Privacy Policy & Data Safety Commitment

1. Our Core Commitment to Data Protection

We recognize that your QuickBooks sales data, customer lists, Tax Identification Numbers (TINs), and invoice values represent confidential business assets. We explicitly promise that:

• No Commercial Monetization: We will never sell, rent, license, or monetize your company accounting or customer data to advertisers, data brokers, or third parties.
• Strict Purpose Limitation: Your data is accessed solely to convert QuickBooks sales receipts into Sri Lanka Inland Revenue Department (IRD) Gazette No. 2481/22 tax invoices.
• Tenant Isolation: Multi-tenant boundary checks strictly prevent any user from viewing another company's accounting figures.

2. QuickBooks & Intuit Developer Regulations Compliance

Our application integrates with Intuit QuickBooks Online via the official Intuit OAuth 2.0 framework and REST APIs. In accordance with the Intuit Developer Terms of Service and Data Security Policies:

• OAuth 2.0 Security: Access tokens and refresh tokens received from Intuit are stored with AES-256 encryption. We never prompt for or store your Intuit account password.
• Revocation Rights: You may disconnect QB-IRD Converter from your QuickBooks Online account at any time via the Intuit App Center or your App Settings page, immediately invalidating active access tokens.
• Scope Minimization: We only request access to accounting data necessary to read invoices and customer tax profiles required for tax compliance.

3. Inland Revenue Department (IRD) Sri Lanka Compliance

Pursuant to Section 117 of the Inland Revenue Act No. 24 of 2017 and Gazette Extraordinary No. 2481/22:

• Mandatory 5-Year Retention: Taxpayers are legally obligated to retain tax invoices for a minimum period of 5 years. Converted IRD tax invoices are securely archived in our database for compliance review.
• Data Integrity: Serial sequence numbers and VAT breakdowns are stored immutably to safeguard against tampering during tax audits.

4. Cookies, Analytics & Google Analytics Notice

Like standard web platforms, we utilize cookies and performance tools:

• Essential Cookies: Required to manage user authentication sessions and prevent Cross-Site Request Forgery (CSRF).
• Google Analytics & Performance Cookies: We may utilize Google Analytics to aggregate anonymous metrics (e.g., page load speeds, browser types, error rates) to maintain service reliability. IP anonymization is enabled by default.
• User Consent: You can manage or reject non-essential cookies at any time using our Cookie Consent Banner or browser preferences.

5. Security Measures & Contact Information

All traffic is transmitted over HTTPS utilizing TLS 1.3 encryption. Your data is stored in cloud PostgreSQL instances managed by Supabase, backed by automated backups and firewall rules.

If you have questions regarding this Privacy Policy or wish to request data deletion, please contact our Data Protection Officer at:
privacy@qb-ird-converter.lk or via your Admin Panel.