Part 2 — Platform privacy notice for connected clients
This is Part 2 of our privacy policy, for clients who connect their accounting and bank accounts to our platform. Part 1, for visitors to this website and anyone who contacts us through the form, is on the main privacy page. If you are a client, both parts apply to you.
Questions about either part: Contact us.
This part applies when you, as a client of Insightful Financials, authorize us to connect to your accounting system or your bank and card accounts so that we can do your bookkeeping and reporting without pulling data by hand.
What we connect to, and what we take
- QuickBooks Online. With your authorization, our platform reads your company's accounting records: accounts, transactions, invoices, bills, payments, customers, and vendors. Access is read-only. Our platform never writes to your books and never moves money.
- Bank and card accounts. With your authorization, given at your own bank or card issuer through our bank-data provider, our platform reads balances and transactions. We never see or store your online banking login. Where your institution supports it, you sign in at the institution itself and we receive only a revocable token.
We take only what the work needs, and we take it on a daily schedule so the reports you see are current.
Your systems stay yours. You give us access, not ownership. If our work together ends, you leave with exactly what you came in with: your books stay in your QuickBooks company, your bank and card connections are yours to keep or revoke, and your bill-pay account transfers to you.
Why
To keep your books, reconcile them, spot problems early, and produce the reports you pay us for. That is the only purpose. We do not sell your data, share it with anyone who is not helping us serve you, or use it to market to you or anyone else.
Where it lives
Your records are stored in a private platform hosted by Cloudflare, in an account that belongs to Insightful Financials LLC, under Cloudflare's data processing addendum. Access to the platform is limited to our team and protected by phishing-resistant two-factor authentication. Copies used to produce your reports may be held on our team's managed, encrypted equipment.
Our correspondence with you lives in our Google Workspace. Our team's credentials for your systems live in a password manager restricted to the people assigned to you.
Who else touches it
We use a small number of providers to run the platform. Each one either holds your data under a written data processing agreement or carries only operational signals about it, never the data itself.
| Provider | What they do | Your data? |
|---|---|---|
| Cloudflare | Hosts the platform | Yes, under a data processing addendum |
| Intuit (QuickBooks Online) | The source of your accounting records | Your data is already theirs |
| Our bank-data provider (Plaid) | Connects to your bank and card accounts on your authorization | Yes, under its agreement with us |
| Bill.com | Your own bill-pay account, where you use one. We work in it through an accountant console | Your data is already yours — the account is in your name and stays with you |
| Anchor | Our proposals, engagement signatures, and billing for our own fees | Your signed onboarding pack and your payment details; no accounting or bank records |
| Google Workspace | Our email and documents | Correspondence with you |
| Resend | Sends our operational alert emails | No records; identifiers and counts only |
| Our managed IT provider | Secures our team's devices and backs up our email | Backup copies of correspondence |
We will tell you before a new provider holds your data. You can ask us for the current list at any time.
Artificial intelligence
Your finances are as unique as your company. There is no substitute for human judgment in analyzing the data you use to make decisions about your financial future. We use AI tools in our work, and we never use them as a substitute for a person: no AI-produced output reaches you without one of us having reviewed it.
AI cannot be switched off across the board, and we won't pretend otherwise. QuickBooks uses it. Our email, our documents, and our design software use it. That is the ordinary state of business software, and no firm can promise you a working environment without it.
Here is the rule that does hold. Nothing about you is ever used to train an AI model. And your identifying information is protected in one of two ways: either it never reaches the AI tool at all — software on our own systems replaces names, account numbers, and contact details with meaningless placeholders first, so what the tool sees is amounts, dates, and categories, never who they belong to — or it is covered by a written agreement with the provider that forbids them from retaining it or training on it.
If you would rather we did not use AI-assisted reporting for you, tell us and we will not. You will receive your QuickBooks reports; you will not receive CFO-style analysis or visual reporting, because those are produced with these tools.
How long we keep it
We keep two kinds of things, and we treat them differently.
- Your raw records, the copy of your accounting and bank data that our platform holds, are a working copy. Your QuickBooks and your bank remain the systems of record. When you leave us, or when you ask us to, we delete our copy within 30 days, disconnect from your QuickBooks, and remove the connection to your bank and card accounts.
- The records you may need later. For three years we keep the reports and reconciliations you are most likely to need — the ones that matter for a tax filing, a lender, or an accountant picking up after us — and we will provide them on request during that time. This is not an archive of everything we have ever produced for you.
If a legal hold applies, for example a subpoena or an audit, we keep what the hold requires for as long as it requires, and no longer.
Your control
- You can revoke our access at any time, from inside your QuickBooks account and from your bank or card issuer. You do not need our permission.
- You can ask us to delete your raw records at any time, in writing, and we will confirm in writing when it is done.
- You can ask what records of yours we hold and we will tell you.
- You can decline AI-assisted reporting (see above).
If something goes wrong
If we ever believe your data has been accessed by someone who should not have it, we will tell you promptly and in writing, explain what happened and what we are doing about it, and meet every notification duty that applies under the law of your state. Our security practices are described in our Information Security Policy, which we will share with you on request.
Changes to this notice
If we change this notice in a way that affects you, we will tell you before the change takes effect. The dates at the top of this page always show the current version.