Epiphany Content

Privacy Policy

How the QuickBooks Integration handles data, and who is responsible for it.

Effective 10 September 2026

1. Who is responsible

Epiphany Content Ltd (company number 11609641), First Floor Flat, 24 Clarendon Villas, Hove, East Sussex BN3 3RB, is the data controller for the records the Integration handles. Contact: kevan@epiphanycontent.com.

2. What the Integration accesses

Through the QuickBooks Online Accounting API, using the com.intuit.quickbooks.accounting scope only:

• Customer records, including business contact names, addresses and email addresses already held in the company's QuickBooks file
• Sales invoices and their line items
• Products and services, used to post invoice lines to the correct income account
• Company information, including registered address and VAT registration number

3. Why

To raise and maintain Epiphany Content Ltd's own sales invoices accurately, and to keep its accounting records complete. The lawful basis is legitimate interests in running and administering the business, together with the legal obligation to keep proper accounting and VAT records.

4. Whose data this is

The records belong to Epiphany Content Ltd. Where they contain personal data, it is business contact information for the company's own customers and suppliers, already held in QuickBooks before the Integration touches it. The Integration collects no personal data from members of the public and operates no user accounts.

5. Where data goes

Data moves between QuickBooks Online and a machine controlled by Epiphany Content Ltd in the United Kingdom. Epiphany Content Ltd does not sell, rent, publish or disclose it to third parties, and makes no use of it for advertising, profiling or analytics. There are no sub-processors.

6. Security

• Authorisation uses Intuit's OAuth 2.0 flow. QuickBooks passwords are never entered into or stored by the Integration.
• Access and refresh tokens are held in a local configuration file with restricted file permissions, excluded from version control.
• All API traffic runs over TLS.
• Access is limited to Epiphany Content Ltd personnel.
• Delete and void operations are disabled.

7. Retention

Tokens are kept only while the connection is active and are deleted when it is revoked. Accounting records remain in QuickBooks Online under Epiphany Content Ltd's own retention practice, and are kept for at least six years to meet UK accounting and VAT requirements.

8. Your rights

Under the UK GDPR, individuals whose personal data appears in these records may request access, correction, erasure, restriction, or object to processing. Write to kevan@epiphanycontent.com. Complaints may be made to the Information Commissioner's Office at ico.org.uk.

9. Changes

Any change to this policy is published on this page with a revised effective date.