we operate in connection with it. It does not cover QuickBooks Online itself or any other Intuit product, which are governed by Intuit's own privacy statement, and it does not cover any other third-party service you may separately choose to use.

If Crosby & Kaneda also provides you with professional accounting, audit, or tax services, those services are governed by your engagement letter and by the professional confidentiality obligations described there which apply in addition to this policy.

2. Information we collect

QuickBooks Online data

When you connect a QuickBooks Online company, the App accesses data within the scopes you approve on Intuit's authorization screen. Depending on the scopes granted, this may include:

• company profile information, chart of accounts, and fiscal-year settings;
• transactions, journal entries, and the general ledger;
• classes, locations, projects, and other tracking dimensions; and

We access only the categories of data covered by the scopes you approve, and only what is needed for the services you have requested. We do not access data outside those scopes.

Account and contact information

Your name, business or organization name, email address, phone number and the identifier of the QuickBooks Online company you connect may be obtained.

Authorization credentials

OAuth access and refresh tokens issued by Intuit, which are stored encrypted and temporarily while you are using the app and used only to make authorized API calls on your behalf.

Technical and usage data

IP address, browser and device type, timestamps, pages and features used, API request and error logs, and diagnostic information. We use this to operate the App, investigate problems, and detect abuse.

Communications

Messages, support tickets, and attachments you send us, along with our responses.

3. What we do not collect

• We never collect or store your QuickBooks Online or Intuit password. Authentication happens entirely on Intuit's systems, and we receive only a revocable access token.
• We do not collect payment card numbers or bank account credentials through the App.
• We do not knowingly collect information from children (see Section 14).
• We do not use tracking technologies to build advertising profiles, and we run no advertising on the App.

4. How we use information

Purpose	What this means
Providing the service	Retrieving, organizing, analyzing, and presenting your QuickBooks Online data to deliver the App's features and the services you have engaged us to perform.
Support	Responding to your questions, troubleshooting errors, and communicating about the App.
Security and integrity	Authenticating users, maintaining audit logs, detecting and preventing fraud, abuse, and unauthorized access.
Maintenance and improvement	Monitoring performance, diagnosing defects, and improving reliability and usability.
Legal and professional compliance	Meeting our recordkeeping, regulatory, professional standards, and legal obligations.

We do not use your information for advertising, and we do not use your data to train third-party artificial intelligence or machine learning models.

5. How we share information

Access to your information is limited as follows:

Crosby & Kaneda personnel

Only those partners, employees, and contracted personnel of Crosby & Kaneda who need access to perform the services you have requested may view your information. Access is granted on a least-privilege basis, is logged, and is removed when no longer needed. All personnel, including any contracted staff, are bound by written confidentiality obligations and by the professional standards described in Section 6.

Service providers acting on our behalf

We rely on a small number of vendors to operate the App — for example, cloud hosting and storage, error monitoring, and email delivery. These providers process data only on our instructions, only to the extent needed to provide their service to us, and under written agreements that prohibit them from using your information for any other purpose. They are not permitted to sell or disclose your information. A current list of these providers is available on request at admin@ck.cpa.

Intuit

The App exchanges data with Intuit's QuickBooks Online API to read the data you have authorized and, where applicable, to write back changes you direct. Intuit's handling of that data is governed by its own agreements with you.

When you direct us to

We will share your information with a third party — such as your auditor, attorney, funder, or another advisor — when you instruct us to do so in writing.

Legal requirements

We may disclose information where required by law, subpoena, court order, or valid legal process, or where reasonably necessary to protect the rights, safety, or property of Crosby & Kaneda or others. Where we are permitted to do so, we will notify you before responding so that you have an opportunity to object.

Business transfers

If Crosby & Kaneda is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to the confidentiality protections of this policy and applicable professional standards. We will notify you before your information becomes subject to a materially different privacy policy.

6. Professional confidentiality

Crosby & Kaneda is a licensed certified public accounting firm. Information you provide through the App may constitute confidential client information subject to the AICPA Code of Professional Conduct and the rules of the California Board of Accountancy, and, where the information is tax return information, to the Internal Revenue Code and IRS regulations.

These obligations restrict our disclosure and use of your information beyond the terms of this policy. Where a disclosure would require your written consent under applicable professional standards, we will obtain that consent in the required form before making it.

Ror regulatory and compliance purposes, regulators or certain other limited entities such as peer reviewers preparing peer review reports as part of quality management activities required by California Board of Accountancy or other regulations or California Board of Accountancy staff may request information related to our practice which may include certain records used in carrying out services we have performed for you which we may allow them to review subject to confidentiality agreements that we enter into with such entities

7. Disconnecting and deletion

You may disconnect the App from your QuickBooks Online company at any time by:

• using the disconnect control within the App; or
• going to the Apps section of QuickBooks Online, locating Report Generator, and selecting Disconnect.

On disconnection, we immediately revoke and delete the associated OAuth tokens and stop accessing your QuickBooks Online data. We then delete or de-identify the QuickBooks Online data we hold within 30 days, except where retention is required as described in Section 8.

You may also request deletion at any time without disconnecting, by writing to admin@ck.cpa. We will confirm your request and respond within 30 days.

8. Data retention

We keep information only as long as we need it for the purposes described in this policy. In practice:

• QuickBooks Online data: deleted or de-identified within 30 days of disconnection or a deletion request.
• Account and contact information: retained while your account is active and for 12 months afterward.
• Security and audit logs: retained for 36 months for security investigation purposes.
• Professional work product and engagement records: where Crosby & Kaneda has performed professional services for you, applicable professional standards and law require us to retain workpapers and supporting records for a minimum period — generally seven years. Those records are retained under our firm-wide record retention policy, remain subject to the confidentiality obligations in Section 6, and are not deleted on disconnection.

We also retain information where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

9. How we protect information

We maintain administrative, technical, and physical safeguards designed to protect your information, including:

• encryption in transit using TLS 1.2 or higher, and encryption at rest using AES-256 or equivalent;
• role-based access controls applied on a least-privilege basis, with periodic access reviews;
• multi-factor authentication required for administrative and personnel access;
• OAuth tokens stored encrypted and never exposed in logs or client-side code;
• audit logging of data access and administrative actions;
• managed, patched infrastructure with monitoring and alerting; and
• written confidentiality agreements and periodic security and confidentiality training for all personnel.

If we become aware of a breach affecting your information, we will notify you and any applicable regulator without undue delay and as required by law.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please report any suspected security issue to admin@ckc.cpa.

10. Where data is stored

Your information is stored and processed on servers located in the United States. If you access the App from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States. We utilize Amazon Web Services as the primary computation platform to operate this app.

11. Your privacy rights

Subject to applicable law and to our professional retention obligations, you may:

• ask what information we hold about you;
• withdraw the App's access to your QuickBooks Online data at any time; and

To exercise any of these, write to admin@ck.cpa. We will verify your identity before acting on a request and will respond within 30 days. We will not discriminate against you for exercising these rights.

12. California privacy rights

We do not perform services for consumers.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding twelve months. The categories of personal information we collect, the purposes for which we use them, and the parties to whom we disclose them are described in Sections 2, 4, and 5.

Where Crosby & Kaneda processes personal information on your behalf as a service provider, we act only on your documented instructions and do not retain, use, or disclose that information for any purpose other than performing the services.

13. Cookies and analytics

The App uses only strictly necessary cookies required to keep you signed in and to maintain your session. We do not use advertising or third-party tracking cookies.

14. Children's privacy

The App is a business tool intended for use by adults acting on behalf of an organization. It is not directed to children under 13, and we do not knowingly collect personal information from children. If we learn that we have collected such information, we will delete it if permitted by regulation. Contact us at admin@ck.cpa if you believe a child has provided us with information.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version at this URL and update the “last updated” date above. If a change is material, we will provide reasonable advance notice by email or through the App. Your continued use of the App after the effective date of a revision constitutes acceptance of it.

16. Contact us

Questions, requests, or complaints about this policy or about how we handle your information:

Crosby & Kaneda CPAs
Attn: Privacy
[STREET ADDRESS]
[CITY], California [ZIP]
admin@ck.cpa
[PHONE]

We will acknowledge your message within 14 business days.