Privacy Policy

Razoyo Insights is a reporting service operated by Razoyo, LLC, a Texas limited liability company ("Razoyo", "we", "us"). This policy describes how we handle information when a business (our "client") asks us to build reporting from its QuickBooks Online books, and when anyone visits insights.razoyo.com.

Razoyo Insights is not a self-service product. Each client's reporting is set up, run and supported by Razoyo under a separate engagement with that client. If you received a report from us and aren't sure why, the client who commissioned it is the right first contact.

When a client connects a QuickBooks Online company, Intuit issues us a credential for its accounting API, and we use it only to request reports and query records. Razoyo Insights does not write to your books. It creates nothing, edits nothing and deletes nothing, and the reporting it produces never needs it to.

What we read depends on the reporting a client has asked for. It generally covers company profile details, standard financial reports, account balances, and the underlying transaction and list records those reports draw on. We request only what a client's reporting needs.

Because accounting records describe a business's dealings with real people, this data can include names and contact details of customers, vendors and employees. We treat all of it as our client's confidential information.

We collect what our clients tell us in the course of setting up reporting:

• names and email addresses of the people a client designates to receive reporting;
• names and email addresses of the people authorized to connect a QuickBooks company or administer the account;
• the configuration a client asks for — which companies are covered, on what schedule, and what the reporting should show;
• anything sent to us in support correspondence.

Our servers keep ordinary operational logs of requests to insights.razoyo.com — IP address, browser user agent, the page requested, and a timestamp — along with records of jobs run, data collected and reports sent. We use these to keep the service working, to investigate faults, and to detect abuse.

We use cookies only where they are needed to make the site work — for example, the session cookie that protects forms against cross-site request forgery. Your light or dark theme choice is kept in your browser's own local storage and is never sent to us. We do not currently use advertising cookies or third-party analytics trackers, and we do not respond to browser "Do Not Track" signals, because we do not track visitors across other websites in the first place.

We use the information described above only to:

• produce and deliver the reporting our client has asked us to build;
• operate, monitor, secure and troubleshoot the service, including keeping QuickBooks connections alive and alerting us when one fails;
• communicate with the client about their reporting and their account;
• comply with law and enforce our Terms of Service.

• We do not sell your data, and we do not share it for anyone's advertising.
• We do not share one client's data with another client, and we do not combine clients' data.
• We do not disclose your data to third parties beyond the service providers listed below — except where the law requires it, or where our client asks us to.
• We do not write anything to your QuickBooks books.

Data collected from QuickBooks Online is stored in a PostgreSQL database hosted by Render in a United States region, and the application that reads and writes it runs in the same region. Traffic between your browser, our servers and Intuit is encrypted in transit.

We are a US-based company serving US-based clients. If you are outside the United States, understand that your information will be processed there.

Running the service requires a small number of infrastructure providers, each of which may process data on our behalf:

• Intuit — the source of the accounting data, via its API.
• Render — application hosting and the managed PostgreSQL database.
• Cloudflare — DNS and edge traffic handling for razoyo.com.
• Mailgun — delivery of the reporting we send by email.

We also use a small number of ordinary operational services — for backups, error monitoring and internal communication — which may incidentally process this data in the course of keeping the service running. A client can ask us for our current list at any time.

Every one of these providers is permitted to use the data only to provide their service to us, and none of them is permitted to use it for their own purposes.

If Razoyo is acquired, merges with another company, or sells substantially all of its business or assets, the information covered by this policy may transfer to the acquiring party as part of that transaction. It would remain subject to this policy, or to a policy at least as protective, and we would tell affected clients.

We keep the data we collect from QuickBooks for as long as we are producing reporting for the client it belongs to. After an engagement ends we keep it for a limited period so that reporting already delivered stays accurate and explainable, and then delete it in the ordinary course. We do not keep it indefinitely, and we do not keep it for any purpose other than the one it was collected for.

Operational logs and job records are kept for a short period for troubleshooting and security, and are used for nothing else. We may also keep records we need in order to meet a legal, tax or accounting obligation.

A client can ask us to delete the data we hold for their companies at any time, and we will — see Your choices. For a period after a deletion, copies may still exist in encrypted backups until those backups age out on their normal rotation; we do not restore deleted data from them.

We limit access to client data to the Razoyo personnel who need it to build and operate that client's reporting, and staff access to our administrative tools requires authentication and is logged.

We use administrative, technical and physical safeguards appropriate to the sensitivity of this data. Traffic to insights.razoyo.com is served over HTTPS and encrypted in transit, and the credentials Intuit issues us are stored encrypted, kept separately from reporting data, and used only to make the read requests a client's reporting needs.

No service can promise perfect security, and we don't. If a security incident affects your data, we will tell the affected client without undue delay, and tell them what we know about what happened and what we are doing about it.

A QuickBooks administrator can disconnect Razoyo Insights at any time from Apps inside QuickBooks Online. When that happens Intuit revokes our access immediately and we stop collecting anything further from that company. Reporting that depended on it stops with the next scheduled run.

Disconnecting does not by itself erase what we already collected. To have that deleted, ask us — see Contact us.

You can ask us at any time to:

• tell you what data we hold for your company;
• correct information you've given us, such as a recipient's details;
• stop sending reporting to a particular recipient;
• delete the data we hold for your company.

Because we hold this data on behalf of our client, requests about a company's accounting data need to come from that client, or be confirmed by them. We verify who is asking before we act, and we respond as promptly as we reasonably can — and within any period the law sets.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the twelve months before the date at the top of this page, and we have no plans to.

California residents have the right to know what personal information we hold about them, to ask us to correct or delete it, and not to be treated differently for exercising any of those rights. To exercise them, write to privacy@razoyo.com — you can use an authorized agent, and we will verify the request before we act on it.

One thing worth being plain about: most of the personal information we hold is our client's own accounting records, which we process on that client's instructions as their service provider. If your information is in a client's books, that client is the business responsible for it, and we will pass your request to them rather than acting on their records ourselves.

Razoyo Insights is a tool for businesses. It is not directed to children, and we do not knowingly collect personal information from anyone under 13 other than whatever appears incidentally in a client's own accounting records.

We may update this policy as the service changes. The current version always lives at this URL, with its effective date at the top. If a change materially affects how we handle your data, we will email the client contacts we have on file before it takes effect.

Questions about this policy, or about the data we hold, go to privacy@razoyo.com, or to your Razoyo contact directly.

Written notices go to: Razoyo, LLC, 6228 Pebble Beach Lane, The Colony, TX 75056, USA.