1. Who we are
Sync Simple is operated by Optivane LLC (“we”). We are the controller of your account data and a processor of the accounting data you connect and the files you upload, which you (or the client you act for) control.
QuickBooks and Intuit are trademarks of Intuit Inc. Sync Simple is an independent product for QuickBooks Online and is not affiliated with or endorsed by Intuit.
2. What we collect
Account and organization
- Name, email address and sign-in method, held by our authentication provider (Clerk).
- The organization you belong to and your role in it, so every record is scoped to your tenant.
QuickBooks connections
- The company identifier (realm id), company name and environment (sandbox or production) of each QuickBooks Online company you connect.
- The OAuth access and refresh tokens Intuit issues for that connection. They are encrypted at rest (AES-256-GCM) with a key held outside the database, are never shown in the app, never written to logs or error reports, and are used only to make the QuickBooks requests you ask for.
- Reference data read from your company to resolve names in your files: customers, vendors, accounts, items, classes, locations, terms, and the document numbers of transactions a payment links to.
Files and import history
- The rows of each file you import, as uploaded, together with the mapping you chose and the result for every row (created, duplicate, invalid, failed) and the QuickBooks id of anything created. This is your import history; it is what lets you review and undo a batch. It commonly contains your clients’ customer and vendor names, amounts, dates and document numbers.
- Saved mapping templates (column names and the fields they map to).
- Files are not stored as files: the parsed rows are stored, dry runs store nothing, and Export, Modify and Delete read from QuickBooks without storing the results.
Technical data
- Error reports (Sentry): the error, the page or route, and identifiers such as an import id. Request headers, cookies, request bodies, query strings and user details are stripped before an event leaves our servers, and anything shaped like a credential is redacted.
- Server logs with request paths and status codes, kept by our hosting provider for a limited time.
- Cookies: a session cookie from Clerk to keep you signed in, a short-lived state cookie during the QuickBooks connect flow, and a cookie remembering which connected company you last selected. We do not use advertising or cross-site tracking cookies.
3. How we use it
- To run the service: read and write to the QuickBooks companies you connect, exactly as you instruct.
- To show you what happened: import history, per-row results, and the ability to undo.
- To keep the service reliable and secure: error reports, rate-limit handling, tenant isolation.
- To contact you about your account or changes to these terms.
We do not sell your data, use it for advertising, train models on it, or use data obtained from Intuit for any purpose other than performing the operation you requested. Access to your QuickBooks data is limited to the accounting scope you grant during connection.
4. Who else sees it (sub-processors)
These providers process data on our behalf, each under its own privacy terms:
- Clerk — sign-in, accounts and organizations (privacy)
- Intuit (QuickBooks Online) — the accounting data you connect (privacy)
- Vercel — hosting the application and its server logs (privacy)
- Supabase — the Postgres database holding your account, connections and import history (privacy)
- Inngest — running imports in the background (ids only, no file content) (privacy)
- Sentry — error reports, with credentials and request data stripped (privacy)
When billing launches, Stripe will process payment details; we will not hold card numbers. We will update this list before adding a provider.
5. How long we keep it
- Account and organization data: until you delete your account or organization.
- QuickBooks tokens: until you disconnect the company. Disconnecting a company in Settings revokes our access with Intuit and deletes the stored tokens immediately; the company’s import history stays until the organization is deleted. You can also revoke access from your Intuit account at any time.
- Import history and templates: until your organization is deleted, so that any batch can be audited or undone. Deleting an organization removes them.
- Error reports: per Sentry’s retention (90 days by default). Server logs: per the hosting provider’s retention.
6. Deleting your data
Deleting your organization, or your account if you use a personal workspace, revokes every connected company’s QuickBooks access with Intuit and deletes the organization’s connections, templates and import history. You can do this from your account settings, or email inquiries@optivane.com and we will do it for you.
7. Security
All traffic is encrypted in transit. Tokens are encrypted at rest. Every database query is scoped to your organization. Imports validate the whole file before anything is written, and every batch can be reversed. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.
8. Your rights
Depending on where you live you may have the right to access, correct, export, restrict or delete your personal data, or to object to how we use it. Email inquiries@optivane.com; we answer within 30 days. If you are a bookkeeper or accountant acting for a client, requests about the client’s data should come through you.
9. Children
Sync Simple is a business tool and is not directed at anyone under 18.
10. Changes
We will post changes here and update the effective date. For material changes we will email account owners before they take effect.
11. Contact
Optivane LLC. Email inquiries@optivane.com; our postal address is available on request.