BackupBuddy — Privacy Policy

This Privacy Policy describes how BackupBuddyQB Analytics Ltd. ("BackupBuddy," "we," "us," or "our") collects, uses, stores, and shares information when you use the BackupBuddy application, available at https://backupbuddyqb.com (the "Service"). BackupBuddy connects to your QuickBooks Online account to export general ledger and account reports to Microsoft Excel and Google Sheets, with hyperlinks to your source document attachments.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

Account information you provide

When you create a BackupBuddy account, we collect your name, email address, company or firm name, and password (stored in hashed form). If you purchase a paid plan, our payment processor, Stripe, Inc., collects your payment card details; we do not store full card numbers on our systems.

QuickBooks Online data

When you connect your QuickBooks Online account, you authorize us to access, via Intuit's API and with your consent, the accounting data needed to generate your exports. This includes general ledger and account transaction data, chart of accounts, vendor and customer names as they appear in transactions, and document attachments (such as receipts, invoices, and bills) linked to those transactions. We access only the data required to produce the reports you request.

Google user data

If you choose to export reports to Google Sheets, we request access to your Google account through Google's OAuth consent process. Specifically, we access:

• Your basic Google account information (email address and profile name), used to identify your connected Google account within BackupBuddy; and
• Per-file Google Drive access (the drive.file scope), which allows BackupBuddy to create new spreadsheet files in your Google Drive and to view and edit only the files that BackupBuddy itself creates. BackupBuddy cannot see, access, or modify any other files in your Google Drive.

We use this access solely to create and populate the spreadsheet exports you request. We do not read, collect, or store the contents of any other files in your Google account.

Automatically collected information

When you use the Service or visit our website, we automatically collect standard technical information such as IP address, browser type, device information, pages visited, and usage events within the app. We use this information for security, troubleshooting, and understanding how the Service is used.

2. How We Use Your Information

We use the information we collect only to:

• Provide, operate, and maintain the Service, including generating your report exports and the hyperlinks to your source documents;
• Create and write spreadsheet files to your Google Drive when you request a Google Sheets export;
• Authenticate your account and secure the Service;
• Process payments and manage subscriptions;
• Respond to support requests and communicate with you about the Service;
• Improve the Service's user-facing features and fix defects;
• Comply with legal obligations.

Limits on our use of Google user data. BackupBuddy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not:

• Use Google user data for advertising, including retargeting, personalized, or interest-based advertising;
• Sell Google user data;
• Use or transfer Google user data to determine creditworthiness or for lending purposes;
• Use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models;
• Allow humans to read Google user data, except (a) with your affirmative consent for a specific file, (b) as necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized for internal operations.

3. How We Store and Protect Your Information

Where your data is stored. BackupBuddy stores your account information, export metadata, and copies of the document attachments needed to power your report hyperlinks on Amazon Web Services (AWS) infrastructure. When you run an export, we retrieve the relevant attachments from QuickBooks Online, store copies on our AWS infrastructure, and generate hyperlinks in your exported spreadsheet that point to those hosted copies. Your data may be stored and processed in Canada and/or the United States.

Security measures. All data is encrypted in transit using TLS and encrypted at rest. Access to production systems is restricted to authorized personnel on a need-to-know basis. OAuth tokens for QuickBooks and Google are stored encrypted and are never exposed in exports or logs. We take reasonable and appropriate steps to protect all systems that handle your data against unauthorized or unlawful access, use, destruction, loss, alteration, or disclosure.

What we do not store. We do not store your Google account password or QuickBooks password; authentication happens directly with Google and Intuit via OAuth. Spreadsheet files exported to your Google Drive belong to you and reside in your Google account, not on our servers.

4. How We Share Your Information

We do not sell your personal information, your QuickBooks data, or your Google user data, and we do not share, transfer, or disclose it to third parties for purposes other than providing the Service. We share information only with the service providers necessary to operate the Service, under terms that restrict their use of your data to providing services to us:

We may also disclose information if required by law, court order, or governmental authority; to protect the rights, property, or safety of BackupBuddy, our users, or the public; or in connection with a merger, acquisition, or sale of assets, in which case we will notify you before your information becomes subject to a different privacy policy. Google user data will only be transferred in such a transaction in a manner consistent with the Google API Services User Data Policy.

5. Data Retention and Deletion

• Account information is retained for as long as your account is active.
• Hosted document attachments and hyperlink data for each exported report are retained for two (2) years from the date the report is generated while you maintain a paid account. If your paid subscription ends — by cancellation or non-payment — hosted attachments are permanently deleted upon expiry of your paid period, and links in previously exported spreadsheets will no longer resolve. Your exported spreadsheet files themselves are unaffected, as they reside in your own Google Drive or local storage.
• Google user data. Your connected Google account identifier and OAuth token are retained only while your Google connection is active. You can disconnect Google at any time from your BackupBuddy settings, or by revoking BackupBuddy's access in your Google Account permissions; we then delete the associated token. Spreadsheets already exported to your Google Drive remain in your Drive, under your control.
• QuickBooks data. You can disconnect your QuickBooks Online account at any time from BackupBuddy settings or via Intuit's connected-apps page, which revokes our access.
• Deleting your account. You may delete your BackupBuddy account at any time from within the app. When you delete your account, we immediately and permanently delete your personal information, stored document attachments, hyperlink data, and connected-account tokens, except for records we are legally required to retain (for example, billing and tax records held by us or our payment processor).

6. Your Rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to or restrict certain processing.

• Canada (PIPEDA and provincial privacy law): You may request access to and correction of your personal information, and withdraw consent to its collection, use, or disclosure, subject to legal or contractual restrictions.
• European Economic Area / United Kingdom (GDPR): You may have rights of access, rectification, erasure, portability, restriction, and objection, and the right to lodge a complaint with a supervisory authority. Where we process personal data of EEA/UK users, we do so on the legal bases of contract performance, legitimate interests, consent, and legal obligation.
• California (CCPA/CPRA): You may have rights to know, delete, and correct personal information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law.

To exercise any of these rights, contact us at info@backupbuddyqb.com. We will respond within the timeframe required by applicable law.

7. International Data Transfers

We are based in Canada and store data on AWS infrastructure that may be located in Canada and/or the United States. If you access the Service from another region, your information will be transferred to and processed in those locations. Where required, we rely on appropriate safeguards for such transfers, such as standard contractual clauses.

8. Children's Privacy

The Service is intended for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes — including any change to how we use Google user data — we will notify you (for example, by email or an in-app notice) and, where required, obtain your consent before the new practices apply. The "Effective date" at the top reflects the most recent revision.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, contact:

BackupBuddyQB Analytics Ltd.

Email: info@backupbuddyqb.com