Privacy Policy

• Account data — name, business name, email address and phone number provided when signing up for our products or contacting us.
• Business data — product catalogs, orders, customer records and other content that our business customers upload to or generate within our platforms.
• Accounting data — where a client engages us for bookkeeping work and connects their QuickBooks Online company, we process their transactions, chart of accounts, invoices, bills and financial reports, strictly to deliver that work.
• Usage and technical data — IP address, browser and device information, and log data generated when using our services.
• Payment data — handled by our payment processors. We do not store full card numbers on our systems.

• To provide, operate, secure and support our products.
• To route messages, orders and notifications between a business and its customers on that business's instruction.
• To respond to enquiries and provide customer support.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To meet legal, tax and regulatory obligations.

Connecting your QuickBooks Online company gives us an access token and a refresh token issued by Intuit. We never receive or store your QuickBooks password. Both tokens are encrypted before they are written down, and they are used only for the bookkeeping work you have engaged us for.

When you disconnect, those tokens are erased immediately. Revoking access kills them at Intuit, and our stored copies are deleted at the same moment. What remains is the record that your company was connected and when that ended, which we keep so the work we did stays auditable. Accounting data already held is a separate request — see Disconnect from QuickBooks.

We do not sell, rent or share your accounting data, and we do not use it to build products for other clients or to train any model.

We process personal data where it is necessary to perform our contract with you, where we have a legitimate interest in operating and securing our services that is not overridden by your rights, where you have given consent, and where we are required to by law.

We share personal data only with service providers who help us run our services — hosting, messaging, analytics, payment infrastructure — under contracts that limit their use of it; with a business customer whose account the data belongs to; and where required by law or to protect our legal rights. We do not sell personal data, and we do not use it to train any model.

Some of our infrastructure providers operate outside India, so we name where the data actually sits rather than leaving it to be asked for. Our application database is operated by Supabase and hosted in Sydney, Australia. Accounting data belonging to clients we work with is stored there.

Where personal data is transferred abroad, we rely on contractual protections requiring the recipient to apply standards comparable to those described in this policy. If you are in the United Kingdom or the European Economic Area and need your data kept in a particular region, ask us before you engage us and we will tell you plainly whether we can do it.

We retain personal data for as long as an account is active and for the period afterwards required to meet legal, accounting and dispute resolution obligations. Business customers may request deletion at any time, subject to those obligations — see our Data Deletion page.

Data is transmitted over encrypted connections and stored on infrastructure with access controls, logging and regular patching. Access to production data is limited to personnel who need it to operate or support the service. Our Security page describes these controls in more detail.

You may request access to, correction of, or deletion of your personal data, and may object to or restrict certain processing. Write to dipa@pingtail.com and we will respond within the timeframe required by applicable law.

Our website uses cookies necessary for the site to function and, where enabled, analytics cookies that help us understand usage. See our Cookie Policy for the full list and how to control them.

Our services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe we have, tell us and we will delete it.

We will update this policy as our services change and will revise the effective date above. Material changes will be notified to account holders by email.