Privacy Policy — OberBuilt Inventory

Effective date: 1 December 2026 Last updated: 5 November 2026

Two parts of this policy apply before that date. What it says about a video you choose to play on our website — section 12, "Videos from YouTube", and the passages about such a video in sections 2, 9 and 20 — applies from 31 October 2026. What section 5 says about where the Service is offered, which now includes Saskatchewan, applies from 5 November 2026. Until 1 December 2026, the rest of the policy that applies is the version that took effect on 18 October 2026, published at https://obinv.oberbuilt.ca/legal/privacy/2026-10-18. Where that version says otherwise about such a video — for example, that the Service sets only three cookies and permits no one else to set one, or that its website has no advertising or tracking technology — or excludes Saskatchewan, these passages replace it.

This Privacy Policy explains what personal information OberBuilt Inc. collects when you use OberBuilt Inventory, or when we contact you about it, why we collect it, who we share it with, where we keep it, how long we keep it, and what you can do about it.

"OberBuilt", "we", "us" and "our" mean OberBuilt Inc. "You" and "your" mean the business that subscribes to the Service and the people who use it on that business's behalf. Where this policy speaks to people at businesses that are not our customers (section 2's last bullet and that part of section 7), "you" means the person we have contacted, or who has asked us about the Service. The "Service" means the OberBuilt Inventory application at obinv.oberbuilt.ca, which connects to QuickBooks Online.

OberBuilt Inventory lets you build multi-level bills of materials, run build and un-build transactions costed first in, first out, the way QuickBooks Online values inventory, and see where components are short. It is a tool for businesses. It is not aimed at consumers and it is not aimed at children.

We are a Canadian company. The law that governs how we handle personal information is Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA). Manitoba, where we are incorporated, has no in-force private-sector privacy statute, so PIPEDA applies to us directly. This policy is organised around PIPEDA's ten fair information principles, but written so you can actually read it.

1. Who we are, and who is accountable (Accountability)

Our Chief Executive Officer is our Privacy Officer. That person is accountable for our compliance with this policy and with PIPEDA. They are also the person to whom access requests, correction requests and privacy complaints should be sent. Write to them at support@oberbuilt.ca, or at the postal address above, marked "Attention: Privacy Officer". Both are monitored. We will tell you the Privacy Officer's name if you ask — write to the same address.

We remain responsible for personal information that we transfer to a third party for processing on our behalf. Canadian privacy law requires us to use contractual or other means to give it a comparable level of protection while it is in someone else's hands, and both of our providers are covered by written terms we accepted before we used them. There are two of them; they are named in section 12, together with an explanation of why Intuit is not one of them, and section 12 sets out what each of those contracts does and does not oblige, including which of them is a data processing agreement — the document that spells out how a supplier must handle information it holds on a customer's behalf — and which is not.

2. What this policy covers

This policy applies to personal information we handle when you:

• connect a QuickBooks Online company to the Service;
• create or manage an account, a free trial, or a subscription;
• use the Service's items, bills of materials, build, un-build, shortage and export features;
• receive email from us about your account;
• contact us for support; or
• work at a business we have contacted, or that has asked us, about OberBuilt Inventory (section 7).

It does not cover Intuit's own handling of your QuickBooks Online data, Stripe's own handling of your payment details, or YouTube's own handling of a video you choose to play on our website (section 12). Those companies have their own privacy policies, and we do not control them.

3. Whose data is whose

Your books are yours. Everything in your QuickBooks Online company — items, bills, purchase orders, vendor names, costs — belongs to your business. We read it, and write build transactions into it, only because you told us to — by running builds and un-builds, as section 6 describes — and for no other purpose. You decide what is in your books; we never do.

Your account with us is ours to run. Your subscription record, billing details, sign-in sessions and support emails exist because we need them to run this business. We are responsible for them, and this policy is our disclosure to you about them.

Intuit is your provider, not ours. Intuit holds your books under your own agreement with Intuit. Section 4 explains that relationship.

For readers used to the vocabulary of privacy law: for your QuickBooks Online data you are the "controller" and we are your "processor"; for your account data we are the controller; and Intuit and OberBuilt are independent controllers of each other, never joint.

4. Our relationship with Intuit

Three statements, all of which we want to be unmistakable.

We are not affiliated with Intuit. OberBuilt Inc. is an independent company. We are not affiliated with, endorsed by, sponsored by, or approved by Intuit Inc. As for approval, Intuit's only role is that it reviewed OberBuilt Inventory before allowing it to connect to real QuickBooks Online companies. Beyond that permission, Intuit has not approved or endorsed OberBuilt Inventory or what it does with your data, and is not responsible for it.

We do not process your QuickBooks data on Intuit's behalf. We access your QuickBooks Online data because you authorised us to, through Intuit's own OAuth consent screen — not because Intuit engaged us to do anything. Under Intuit's Developer Terms of Service, Intuit and OberBuilt are independent controllers and expressly not joint controllers: each of us decides independently why and how we handle information, and each of us is separately responsible for our own compliance. We are not Intuit's processor, agent, partner or representative, and nothing in this policy should be read as saying otherwise.

Trademark attribution. Intuit and QuickBooks are registered trademarks of Intuit Inc.

5. Where the Service is offered

We offer the Service only to businesses located in Canada, excluding Quebec, and in the United States. By the United States we mean its fifty states and the District of Columbia, not its territories, such as Puerto Rico or Guam.

This is a term of our contract with you, and it is backed by a technical check. Each time you connect a QuickBooks Online company or sign in with QuickBooks Online, we read the country, the province or state, and the postal code recorded in that company's QuickBooks Online company information, and use them to work out where the company is. We refuse a company recorded outside the area above — for example in Quebec, outside Canada and the United States, or with no country recorded — and may refuse one whose postal code places it there; if it is a company we already serve, we then disconnect it (section 15). Each connection or sign-in that is not refused also updates the country and province we hold for you to the ones recorded in QuickBooks Online. While you stay connected, we read the address again from time to time, only so that our staff are told if it has moved to a place we do not serve; nothing is refused or disconnected automatically because of that. The check is only as good as the address in your QuickBooks Online file, so it is not a guarantee. That is why the same restriction is also a binding term of our Terms of Service and End User Licence Agreement, whose section 4.2 sets out the check in full. If we refused your company because that address was wrong, correct it in QuickBooks Online and connect again. If you are located outside the permitted territory you are not permitted to use the Service even if no technical check stops you, and we may end your account when we find out.

Because we do not accept customers in the European Union, the European Economic Area or the United Kingdom, this policy does not describe rights under the GDPR. Because no United States state comprehensive privacy law applies to us — outside California, those laws do not cover people acting in a business capacity, and California's applies only to businesses far larger than we are or that trade in personal information, which we do not — this policy does not contain a California or other state-specific rights section. We would rather say nothing than claim compliance with a law that does not apply.

6. The QuickBooks Online data we read — and what we write back

Authentication, when you connect your QuickBooks Online company and when you sign in while it is connected, happens entirely at Intuit. While it is disconnected, you can also sign in with a code we send by email (section 8). We never receive, see or store your QuickBooks Online username or password. Intuit hands us a token; we never hold your QuickBooks Online sign-in credentials.

We request exactly one permission scope from Intuit: com.intuit.quickbooks.accounting. We do not request access to payments, and we do not request Intuit's separate sign-in permissions for your personal Intuit profile, telephone number or address. The company address described below comes from your company's own records in QuickBooks Online.

What we read

• Inventory items — names, quantities on hand, and cost information.
• Bills of materials and component structure — including the bills of materials you create in the Service and the groups you sort them into.
• Purchase orders and bills — used to work out component shortages and costs. These records carry vendor names. See section 7.
• Build and un-build transactions, including the cost snapshots taken at build time, and the build plans you create in the Service to plan builds.
• Company information — we read your company's default time zone and home currency; the QuickBooks Online plan it is on, and whether its settings track inventory quantity on hand and use multiple currencies, which tell us whether, and how, the Service can post builds for your company; its name; its address (or, if that has no province or state and its legal address does, its legal address) — country, province or state, street, city and postal code — used for the territory check in section 5 and for billing, including sales tax; the date and time your QuickBooks Online company was created; and the email address recorded on your QuickBooks Online company. We pass the address to Stripe when your customer record at Stripe is created, so that it can calculate the right sales tax. We keep the country and province or state, but we do not otherwise store the street, city and postal code (the invoices issued to you carry the address Stripe holds, and we keep copies of them — section 15; and the messages Stripe sends us about your billing can carry it while we hold them — section 8). We keep the creation date and time to confirm that a company reconnecting is the same one that connected before, and we use the email address as the address we write to and as a check that the person reconnecting is the same person who connected in the first place. You can change the address we write to at any time in the Service's settings. For the check on reconnecting, we also keep the most recent email address the company reported when it connected successfully; changing the address we write to does not change that copy. We use that copy for one other thing: when someone signs in with an emailed code, we send it a notice of the sign-in if it is not the address we write to (section 8). We read this company information when you connect, and again from time to time while you stay connected.

What we write — and what we delete

OberBuilt Inventory does not only read. When you run a build or an un-build, the Service creates, modifies and in some circumstances deletes records inside your QuickBooks Online company. Specifically:

• It creates bills and inventory adjustments that change your inventory quantities and your inventory valuation.
• On your first build it creates one supplier record ("Vendor") in your QuickBooks Online company, named OberBuilt Inventory (Internal, Do Not Pay). It is not a real supplier and it must never be paid. The Service uses it as the counterparty on the internal bills it posts for your builds. It is created once and reused after that, and it stays in your supplier list after you cancel, disconnect or ask us to erase your data — we cannot remove it for you once your authorisation ends, but you can delete or deactivate it yourself in QuickBooks Online.
• When you un-build all of what remains of a build, the Service permanently deletes the bill it posted for that build — a deletion, not a void — which takes the finished goods back out of your inventory and returns the components the build used. The Service tells you this before you confirm. When you un-build only part of a build, it changes that bill to the quantity that stays built, at the build's original cost, instead of deleting it.
• After an un-build, the Service may re-send, unchanged, the bill it posted for each other build that still stands, is dated the same day and used one of the same components, to have QuickBooks Online recalculate that bill's cost; section 9.3 of our Terms of Service and End User Licence Agreement explains why, and what it can change. The bill keeps the same items, quantities, prices, amounts, date and bill number, but QuickBooks Online can show the re-send in the bill's history as an edit. The Service does not tell you which bills it re-sent.
• Where a build or un-build fails after the Service has already posted a bill, the Service permanently deletes that bill from your QuickBooks Online company — a deletion, not a void — and, where it had already posted inventory adjustments, reverses those by posting equal-and-opposite adjustments. Section 9 of our Terms of Service and End User Licence Agreement explains why the Service deletes these bills rather than voiding them, and what that means for your books.

Every one of those writes follows from a build or an un-build you asked for, and is made through Intuit's own API.

The limits we work within

• We access only the QuickBooks Online data the Service actually needs to do these things.
• We use it only to provide the Service to you, within the boundaries of the authorisation you gave at the Intuit consent screen.
• We do not sell it. We do not make it available to any third party for any purpose that does not directly support your own use of the Service.
• The Service does not write your QuickBooks Online records into its application logs, and we never log your tokens. The time zone and home currency recorded for your company can appear in them, and so can the country and province or state of your company's address, or of the billing address Stripe holds for you — for example when the check in section 5 refuses a connection — but never a postal code. Our application logs pass through redaction rules that strip secrets, tokens and credentials before anything is written down. One narrow exception: if the email address on your QuickBooks Online company changes, our error monitor records the old and the new address, because a change of company owner is a security event we have to be able to investigate. That monitor runs on our own hardware in Winnipeg (section 13).

7. Personal information about people who are not our customers

This section is for vendors, suppliers and others whose names appear in a customer's QuickBooks Online records, and for customers who want to understand their own obligations.

Purchase orders and bills synced from QuickBooks Online carry vendor names. Where a vendor is a corporation, that name is not personal information. Where a vendor is an individual or a sole proprietor, the name is personal information about that person — a person who has no relationship with us and never agreed to anything with us.

We treat those vendor names as personal information under PIPEDA and handle them accordingly. We hold them only because they are part of the accounting records in our customer's own QuickBooks Online company, and we use them only to display and compute costs and shortages inside that customer's own account. We do not use them to contact anyone, we do not add them to any list, and we do not disclose them to anyone outside the service providers named in section 12.

Where responsibility sits. The customer — the business whose QuickBooks Online company the data comes from — is the controller of that information. The customer is responsible for having a lawful basis for the personal information in its own books, for telling its own vendors and customers why it collects their information and how it is handled, and for the accuracy of that information. We process it on the customer's instructions, to provide the Service.

If you are a vendor and your name is in a customer's records, the fastest route is to contact the business you deal with, because they control those records and can change them at source. You can also write to our Privacy Officer at support@oberbuilt.ca and we will help you reach the right place and, where PIPEDA requires it of us, respond directly.

If we have contacted you about OberBuilt Inventory

This part is for people at businesses that are not our customers.

What we do. Our staff sometimes write to someone at a business, one person at a time, to introduce OberBuilt Inventory — by email or by a message on LinkedIn, never by text message. We do not send newsletters or bulk mailings, and we do not buy, rent, borrow or scrape lists of addresses. We write only to businesses in the area where we offer the Service (section 5).

When we write. We write to you only where Canada's anti-spam law allows it: you agreed to hear from us; you asked us about OberBuilt Inventory in the last six months; you gave us your business email address yourself, or openly published it, or had it published, for example on your business's website, without a statement that you do not want unsolicited messages, and what we write is relevant to your role in your business; or someone who knows both you and us referred you to us — then we send one first message, which names them and says it follows their referral, and we write again only if you reply asking about it, or another of these reasons applies. We do not write this way to our customers or to anyone on a free trial: before each message, the first and every follow-up, one of us checks by hand that the business is not a customer or on a free trial, and that answer is not written down. If someone we have written to starts a trial or becomes a customer, we stop. We never use anything from a customer's account, or from the QuickBooks Online records our customers keep, to find people to write to.

What we keep. For each person we write to: their name, role and business; the business email address or profile we used, and where we found it or how they came to us, including who referred them, if anyone; which of the reasons above lets us write; when we wrote and what we sent; any reply, and our notes on the conversation; and, if they asked us to stop, when.

How to make it stop. Reply to any of our messages saying so, or email support@oberbuilt.ca with "unsubscribe" in the subject line. We act on it within 10 business days, and we keep a do-not-contact entry — your email address or profile and the date you asked — so that we do not write to you again.

How long we keep it. Three years after the last message between us, we delete our record of the outreach, together with the emails in our mailbox and the LinkedIn conversation on our side, because the law puts it on us to show why we were allowed to write until then. Copies in our email host's own backups of the mailbox are removed on that host's schedule, not ours. The do-not-contact entry is kept for as long as we write to businesses this way, so that your request keeps working.

Where it is kept, and who sees it. We keep this record in our own business files in Canada, separately from the Service, and never with the information we hold about customers. Only the OberBuilt staff who do this outreach can see it. Emails we send and receive are held in our business mailbox at Web Hosting Canada (section 12). Messages sent on LinkedIn are held by LinkedIn under the terms each of us accepted as LinkedIn members.

Artificial intelligence. We may use an artificial-intelligence writing tool to help with the general wording of these messages. We give it only a description of the kind of business we are writing to — never your name or your business's name, your contact details or profile, anything you have written to us, our notes about you, or whether your business is or was a customer or on a free trial; we add those ourselves.

Your rights. You can ask what we hold about you, ask us to correct it, or ask us to delete it (section 18). If you ask us to delete it, we keep only the do-not-contact entry, so that we do not write to you again.

8. The other information we collect

Account and subscription information

• The email address we send your account emails to. We take it, to begin with, from your QuickBooks Online company profile. You can change it in the Service's settings at any time — but a new address does not take effect until someone at that address clicks a confirmation link we send it, and until then your account emails keep going to the address already on file. Until the first time you set the address in our settings, it keeps following your QuickBooks Online company profile, and a correction made there needs no confirmation from us. Correct it there and reconnect, and we follow you to the corrected address without a confirmation link. From the first time you set it here — including clearing it, or confirming the address that was already there — the company profile no longer overrides your choice, and every later change goes through the confirmation above. While a change is waiting to be answered we hold the requested address, a hashed copy of the one-time code in that link, and the address it would replace. The confirmation link works for 24 hours; the page it opens keeps accepting a "no, I did not ask for this" answer for 30 days. We delete the record 7 days after the change is confirmed or cancelled, and, for a request nobody ever answers, 7 days after that 30-day window closes. If the person at the new address tells us they did not ask for it, we send nothing further to that address on behalf of your company for 30 days, and we keep the record of that refusal for the same period. We also send a notice to the address being replaced, naming the new one. You can clear the address altogether, and that takes effect at once — we tell the address we are dropping that we are stopping — but if you do, we cannot send you any account emails (section 14 says what that means). Whenever the address on your account changes, including when you clear it, we pass the change on to Stripe, so that the emails Stripe sends you follow it (section 14).
• A record of the account emails we send you, and of the ones that fail. For each account email we keep which message it was, when we sent it, the address it went to, and what the receiving mail server said in reply. If a message comes back undeliverable we also keep that failure report — the address it was for, the reason the receiving server gave, and which server gave it — and, against the address itself, a note of the most recent failure and a running count of the messages we have held back from it. That note is what tells us to stop sending to a dead address, and that count is the number the notice in the Service shows you (section 14). We delete the send records and the failure reports 90 days after they are written. The copies of the failure messages themselves, which sit in a mailbox at our email host (section 12), are deleted on the same 90-day schedule once we have read them. The note against an address is kept for as long as that address is the one on an account or on a change waiting to be confirmed, and is deleted once no account uses it and it has gone 90 days without changing. The count is cleared when the address starts working again, and — on the same condition as the note above — it is deleted when your data is erased or purged, unless another account still uses that address. It is never kept more than 90 days past the last message it counted.
• Every email the Service sends, while it is on its way. Each email the Service sends — to you, or one of its alerts about your account (section 12) — waits in our job queue, with the address it is for, which company it is about, and everything it says, including any attachment, until it has been handed to the mail server we send through or we decide not to send it, and is then removed from the queue straight away; one that fails stays longer, as described below and, for an alert, in section 15. Until the queue's saved files on the machine that runs the Service are next compacted, they can still hold an email that has been removed, and backups of those files keep it for up to 35 days after that. Once a day, while our background service is running, we ask for that compaction.
• An account email we could not deliver. When the mail server we send through refuses one of our emails to you, or we stop retrying it, we keep that email — the address it was for, which company it was about, and everything it said, including any attachment — in our job queue so that we can find out what went wrong. We remove each such email from the queue about seven days after we gave up on it, and when you erase your data, we remove yours as well. Until the queue's saved files on the machine that runs the Service are next compacted, they can still hold a removed email, and backups of those files keep it for up to 35 days after that.
• Your account is keyed to the identifier of the QuickBooks Online company you connect. When your data is deleted, we keep that identifier, with the dates and how many of its invoices an introductory discount applied to, as a record of the company's free trial and introductory discount (section 15).
• We store the Stripe customer and subscription identifiers, your country and province or state, your preferred language setting, your billing currency, your subscription status and period dates, and the last four digits of your payment card as a reference so you can tell which card is on file.
• A record of each time you accept our Terms of Service and End User Licence Agreement: which version you accepted, when you accepted it, how you accepted (by ticking the box when you connected a QuickBooks Online company, or when you went on to start a new subscription after our terms had changed), the identifier of that company, and a keyed hash of the network (IP) address the acceptance was recorded from — never the address itself (below). We write it when the connection to your company is completed or, for a new subscription, when you continue to our payment provider's checkout page — even if you then leave that page without paying. Each acceptance adds a new record; earlier ones are not overwritten. Section 15 says how long we keep them.
• If we give your company a discount, a special price or a credit by hand, or a refund, a record of it: the identifier of your QuickBooks Online company, what we gave and the amount, the references our payment provider gave it, who on our side gave it and why, when, and, for a discount, special price or credit, when it was withdrawn or ended. Section 15 says how long we keep it.
• We do not ask why you are cancelling, and we keep nothing you write when you cancel. When a subscription ends, our payment provider tells us how — for example, that it was cancelled or that a payment failed — and we use that to keep your account's status right.
• When Stripe tells us that something about your billing has changed — your customer record, your subscription, an invoice, a refund or a dispute — we hold its message in our job queue while we act on it. The message can include your billing name, email address, telephone number, address and any tax registration number and, for some messages, such as one about a refund, your card's brand, last four digits and expiry date. Erasing your data does not reach these messages; they are removed as described here. We remove each such message from the queue within about a day of finishing with it or giving up on it. Until the queue's saved files on the machine that runs the Service are next compacted, they can still hold a removed message, and backups of those files keep it for up to 35 days after that.
• If you ask us to stop sending you commercial messages (section 14), we keep a record of that request: the email address it applies to, the messages it covers, the date you asked, the date we recorded it, the date the record expires and, until your data is deleted, which company it came from, if any (section 15).

We never receive your full card number. Card details go directly to Stripe and are held by Stripe. Our exposure to payment card data is zero.

Authentication and session information

When you sign in, we create a session record. It contains:

• an unguessable session identifier, stored in the cookie described in section 9;
• a keyed SHA-256 hash of your IP address — not the address itself. We hash it with a secret key so that we can recognise an unusual pattern without holding the raw address in your session record;
• the browser user-agent string your browser sends, truncated to 512 characters.

Sessions expire after 30 days — or 2 hours, for a session started by signing in by email (below) — and cannot be extended by using the Service. A session started by signing in by email also ends sooner if it goes 30 minutes without use (below). A session record is fully deleted about a week after it expires. When you disconnect inside the Service, we end every session for your company.

Sign-in codes

If your QuickBooks Online company is disconnected, you can sign in without reconnecting by asking for a code on our sign-in page (Terms of Service and End User Licence Agreement, section 5.6). We look up which companies use the address you type as the address we send account emails to, and email that same address a sign-in code for each one that is disconnected or, for a company that is still connected, a pointer to sign in with QuickBooks Online instead. So that the page cannot be used to flood a mailbox, we limit how many companies one request covers and how many of these emails we send for each company, and we send none for a company whose account is on hold — for example while a change of owner is checked. The email names each company, or, where a company has no name on record, shows its Company ID, the identifier also shown in the Service's settings. It contains no sign-in link. The page shows the same message whether or not we know the address, and we do not store the address you typed or write it into our logs, except as the recipient in the record we keep of each email we send (above). If we do not know the address, we keep no record of the request in our database.

A code works only in the sign-in page that asked for it, only once, for a limited time and a limited number of tries; section 5.6 of our Terms of Service and End User Licence Agreement sets out those limits. It signs you in for 2 hours, and only to your billing settings, the CSV export, erasing your data, telling us your email address works again (section 14) and reconnecting. That sign-in also ends if it goes unused for 30 minutes. Signing in with a code ends any earlier session in the same browser.

For each code we keep a record of which company it is for, the address we sent it to, when it was created, when it expires, whether it has been used and how many tries have been made, together with a keyed hash of the code, made with a secret key that is not kept in our database, and a hash of the identifier of the page that asked for it — never the code or the identifier itself. We delete a sign-in code's record 7 days after it was created. To enforce the limits above, we also keep, for an hour, the times at which codes were sent for each company, together with a keyed hash of the network (IP) address that asked — the same keyed hash a session record holds (above), never the address itself.

Each time someone signs in with a code, we email a notice naming the company, the address the code was sent to, and the date and time of the sign-in, with the time zone. It goes to the address the code was sent to and, if it is different, to the company email address described in section 6 — unless that is not a usable email address or mail to it is coming back undeliverable (section 14). The notice contains no code and no sign-in link, and nothing about the browser used or where it was. If you did not sign in, reply to the notice or write to support@oberbuilt.ca straight away, and we will end any email sign-in in progress for your company and cancel any code not yet used. That does not stop someone who can read the mailbox from asking for a new code, so secure the mailbox as well. Reconnecting your company also ends every email sign-in, and while it is connected no codes are sent.

How we handle IP addresses, stated precisely

We want to be exact here rather than flattering, because this is a claim people check.

• In your session record, your IP address is stored only as a keyed hash, never in raw form. There is no raw IP address column anywhere in our database. For an IPv6 address, we hash only its first 64 bits (its /64 prefix), which identify the network it belongs to rather than the device. Every keyed hash of a network address in this policy is made the same way. Hashes made before we adopted this rule used the whole address.
• The record of each acceptance of our terms holds the same keyed hash of the network address the acceptance was recorded from (above, and section 11), and the record that an erasure was requested holds a copy of the keyed hash from the session that asked for it, when the request came through the Service (section 15). Like the session record, it holds the hash, never the address. A keyed hash can be compared only with another one made with the same secret key; if we ever change that key, hashes made with the old key can no longer be matched with new ones.
• Our application logs no longer record the address of the requesting browser. They did until 29 August 2026; the field is now redacted before anything is written. When a sign-in code is refused, or a request to our sign-in page is turned away, the line we log carries the same keyed hash of the address that a session record holds (above), so that we can see repeated attempts from one place — never the address itself.
• Our web server can record the requests and connections it handles — the internet (IP) address a request or connection came from, when it came, the address requested (which can include a one-time code from a sign-in or confirmation link), the request's headers with cookies and sign-in credentials blanked out, and the result — and keeps any such record for at most 30 days (see "Operational logs and error reports" below). That record sits on the same machine as the Service, in Canada, on hardware we own. It is used to keep the Service running and secure, and for nothing else.
• Your IP address is still handled in raw form while each request is being handled, for security and rate limiting. Our rate-limiting cache counts requests per keyed hash of the address — the same kind of hash as above, never the address itself — so that we can detect and slow down an attack, and each count expires within an hour. That is how a web server defends itself, and we would rather tell you it happens than write a sentence that says we never see the address. Counts kept before we began hashing the address were keyed by the address itself. We no longer read them, but they can stay in the cache's saved files until those files are next compacted, and in backups of those files for up to 35 days after that.

OAuth tokens

To keep your QuickBooks Online connection alive we store the tokens Intuit issues. The access token and the refresh token are both encrypted at rest with AES-256-GCM, and neither is ever stored or logged in plain text.

Support correspondence

If you email us or write to us by post, we keep your message and our reply. Our business mailbox is hosted by Web Hosting Canada — see section 12, which also describes the alerts we send ourselves about a company's account; we keep those in our business email there too. Section 15 says how long we keep each.

Operational logs and error reports

We keep structured application logs and error reports so we can run the Service securely and fix problems. Secrets and tokens are redacted before they are written. Our server logs record what was requested and what the result was, and we use them to keep the Service secure and to diagnose faults, and for nothing else. Error monitoring runs on our own hardware, in Canada — see section 13.

How long we keep them:

• Application logs — what each part of the Service records as it runs — are kept in files of a fixed size. Once a part of the Service has filled its share, its oldest entries are deleted as new ones are written, and in any case we clear these logs at least once a month.
• Any record our web server keeps of the requests and connections it handles is kept for at most 30 days.
• Error reports are deleted automatically once they are 14 days old.
• The record our server keeps of the commands we run on it remotely, with what each command displayed — which can include extracts of the logs above or of your data — is kept for at most 90 days.
• A backup copy of any of these lasts at most 35 days (section 15).

Erasing your data (section 15) does not reach these logs, reports and records; what they hold is deleted as described above, unless a legal hold applies (section 15).

9. Cookies — the complete list

There are exactly three cookies. All three are strictly necessary for the Service to function. There are no analytics cookies and no advertising cookies. We do not set, and do not permit anyone else to set, a cookie on the Service for measurement, profiling, retargeting or advertising, with one exception that only you can bring about: a video on our public website that you choose to play (below).

httpOnly means no JavaScript on the page can read the cookie. Secure means it is only ever sent over an encrypted connection. SameSite=Lax means it is not sent along with most requests started by other websites.

The OAuth state cookie and the Terms-acceptance cookie are named with the __Host- prefix, like the session cookie, so your browser accepts them only from this site and no other website can set or replace them.

Stripe's pages are Stripe's. When you add a payment method, start a subscription or open the Stripe Customer Portal, you leave the Service for a page on Stripe's own website. Stripe sets its own cookies there, including to prevent fraud, under its own cookie policy and privacy policy. They are not set by the Service, and the three cookies above are the only ones the Service sets.

A video you choose to play is YouTube's. Where a page of our public website offers a video, the video is hosted by YouTube, and nothing from YouTube loads until you press play (section 12). Once you do, YouTube may store cookies or similar information in your browser, such as entries in its local storage, under its own policies — which may include measuring how its videos are watched and showing advertisements in its player. They are not set by the Service, and if you do not play the video, YouTube sets none of them through our website.

Because all three cookies are strictly necessary to deliver a service you asked for, we do not show a cookie consent banner. There is nothing optional among them to consent to. If you block them, you cannot sign in. Playing a video is optional, and it is your own choice: nothing from YouTube loads until you press play, and the page tells you, next to the play button, that the video comes from YouTube.

We also send an HTTP Strict Transport Security header with a two-year maximum age, which tells your browser never to connect to us over an unencrypted connection.

10. Why we use your information (Identifying Purposes; Limiting Collection)

We collect only what the Service needs, and we use it only for these purposes:

• to authenticate you and keep you signed in, and to tell you when someone signs in to your company's account with an emailed code;
• to establish and maintain your QuickBooks Online connection;
• to read your items, bills of materials, purchase orders and bills so we can calculate costs and shortages;
• to create and modify the build and un-build transactions you ask for inside your QuickBooks Online company, to delete the bills the Service posted for them in the cases described in section 6, and, after an un-build, to re-send unchanged the bills of other builds dated the same day that used one of the same components, to have QuickBooks Online recalculate their cost (section 6);
• to generate the CSV exports you request;
• to take payment, run trials, renewals and cancellations, and calculate applicable taxes, and to make sure each QuickBooks Online company has only one free trial, and that invoices already covered by an introductory discount count against any introductory discount it is offered later;
• to send you the account and service emails listed in section 14;
• to keep the Service secure, find and fix faults, and investigate abuse;
• to answer your support requests;
• to keep evidence of what we agreed with you, and to preserve information when a legal claim or proceeding is started, threatened or expected, or the law requires it (section 15);
• to introduce OberBuilt Inventory, one message at a time, to people at businesses that are not customers — checking by hand, before each message, that the business is not a customer or on a free trial — and to keep their requests not to be contacted (section 7);
• to make sure that data we have deleted stays deleted if we ever restore a backup (section 15); and
• to meet our own legal, tax and record-keeping obligations.

That is the complete list. We do not use your information to build advertising profiles, we do not use it to train any artificial intelligence or machine-learning model, and we do not use it to develop products for anyone other than you.

11. Consent, and how to withdraw it

How we get consent. Before you connect a QuickBooks Online company, and again before you start a new subscription if our terms have changed since you last accepted them, the Service shows you a summary of the key terms — that the Service is for business use only; that it is in beta, writes to your QuickBooks Online company and can change or delete bills it created there; the limits on our liability and the law that governs our agreement; one connected company, tax on top, monthly automatic renewal, cancel yourself at any time — and links our Terms of Service and End User Licence Agreement and this Privacy Policy, each opening in a new tab. It then asks you to tick a box confirming that you agree to the Terms for your business and have read this Privacy Policy. Where that summary is longer than the space it is shown in, you cannot continue until you have scrolled to the end of it. Ticking that box and continuing, after you have read this policy, is your consent to what it describes. We keep a record of each acceptance — which version, when, and a keyed hash of the network address it was recorded from (section 8) — for the period set out in section 15. You then give Intuit its own separate consent, at Intuit's own consent screen, which tells you what access is being granted. For the ordinary operation of the Service, those two consents are what we rely on. If you later start a subscription on Stripe's checkout page — for example after an earlier one has ended — you are also asked there to tick a box agreeing to our Terms of Service and End User Licence Agreement.

How to withdraw it. You can withdraw your consent at any time by disconnecting the Service from your QuickBooks Online company — either inside the Service, or from within QuickBooks Online itself — and by ending your subscription. When you disconnect inside the Service while you are paying, or on a free trial with a payment method on file, we ask what should happen to your subscription: stopping it sets it to end, while keeping it means you go on being charged, and we go on holding your data, until you cancel. When you disconnect from within QuickBooks Online, we stop your subscription from renewing ourselves. You can also cancel at any time in the Stripe Customer Portal. Section 5.5 of our Terms of Service and End User Licence Agreement sets out each case.

What happens if you do. You should know the consequences before you act. Disconnecting stops the Service working: we can no longer read your items or post your builds, and the application will be of no use to you. Disconnecting inside the Service also signs you out, but you can still sign in by email (section 8) to manage your subscription, export your data or erase it, for as long as we hold it — provided we have a working email address for you. If we do not, export anything you want before you disconnect (section 15). Withdrawing consent does not undo transactions the Service has already written into your QuickBooks Online company; those are your records and they stay in your books unless you reverse or delete them yourself. Some information must be kept for a period after you leave — see section 15.

We do not require you to consent to anything beyond what is necessary to provide the Service as a condition of using it.

12. Who else handles your information

Two service providers — and Intuit, which is not one of them. That is the entire list.

Our service providers

One of them processes information we hold for you. The other holds the correspondence we are responsible for in our own right, and delivers the messages we send you. The emails Stripe sends you itself are the exception: Stripe delivers those (section 14). We separate them because the distinction is real, and because the kind of written agreement behind each of them is not the same.

Processing your account and Service data on our behalf

We will not send your information to a provider in this group before a written data processing agreement with that company is in place.

Stripe publishes that agreement itself, and says it takes effect when its ordinary terms of service are accepted rather than on a signature — so what puts it in place is opening the account under those terms, not a separate signing.

Holding our correspondence, and delivering the email we send you

Web Hosting Canada is given no access to the Service or to your QuickBooks Online company. What it receives is the email itself — and some of what our emails say comes from your QuickBooks Online company: its name or Company ID, its email address, its province, state or territory, its time zone, and, in a low-stock alert, the name, SKU, quantity on hand and reorder point of each item that has run low. Its mail server also carries the alerts we send ourselves about a company's account when something needs a person to look at it — for example a payment dispute, a renewal reminder we could not send, or an address outside the places we serve. Such an alert can contain your Company ID; the references Stripe gives your customer record, subscription, invoices, credit notes, any dispute and the Stripe message behind the alert; your company's country and province, state or territory, as recorded in QuickBooks Online or in your billing details at Stripe, or as worked out from its postal code; the status and dates of your subscription and of your connection, when your data is due to be deleted, and what we did about them; a dispute's amount, reason and outcome; which parts of an address are missing; whether an email address is on file for you, with us or at Stripe, and whether the one on file with us is working; and the text of the error that caused it, with notes for our staff. It is named here because those messages, those alerts, your emails to us and our replies pass through or sit on its systems — and we would rather tell you that than leave you to assume our mail runs itself.

Our email host publishes no such agreement, and what governs it instead is still a contract. When we opened the account we accepted Web Hosting Canada's terms of service, which by their own wording take in its privacy policy as well and are governed by Canadian law. Under them it undertakes to keep personal information confidential and to give it out only as that policy allows or the law requires; the policy names the contents of email among the things it holds, binds the companies behind it to the purposes it has authorised, commits to storing information on secure servers, keeps backups of a closed account for at most nine months, and lets us ask for deletion sooner. What it does not carry is the machinery a purpose-built agreement would add — no undertaking to act only on our instructions, no right for us to audit, no promise to tell us within a set time if something goes wrong — and it is written for its own customers rather than for someone holding a third party's correspondence on their behalf. Those terms can also be changed by the other side, thirty days after the new version is published, with no obligation to warn us first. This is the ordinary arrangement for a business our size, and it is one of the reasons for the paragraph below.

About Web Hosting Canada, stated carefully. Web Hosting Canada is a Canadian company with its head office in Montreal, Quebec. It states publicly that files, databases and email are stored on servers located within Canadian borders. We checked that independently rather than taking it on trust: the server that holds our mailbox, and every relay authorised to send mail from our domain, are on Canadian networks in Montreal and Beauharnois, Quebec. What we cannot give you is a guarantee. What we checked is where the machines are, which is not the same as knowing every company whose software runs on them. Web Hosting Canada's own privacy policy says personal information is collected and stored in Canada except as otherwise described in that policy, and that it works with providers around the world such that some personal information may be transferred to other countries for processing. Those words are part of our contract with them, because their terms of service take that policy in — but a promise written with its own exception inside it is not one we can hand on to you as a guarantee. So our position is that the evidence supports the Canadian claim and we have found nothing contradicting it, but it rests on their practice more than on what they have promised us. If where your correspondence sits matters to you, write to the postal address in section 1 instead.

Intuit is different

Intuit holds your accounting and inventory records under your agreement with Intuit, not ours. We read from and write to your QuickBooks Online company under the authorisation you gave at Intuit's consent screen. As explained in section 4, Intuit and OberBuilt are independent controllers: Intuit is not our processor and we are not Intuit's. We are not sending your data to Intuit — it is already theirs to hold for you, and we are working inside it.

Videos from YouTube

Where a page of our public website at obinv.oberbuilt.ca offers a video, the video is hosted by YouTube, a Google service, and nothing from YouTube or Google loads until you choose to play it. To play it we use YouTube's embedded player, one of the YouTube API Services. Until then the page shows a picture and a play button of our own, and the page tells you, next to that button, that playing the video loads it from YouTube. This applies to anyone who visits such a page, whether or not you are a customer.

When you press play, your browser connects to YouTube directly. The video then plays inside our page, in YouTube's privacy-enhanced mode, from www.youtube-nocookie.com. From that moment YouTube receives what any website receives from a browser that connects to it — your network (IP) address, details of your browser and device, and the address of our website — and it can see how you use its player. YouTube may store cookies or similar information in your browser (section 9), and may show its own controls, suggestions of other videos and, under its own policies, advertisements in its player. If JavaScript is turned off, or you open the play button in a new tab or window, it opens the video on YouTube's own website instead, under YouTube's ordinary settings.

We send YouTube nothing about you. We give YouTube and Google no information about you, nothing from your account and nothing from a QuickBooks Online company; the video is the same for everyone who plays it. The application you use once signed in shows no video from YouTube. YouTube gives the owner of a video counts of how it is watched — for example how many times it was played, and from which countries and which websites — and we see only those totals, never who watched it on our page.

YouTube is not one of our service providers. It handles nothing on our behalf. What it receives, it receives from your browser, because you chose to play the video, and it handles that information under its own Terms of Service (https://www.youtube.com/t/terms) and Google's Privacy Policy (https://policies.google.com/privacy), not under this policy. Google may handle it outside Canada, including in the United States. If you would rather YouTube did not receive it, do not play the video; you can ask us about anything it shows at support@oberbuilt.ca.

Everyone else

LinkedIn. If we write to someone on LinkedIn (section 7), the message is held by LinkedIn under the terms each of us accepted as LinkedIn members. LinkedIn does not process anything on our behalf, so it is not one of our service providers.

Beyond these, we will disclose personal information only where we are legally required to — for example in response to a valid court order, subpoena, or lawful demand — or where it is necessary to establish or defend a legal claim, or to protect against fraud or an imminent threat to someone's safety. If we are ever compelled to disclose your information, we will tell you unless we are legally prohibited from doing so.

If OberBuilt is sold or reorganised. If our business, or substantially all of its assets, is sold, merged or reorganised — including through insolvency proceedings — personal information may be shared with and transferred to the prospective or actual buyer or successor as part of that transaction. Canadian privacy law (PIPEDA s. 7.2) permits this on conditions we would follow: the information may be used only to evaluate and complete the transaction, it must be protected by an agreement, and after closing it may be used only for the purposes this policy already describes. The successor takes over the promises in this policy, and you would be told that the transfer happened.

If we ever add another service provider, we will update this policy and give you notice before the new provider starts handling your information, so you have an opportunity to object or to leave. If we ever have to add one urgently to keep the Service secure or running, we will tell you within seven days instead, and this policy will be updated at the same time.

13. Where your information is held, and what crossing a border means

The Service itself is in Canada, on hardware we own

The Service runs on hardware that OberBuilt Inc. owns, located on OberBuilt Inc.'s own property in Winnipeg, Manitoba, Canada. We are not renting space from a cloud provider for it.

• Nothing sits between your browser and us. The encrypted connection from your browser runs all the way to our own server. There is no content delivery network and no third-party intermediary in the middle, so no fourth party can see your traffic unencrypted.
• Backups never leave our premises. Any backup of the Service is encrypted and held on hardware we own, at the same premises as the Service. There is no third-party storage provider and no copy held offsite by anyone else, so a backup cannot put your data anywhere the Service itself is not. Section 15 sets out how long a backup copy can live, and what that means when you ask us to erase your data.
• Error and diagnostic data also stays in Canada, on hardware we own. Our error monitor runs on the same machine in Winnipeg that runs the Service. It is not a third-party service, and the application is configured to refuse to start in production if it is ever pointed at one.

This is a choice we made, not a rule anybody imposed on us. Intuit does not require applications to be hosted in any particular country.

Our email is hosted in Canada by a Canadian company — with the qualification in section 12

Our business mailbox is hosted by Web Hosting Canada, a Canadian company headquartered in Montreal, Quebec. Section 12 sets out what Web Hosting Canada says about where it stores data, what we independently checked, and why we still stop short of calling it a guarantee.

One of our two service providers is in the United States

Stripe processes information in the United States. That means your billing information is handled outside Canada — and so are the emails Stripe sends you itself (section 14): receipts, credit notes, requests to confirm a payment and any notice about an expiring card. The emails we send you ourselves are sent by Web Hosting Canada, from mail servers on Canadian networks, with the qualification set out in section 12.

You should understand what that implies. While personal information is in the United States, it is subject to United States law, and it may be accessible to United States courts, law enforcement agencies and national security authorities under the laws of that country — through legal processes that do not necessarily require your knowledge or consent, and that may offer fewer protections than Canadian law. This is true of any organisation that uses a United States service provider, and it is true of us. We are telling you because the Office of the Privacy Commissioner of Canada expects organisations to make this plain, and because you should be able to weigh it.

We remain accountable for that information, and we will not send it to a provider before contractual terms requiring a comparable level of protection are in place. But contracts do not override a foreign government's lawful authority, and we will not pretend otherwise.

14. The email we send you

Every email we send you as a customer is about your own account or the service you use. We do not send customers — including anyone on a free trial — marketing email, newsletters, promotions or product announcements. The only messages we send to introduce OberBuilt Inventory go to people at businesses that are not customers, one at a time; section 7 describes them. Two messages are exceptions we treat conservatively rather than narrowly: the notice we send before your free trial ends when no payment method is on file, and the notice we send when a trial has ended without a payment method, invite you to continue on a paid plan, so we treat them as commercial electronic messages under Canada's anti-spam law and give them an unsubscribe mechanism. It is described below.

The messages we send are:

• Trial: a notice before your free trial ends, telling you what will happen on that date — and, if a payment method is on file, the price, how often you will be billed and how to cancel; if your trial ends without a payment method on file, a notice that it has ended, with the date your data will be deleted and how to export it or start a subscription — without the invitation to start a subscription if you have unsubscribed, and possibly without it if we first learn that your trial has ended while your company is being disconnected; and, when you add a payment method during your trial, a confirmation that your subscription will begin when the trial ends unless you cancel, with the price, the billing frequency, the date of the first charge and how to cancel, and a notice before that first charge, with its amount and date and a link to cancel online. Section 11.5 of our Terms of Service and End User Licence Agreement says when each of these is sent, and when it is not. Your trial end date is also shown in the Service, on your billing page, from the moment you connect.
• Billing and subscription: that a payment failed, with a link to pay the invoice on Stripe's payment page; that your subscription is set to end, or has ended, with the date your data will be deleted and a note that we will warn you again before then; that your subscription will continue after all, when a set end is undone; once a year, a reminder that your subscription renews automatically until you cancel it, and how to cancel; if your subscription began with an introductory discount, a notice before the first invoice at the full price, with the new amount and its date; before a change to the price of your subscription takes effect, a notice with the current and the new price, the date of the renewal it starts at and how to cancel; before a discount with an end date stops applying to your paid subscription, a notice 25 to 30 days before the first invoice without it, or as soon as we can if there is less time than that, with the price now, the price after, that date and how to cancel (not sent, and not shown in the Service, if we have no working address for you or more than one discount applies); and a written acknowledgment of your subscription terms, with a copy of our Terms of Service and End User Licence Agreement. Sections 11 to 13 of those Terms say when the notices about a failed payment, an introductory discount, a price change, the written acknowledgment and the yearly reminder are sent, and when we show one in the Service instead of, or as well as, emailing it.
• Changes to our terms: before a material change to our Terms of Service and End User Licence Agreement or to this Privacy Policy takes effect, a notice of what is changing, the date each change takes effect for you, links to the new versions and to the ones they replace, and how to decline the change to the Terms by cancelling. Section 27.2 of the Terms and section 23 of this policy say how far ahead we send it, and what happens if we cannot.
• Disconnecting QuickBooks Online: when you disconnect inside the Service, a confirmation of what happens to your subscription — that it is set to end (or that it has ended), that you chose to keep it, or, on a free trial with no payment method on file, when your trial ends; a notice when your company is disconnected without you doing it in the Service — disconnected from Intuit's side, or by us because the company is outside the area where we offer the Service (section 5) — saying what we did to your subscription; and, while your company is disconnected and you have kept your subscription, a reminder before every charge, with the amount and a way to cancel without reconnecting (section 13.2 of our Terms of Service and End User Licence Agreement says when it is sent, and when it is not).
• Signing in by email: when you ask for one on our sign-in page, a sign-in code for each disconnected company that uses that address; and each time someone signs in with a code, a notice of that sign-in, sent to that address and, if it is different, to the company email address described in section 6 (section 8).
• Data: a reminder about 30 days before your data is deleted after the retention period, and a warning before your data is deleted, about a week ahead; confirmation that an erasure you requested has been carried out — or, where a legal hold applies (section 15), that we have stopped your subscription and ended our access, and are keeping your data until the hold ends.
• Operational alerts: low-stock alerts; notices that your QuickBooks Online connection is about to expire or needs re-authorising.
• Address checks: a short test message when you tell us that an address our mail had been bouncing from is working again.
• Address changes: when you ask us to send your account emails to a different address, a message with a confirmation link to that new address — nothing else goes to it unless that link is used — and a notice to the address being replaced, naming the new one. If you clear the address instead, that last address gets a notice saying so.

With two exceptions, these are not marketing messages and there is no marketing unsubscribe link on them, because they are how we tell you about your own account, your own money and your own data. The exceptions are the two trial notices: the one before your trial ends when no payment method is on file, and the one when it has ended without a payment method. Because they invite you to start paying, we treat them as commercial electronic messages and each carries an unsubscribe mechanism (a plain version without that invitation does not need one). It is not a one-click link. We have not built one, and we would rather tell you what exists than describe something better that does not: email support@oberbuilt.ca with "unsubscribe" in the subject line, and we act on every such request within ten business days. We keep a record of each request — the email address it applies to, the messages it covers, the date you asked, the date we recorded it, the date the record expires and, until the rest of your data is deleted, which company it came from, if any — for 3 years from the date we recorded it, even if the rest of your data is deleted in the meantime, and we check it before sending either trial notice, so the request still holds if you come back within that time (section 15). One request stops the notice before your trial ends when no payment method is on file, and any other commercial message we might send. It does not stop the notices about your first charge or the end of an introductory discount: they state facts about a subscription you already have, and carry no unsubscribe mechanism. The notice on the day a trial ends without a payment method still goes out, but as a plain statement of the date your data will be deleted and how to export it, with no invitation to start paying. It does not stop the account and service emails listed above, and your trial end date is shown in the Service either way. You can switch them off: clear the notification email address in the Service's settings and we will stop sending, immediately. Please think before you do. If we have no address for you we cannot warn you before your data is deleted at the end of the retention period (section 15), we cannot tell you a payment has failed, and we cannot tell you your QuickBooks Online connection is about to expire, and Stripe cannot ask you to confirm a payment your bank wants confirmed, so unless you confirm it yourself on Stripe's page, which the Service links to while an overdue payment waits for your bank, that payment is not made, and your subscription can end for non-payment (section 12.5 of our Terms of Service and End User Licence Agreement). If your company is disconnected, we also cannot send you a sign-in code or remind you before a charge — which is why keeping your subscription while disconnected needs a working address. Those things will still happen; you just will not hear about them from us.

If a message we send you comes back as undeliverable, we stop. When mail to your address fails outright, or keeps being turned away for several days, we stop sending to that address and show a notice in the Service, on every page. It stays until the address is working again or has changed: you can tell us in the Service that it works again, give us a new address in the Service's settings, which takes over once someone there uses the confirmation link we send it, or clear the address altogether, which stops our account emails entirely (see above); and if your account still uses the email address from your QuickBooks Online company profile, correcting it there and reconnecting moves us to the corrected address (section 8). While that notice is showing, the messages listed above are not sent — with two exceptions: the final warning before your data is deleted (section 15) and the yearly renewal reminder are still attempted. That warning is also shown in the Service, with the date, because the attempt may well not arrive. A message we did not send, or that came back undeliverable, is not delivered later, except that, once your address is working again or has changed, we may still send a notice about a date that is still ahead — such as the reminder before your data is deleted, or before a charge — if it still applies. A temporary problem, such as a mailbox that is full for an afternoon, does not stop your mail: billing and account messages still go out, and only low-stock alerts may be held back while it lasts, which we say in the Service. When you tell us the address works again we send it a short test message; if that message bounces too, the notice comes back, and you may have to wait before you can tell us again.

Our billing emails deliberately contain no marketing and no upsell — just the facts, an invitation to reply if you need help, and links to where you can act on what the email is about. The email on the day your subscription or trial ends, and the reminder and the warning before your data is deleted, never invite you to start paying and carry no link to do so: once you have signed in, their links open a page where you can see your invoices and export or erase your data, with nothing on it to buy. The one exception is the notice on the day a trial ends without a payment method (above), which does invite you to start a subscription, and which goes out without that invitation if you have asked us to stop our commercial messages. If your subscription ended for non-payment, or ended at once because a payment was overdue when it was stopped (section 12.6 of our Terms of Service and End User Licence Agreement), the email saying so also tells you how to pay anything you still owe. An email saying that your subscription or trial is set to end, before it has ended, can tell you how to undo that and link to where you do it. Apart from that, the notice before your trial ends, when no payment method is on file, is the only other email of ours that invites you to start paying.

Some billing email comes from Stripe, not from us: a receipt for each successful payment, a receipt for each refund, the credit note for each refund, and a request to confirm a payment with your bank when your bank asks for that, with reminders until it is confirmed or the request lapses. We have switched those on in Stripe's settings. Stripe may also email you before a card on file expires. Stripe's own trial-ending and failed-payment emails, renewal reminders and reminders about unpaid invoices are switched off; we send our own, listed above. Stripe does not email you the invoices themselves, because your subscription is charged automatically to the payment method on file. A payment receipt is sent only when a payment succeeds, and none is sent for an invoice on which nothing was charged. A credit note records the amount credited or refunded against an invoice, and may carry a short note from us about it. A request to confirm a payment links to a page at Stripe where you complete the check your bank asks for. Stripe does not email the credit note that reduces an unpaid invoice when your subscription ends for non-payment, or ends at once because a payment was overdue when it was stopped; our own email tells you the amount still owed instead (sections 12.4 and 12.6 of our Terms of Service and End User Licence Agreement). Stripe sends all of these itself, from its own stripe.com address, and handles them in the United States (section 13); if you reply to one, the reply comes to support@oberbuilt.ca. They go to the email address on your customer record at Stripe, which we keep the same as the address in the Service's settings. When a change to that address takes effect with us, including clearing it, we pass it on to Stripe; it cannot be changed in the Stripe Customer Portal. If that record has no email address, Stripe sends none of them. What we do when our own mail comes back undeliverable (above) does not apply to them. While you still have an account with us, every invoice can also be viewed and downloaded in the Stripe Customer Portal, whether or not an email reached you. Once your account is gone, because you erased your data or the retention period ended, ask us at support@oberbuilt.ca and we will send you copies.

If we ever introduce marketing email to customers, we will do it properly: a separate, unbundled opt-in that you have to actively choose, sender identification and our mailing address in every message, and a working unsubscribe link in every message that we act on promptly. That mechanism does not exist today. We are describing an intention, not a feature — and we would rather say that than describe a consent system we have not built. The individual messages described in section 7 are not this: they go only to people at businesses that are not customers.

15. How long we keep things, and how to have them deleted

These are the actual numbers. They are the same numbers, to the day, as the ones in our Terms of Service and End User Licence Agreement.

While you are a customer

We keep your data for as long as your subscription or your 14-day free trial continues — including while your QuickBooks Online company is disconnected, if you chose to keep your subscription. Nothing is purged while it continues.

When you disconnect

When you disconnect the Service from your QuickBooks Online company, or revoke our authorisation from within QuickBooks Online, we immediately stop accessing your QuickBooks Online company and immediately stop syncing, using or acting on its data. This is not "we will get to it" — access ceases at once, and this obligation also flows down to us from Intuit's Developer Terms of Service. The copy already in our systems is not used for anything after that: it is held, dormant, under the retention rules below, so that you can still export it and so that a disconnection by mistake is recoverable.

We also ask Intuit to revoke our authorisation. Our stored copy of your authorisation credentials stays in our database, encrypted and unused, until your data is purged — when you ask us to erase it, at the end of the retention period, or in the case below in which we may erase it at once without being asked.

What happens to your subscription depends on how you disconnect; section 5.5 of our Terms of Service and End User Licence Agreement sets it out. If you choose to keep your subscription, the dormant copy is kept for as long as the subscription continues, with no deletion date; otherwise the retention period below starts when your subscription or trial ends. Disconnecting inside the Service also ends every session for your company.

The same is true when we refuse a reconnection. If a company we already hold credentials for reconnects, or someone signs in with QuickBooks Online for it, and the territory check in section 5 refuses it, and we can confirm that the company reconnecting is the one we already hold, we ask Intuit to revoke our authorisation, we mark the connection disconnected, and we sign out every session for that company. We then stop your subscription from renewing, as we do when a company is disconnected from Intuit's side, and email you to say so; section 16.7 of our Terms of Service and End User Licence Agreement says when you can keep it after all. You can still sign in by email (section 8) to see your billing, export your data or erase it, for as long as we hold it. If we cannot confirm that, we only refuse the new connection and ask Intuit to revoke the authorisation it just gave us: we do not disconnect the company, sign anyone out or change your subscription, because we cannot yet tell whether the refused company is the one we hold. If that also ends our access to your company, we treat it as a disconnection from Intuit's side, described above, when we next try to use it. When we disconnect the company this way, the credentials we already held stay in our database, encrypted, revoked and unusable, and are deleted on the normal retention schedule set out in this section — not at that moment. A company connecting for the first time is not affected at all: the refusal happens before any credentials are stored, so there is nothing to hold and nothing to delete.

After your subscription ends

We keep the data already in our systems for 90 days after your subscription or free trial ends, and then purge it. The 90 days run from the day it actually ends, not from the day you cancel or disconnect, which only sets that day. A company that connects again after its free trial has been used (see "What we keep longer" below) and does not start a subscription is treated as if its trial had ended on the day it connected: the 90 days run from that day, and the first of the emails below goes out that day. We do this so that a business that cancels by mistake, or that comes back after a short break, can pick up where it left off. We email you the purge date on the day your subscription or trial ends, a reminder about 30 days before that date, and a final warning about a week before it, so the deletion never arrives as a surprise — provided we still have an email address for you (section 14). Section 16.2 of our Terms of Service and End User Licence Agreement sets out when each of these is sent and when it is not: for example, if we only learn later that your subscription or trial has ended, the first of these goes out on the day we learn it, and the first two are not sent while that address is rejecting our mail. We send the final warning even when that address has been rejecting our mail. It gets one attempt, and it may not arrive, so the same warning, with the date, is shown in the Service — including to a company that has disconnected, once it signs in by email (section 8), which it can do only while our messages to its address are getting through. Where we have an email address for you, we do not purge before the final warning has been sent: if it has not gone out in time, we move the purge date later, and the purge follows about a week after the warning. If we only learn late that your subscription has ended, the purge date is set no earlier than about a week from the day we learn it, whether or not we have an email address for you. Before purging we also check with Stripe, and we do not purge while Stripe still shows a subscription for you that could be charged.

If, contrary to section 5, a company in the European Economic Area has connected to the Service, we apply a 30-day window instead of 90 days. The rules above can move that date later by about a week, so that the final warning reaches you first; you can have the data erased at once at any time (below).

A company connected under another company's identifier. If someone connects the Service in a way that records one QuickBooks Online company under the identifier of a different company that is not theirs, and the owner of that other company shows us, from inside QuickBooks Online, that it is theirs, we may erase the account that connection opened, and everything recorded under it, at once, without waiting for the 90 days or the emails above. We first end any subscription or trial on that account. The erasure then keeps, and does not reach, the same things as an erasure you ask for (below), except the record that the company has had its free trial, which it does not keep for that identifier; but we send no confirmation email, and we do not erase this way while a legal hold applies (below). We need not tell you before we do this, and any date we have emailed you for deleting that account's data no longer applies. Section 16.10 of our Terms of Service and End User Licence Agreement sets this out.

CSV export of your items, bills of materials and builds keeps working after your trial ends, after you cancel and after you disconnect — for as long as we still hold the data, as described above. You do not need an active subscription to get your data out. Disconnecting the Service from your QuickBooks Online company signs you out, but you can sign in by email (section 8) and export without reconnecting, or reconnect. If we have no working email address for you, reconnecting is the only way back in, so export before you disconnect.

If you want it gone sooner

You can erase your data yourself, at any time, from inside the Service. You do not have to wait for your trial or subscription to end, and you do not have to ask us. The control sits under the pricing summary on both the settings page and the billing page, and on the screen shown instead of the Service when your access is blocked, for example after your trial or subscription has ended — and, if your company is disconnected, on the page you reach by signing in by email (section 8) — and it asks you to type DELETE to confirm, because what follows cannot be undone. If you would rather we did it for you, email support@oberbuilt.ca and we will. Either way:

1. We write a durable audit record of the request before anything is destroyed, so that a crash part-way through cannot destroy the record of who asked for what and when.
2. We tell Stripe to stop your subscription, so you are not charged again. Your subscription runs to the end of your existing billing period; if a payment is overdue, it ends at once rather than at the end of the period. Because you asked us to erase your data, we then stop asking for any amount still unpaid from that subscription (section 12.6 of our Terms of Service and End User Licence Agreement).
3. We erase your data from our own systems, apart from the records listed under "What we keep longer" below — unless a legal hold applies (below), in which case we keep it until the hold ends. What can remain for a short time, in our job queues, in short-lived copies and in backups, is set out under "The honest part about backups" below.
4. Your customer record at Stripe is deleted — the invoices are not, and cannot be. Two different things live at Stripe, and we would rather separate them than let one word cover both. The customer record holds your email address, billing name and address, any tax registration number and your saved payment method; it is deleted automatically at the end of the retention period described above — or, if you erase while your subscription or trial is still running and not yet set to end, 90 days after you erase (30 days for a company in the European Economic Area). The invoices and payments already issued are separate records, and they stay. Stripe is a payment processor and is required to keep transaction records to meet its own tax, accounting and anti-money-laundering obligations; each invoice keeps the billing details it carried when it was issued (name, email address and address, and any telephone number or tax registration number), and Stripe provides no mechanism to erase an issued invoice. That is Stripe's legal duty, not our choice, and we cannot override it — nor can we tell you how long Stripe keeps them, because Stripe does not publish a figure for it. Canadian tax law separately requires us to keep our own copies of those invoices for six years after the end of the tax year they relate to. If you erase your data yourself before the retention period is up, we write the instruction to delete the customer record at the moment you erase, and that instruction is built to outlive the erasure of everything else so that the deletion still happens on the original date. The instruction holds the Stripe reference and that date and nothing else — not your name, not your address, not your invoices. Ask us at any point and we will confirm when the customer record is gone.
5. We send you a confirmation email, provided we still have an email address for you and our messages to it are getting through (section 14).

Erasure from our systems does not reach the emails you have sent to our support address and our replies to them, which sit in our business mailbox, or the alerts we send ourselves about your company's account (below). Nor does it reach our operational logs, error reports and records of the commands we run on our server, which are deleted on their own schedules (section 8), unless a legal hold applies (below). One further thing described in section 8 is outside it: the delivery-failure reports that came back to our bounce mailbox, which are deleted on their own 90-day schedule rather than at the moment you erase. Tell us if you want those deleted too, and we will delete them. Everything else in section 8's record of the emails we sent you is deleted with the rest of your data, except where another account is still using the same email address, or is waiting for a confirmation we sent to it, at erasure and at the end of the retention period alike. After that point we write only two such records: the record of the confirmation email in step 5, which we delete as soon as our mail server has accepted the message for delivery; and the record of an account email we were already sending at the moment you erased — that email may still reach you — which we delete as soon as the attempt to send it is over. If either message is refused, or comes back undeliverable afterwards, any failure report about it cannot be matched to a message, and it is deleted on the 90-day schedule in section 8, together with any note it puts against the address. The send records go outright, and so do the failure reports we were able to match to one of those messages. Three things are filed under the email address itself rather than under you — a failure report we could not match to any particular message, the note about that address, and the count of messages we held back — and we keep those if another account is still using that address, or is waiting for a confirmation we sent to it, because deleting them would start our mail flowing again to a mailbox we already know is dead. Where we do keep them, the unmatched report still goes within 90 days. The note and the count stay for as long as that other account is using the address — and the count is never kept more than 90 days past the last message it counted, which is what section 8 says about both.

The honest part about backups

We want to be precise rather than reassuring here, because an over-promise would be a false statement — and so would leaving something out.

• Your data is erased from our live production systems immediately when you ask, at the end of the retention period, or in the case above in which we may erase it at once without being asked, unless a legal hold applies (below). That is the copy the Service reads and writes, and it goes first. A few copies outside it go a little later: background work for your company is removed from our job queues within about an hour, or, for a job that was running at that moment, within about an hour after it ends, apart from a finished job that holds nothing but your company's identifier, which can stay until a later one of the same kind has finished; a notice of a change that QuickBooks Online sent us about your company, which carries your company's identifier and those of the changed records but not their contents, is removed about a day after we processed it; and the short-lived copies of your items' names, stock levels and costs and of your latest shortage results that we keep to make the Service faster expire within about two days. Messages Stripe sent us about your billing, and our emails that were already on their way or that failed, are removed on the schedules in section 8 and under "What we keep longer" below. A removed copy can stay in our job queue's saved files on the machine that runs the Service until they are next compacted (section 8). The operational logs, error reports and records of commands described in section 8 follow their own schedules, and so do the support correspondence and the alerts we send ourselves, described below.
• Any backup copy is ours, it is encrypted, and it is short-lived. Backups exist for one purpose — our own ability to recover from a failure and keep running. They are held on hardware we own, at the same premises as the Service, with no third-party storage provider and no offsite copy held by anyone else. Backups are kept for at most 35 days before they age out and are overwritten.
• So a copy of erased data can linger in a backup for up to 35 days after it is erased from our live systems — and never longer. We would rather tell you that than tell you your data becomes instantly and permanently unrecoverable everywhere the moment you press a button, because inside that window it would not be true.
• Erased data is never restored to live systems. If we ever have to restore from a backup for an unrelated reason, then before the restored copy goes live we erase from it again every company whose data was erased after that backup was taken, whether you asked us to or the retention period ended. A restore never drops a legal hold (below), or an erasure that a hold is still deferring, and never brings back a hold we have since lifted.

That 35 days is a ceiling, not a claim that a backup holding your data exists at any given moment. What we commit to is the limit — no backup copy of your data outlives 35 days, and none of it leaves our premises. Whether a backup taken on a particular day still holds a particular record is not something we are going to overstate, in either direction.

What we keep longer

• Invoices and credit notes — our own copies, as Stripe issued them, including the billing name, email address, address and any telephone number or tax registration number each one carries — are kept on our own hardware for six years after the end of the tax year they relate to (longer while a tax objection or appeal about that year is open), as Canadian tax law requires, and are then deleted.
• The record that an erasure was requested — the date you asked, the date it was carried out, whether a legal hold applied when we began to act on your request, and technical details identifying the request — is kept for as long as we operate the Service, so that we can always prove we acted on it, and so that we can apply it again if we ever restore a backup (above). It does not contain your business data.
• The record that your data was deleted at the end of the retention period — a unique identifier for the record, the identifier of your QuickBooks Online company, and the date and time of the deletion — is kept for 40 days after that deletion. A daily check deletes it once it is older than that, so it lasts at most 41 days, and a copy can remain in a backup for up to 35 days after it is deleted. We use it for one thing only: to erase your data again from a backup if we ever restore one (above). Only that restore reads it, and it copies the record into the restored copy unchanged.
• The record of each time you accepted our Terms of Service and End User Licence Agreement (section 8) — the version, when you accepted it, how you accepted, the identifier of your QuickBooks Online company and a keyed hash of the network address the acceptance was recorded from — is kept for 7 years from when it was recorded, even if the rest of your data is deleted in the meantime, including by an erasure you asked for, because it is our evidence of what we agreed. While you still have an account with us, we keep the most recent one even if it is older than that. Each record is then deleted. It does not contain your business data.
• Records of discounts, special prices, credits and refunds we give by hand (section 8) — the identifier of your QuickBooks Online company, what was given and the amount, our payment provider's references, who gave it and why, when, and, for a discount, special price or credit, when it was withdrawn or ended — are kept until 7 years after each one ends, even if the rest of your data is deleted in the meantime, including by an erasure you asked for, because they are part of our own financial records. They are then deleted. A discount or special price ends when we withdraw it, when its term runs out, or when your account with us is deleted; a credit ends when it is given; a refund, when it is made.
• The record that a company has had its free trial — the identifier of its QuickBooks Online company, the date its trial started, the date we recorded it, the date its data was deleted, the date the record expires, and how many of its invoices an introductory discount applied to — is kept for 3 years after the rest of that company's data is deleted, including when the deletion was an erasure you asked for, so that the same company cannot start a second free trial, and so that the invoices its introductory discount has already covered still count against any introductory discount we offer when it comes back. It is then deleted. It does not contain your business data.
• The record of a request to stop our commercial messages (section 14) — the email address it applies to, the messages it covers, the date you asked, the date we recorded it and the date the record expires — is kept for 3 years from the date we recorded it, even if the rest of your data is deleted before then, so that the request goes on being honoured if the same address comes back to us. It is then deleted. While we still hold your data, it also notes which company the request came from, if any; that note is removed when your data is deleted, at the end of the retention period or on erasure.
• The instruction to delete your Stripe customer record, where you erased your data before the retention period had run out, is kept until that deletion has happened — at most the remainder of the same period (or, under a legal hold, until the hold ends) — and is deleted with it. It holds the Stripe reference and the due date, and nothing else.
• Records of any breach of our security safeguards are kept for 24 months, as PIPEDA requires — see section 21.
• Support correspondence is kept for as long as we need it to deal with the matter you wrote about and anything that follows from it, and is then deleted — and in any case within a month after three years have passed since the last message in that conversation, unless a legal hold applies (below). If you want a particular exchange deleted sooner, ask us. Deleting a message removes it from our mailbox; copies in our email host's own backups of the mailbox are removed on that host's schedule, not ours.
• The alerts we send ourselves about a company's account (section 12) are kept in our business email so that we can deal with what each one is about and anything that follows from it, such as a payment dispute, and are deleted within a month after three years have passed since each was sent, unless a legal hold applies (below). As with support correspondence, copies in our email host's own backups of the mailbox are removed on that host's schedule, not ours. An alert that the mail server we send through refuses, or that we stop retrying, stays in our job queue for about seven days after we give up on it, with the saved-file and backup copies section 8 describes. Our record that each alert was sent — your Company ID, which alert, when, and what the receiving mail server answered — is deleted 90 days after it was written, or sooner, with the rest of your data, if that is deleted while the record exists.

If there is a legal claim

The deletion of your data described in this section — at the end of the retention period, or when you ask us to erase it — gives way in one case. If a legal claim or proceeding involving your account has been started or threatened, or we reasonably expect one — including one between you and us — or the law, a court or a regulator requires us to preserve information, we may put that deletion on hold — and with it the deletion of your customer record at Stripe described above, whose instruction we then keep until the hold ends — even if you have asked us to erase your data or the retention period has ended, and we may keep the parts of the logs, error reports and records described in section 8 that relate to it for longer than the periods given there. We keep what is held only until the claim or proceeding is over, including any appeal, or the requirement ends; we use it only for that claim, proceeding or requirement; and we then delete it on the timetable above — or, if that date has passed and you did not ask us to erase your data, after the final warning described above. Where you did not ask us to erase your data and the hold ends too late for the reminder about 30 days before the deletion date, we do not send that reminder, but the final warning still goes out. While a hold applies, any date we have given you for deleting your data no longer applies; we delete it only once the hold ends. While a hold applies, the data stays in our live systems and so in our backups, and the 35-day limit on a backup copy runs from when it is finally deleted.

If you ask us to erase your data while a hold applies, we still do everything else an erasure does: we stop your subscription so that you are not charged again, stop asking for any amount still unpaid from it, end our access to your QuickBooks Online company and sign everyone out. Our confirmation tells you that we are keeping your data because of a legal requirement. We may not be able to tell you more about it than that. Despite what this section says about export, from then on you cannot sign in, export your data or use the Service with that company while the hold lasts; you can still ask us for the personal information we hold about you (section 18).

16. How we protect your information (Safeguards)

Our safeguards are appropriate to the sensitivity of the information, which is business financial data.

Technical

• All traffic to the Service is encrypted in transit with TLS, terminated on our own server.
• HTTP Strict Transport Security is enforced with a two-year maximum age.
• The access and refresh tokens Intuit issues are both encrypted at rest with AES-256-GCM. Neither is ever stored or logged in plain text.
• Tenant isolation is enforced in the database layer, not by convention. Every table that holds your QuickBooks Online data or your account data carries the identifier of the QuickBooks Online company it belongs to, and a database middleware layer adds that filter to every query the application makes. The Service is built so that a request made in one customer's session does not return another customer's data. Four kinds of exception exist and we would rather name them: our own scheduled jobs for synchronisation, billing, notices and maintenance — for example the ones that decide which customers are due for a sync, scan for low stock, reconcile payments and subscriptions with Stripe, find the customers due one of the notices in section 14, and, most consequentially, run the daily retention sweep that sends the deletion reminder and warning and then permanently deletes the accounts that have reached the end of the retention period in section 15 — run across all customers by design, because that is what they are for; the sign-in page, which looks across all customers for the companies that use the address typed into it, and only ever emails the answer to that address; the checks we make against an email address rather than a company — before a commercial message goes out, against the record of requests to stop them, and, when your data is erased or deleted, whether another account still uses, or is waiting to confirm, the same address (section 15); and our two administrators can run maintenance tools directly against the database, which is what the "Organisational" heading below is about.
• Session cookies are httpOnly and Secure. In our session records your IP address is stored only as a keyed hash, never in raw form. Our rate-limiting cache counts requests by a keyed hash of the address, not the address itself, because that is how a web server detects an attack; it is not used for anything else. Section 8 sets this out in full.
• Inbound webhooks from Intuit are verified with an HMAC-SHA256 signature, de-duplicated by event identifier, and processed asynchronously.
• Redaction rules strip secrets, tokens and credentials from logs before they are written.

Organisational

• Exactly two people hold administrative credentials to our systems: our developer and our Chief Executive Officer. Nobody else can log in. The hardware sits on our own property, where other people can enter the building — we would rather tell you that than imply a data centre.
• We look at diagnostic and error data proactively — error reports and bug reports — so that we can find and fix problems without waiting for you to report them.
• We look at the contents of your QuickBooks Online data only when you ask us for help, and then only as far as the problem you reported requires. We are being straightforward about the mechanism: we do not have a purpose-built support-impersonation feature. When help is needed, one of those two administrators looks directly at the relevant data, and no further.

No system is perfectly secure, and we are not going to claim ours is.

17. Keeping information accurate

Most of the information the Service works with lives in your own QuickBooks Online company, and you control it there. If it is wrong at source, correct it in QuickBooks Online and the Service will pick up the correction.

For the information we hold ourselves — your subscription record, your billing details, your contact address — you can correct your email address in the Service's settings and your billing name, address and tax registration number in the Stripe Customer Portal, or ask us to correct any of it. We will keep it accurate, complete and up to date to the extent necessary for the purposes in section 10.

18. Your rights, and how to use them (Individual Access)

Under PIPEDA you have the right to:

• ask what personal information we hold about you, how we have used it, and to whom we have disclosed it;
• ask us to correct it if it is wrong or incomplete;
• ask us to delete it — see section 15;
• withdraw your consent — see section 11; and
• complain — see section 19.

How to make a request. Email support@oberbuilt.ca, or write to the postal address in section 1, marked "Attention: Privacy Officer". Tell us what you are asking for. We may need to confirm your identity before we act, so that we do not hand your information to somebody else.

How long we take. We will respond within 30 days of receiving your request. If we need more time, we will tell you before the 30 days are up, explain why, and tell you when to expect an answer. Access to your own information is free; if a request would require significant work, we will tell you the cost before we do it and give you the chance to withdraw the request.

If we say no. In a small number of cases the law lets or requires us to refuse — for example where giving you information would reveal personal information about somebody else, or where it is subject to legal privilege. If we refuse, we will tell you in writing, tell you why, and tell you how to challenge that decision.

19. Complaints (Challenging Compliance)

Start with us. Write to our Privacy Officer at support@oberbuilt.ca or at 612 – 3336 Portage Avenue, Winnipeg, Manitoba R3K 2H9. We will acknowledge your complaint, investigate it, and give you a written answer. If your complaint is justified, we will fix the problem — including, where appropriate, changing our practices or this policy.

If we do not resolve it, go to the regulator. You have the right to complain to the Office of the Privacy Commissioner of Canada, which is independent of us:

Office of the Privacy Commissioner of Canada 30 Victoria Street, Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 www.priv.gc.ca

You do not need our permission to do this, and you can go to the Commissioner whether or not you have complained to us first.

If you are in Alberta or British Columbia, you may also be able to raise your concern with your provincial Information and Privacy Commissioner.

20. What we do not do

We think this list is as important as the rest of the policy, so it gets its own section. We do not:

• use any third-party analytics. No Google Analytics, no tag manager, no product-analytics tool, no session recorder, no heatmap tool. None. The web application loads its own code and nothing else, and so do the public pages of its website, except for a video from YouTube that you choose to play (section 12).
• use advertising or tracking technology in the Service or on its website at obinv.oberbuilt.ca: no advertising pixels, tags or scripts, no list of customers — or of anyone else — uploaded to an advertising platform, and no audience built from the people who visit that website. The one thing on that website we do not control is a video you choose to play: YouTube's player may use cookies and show advertisements under YouTube's own policies (sections 9 and 12), and none of it loads unless you press play. We may pay for advertisements of OberBuilt Inventory on other websites and platforms; those platforms show them under their own policies, and we give them none of your information.
• use a third-party error-monitoring service. Our error monitor is self-hosted on the same hardware we own in Winnipeg that runs the Service, and the application is configured to refuse to start in production if it is ever pointed at an external monitoring service.
• use a content delivery network, or put any third-party intermediary in front of the Service.
• process your data with artificial intelligence or a large language model, for any purpose, including training. We do not do it today and we have no plans to.
• sell personal information, or make it available to any third party for a purpose that is not directly about delivering the Service to you.
• share one customer's data with another customer, in any form.
• store your QuickBooks Online sign-in credentials, or your full payment card number.

If any of this changes, this policy changes first, and we will tell you.

21. If there is a security breach

If a breach of our security safeguards occurs, we will:

• assess it — what happened, what information was involved, how many people are affected, and how likely it is that the information will be misused;
• report it to the Office of the Privacy Commissioner of Canada, and to any provincial privacy commissioner where the law requires it, as soon as feasible where it is reasonable to believe the breach creates a real risk of significant harm to an individual. Significant harm includes financial loss, identity theft, damage to reputation or relationships, damage to or loss of property, and effects on a credit record;
• notify you directly and conspicuously, as soon as feasible, where that same threshold is met, telling you what happened, what information was involved, what we are doing about it, and what you can do to reduce your risk;
• tell you promptly when a breach involves information we hold for you — the data from your QuickBooks Online company and the records you create in the Service, including any personal information about your vendors, customers or staff in them — so that you can meet your own obligations to the people it concerns, including any notice the law where you are located requires of you;
• notify other organisations — including Intuit — where doing so may reduce the risk of harm, and where we are required to; and
• keep a record of every breach, whether or not it is reportable, for 24 months, and provide those records to the Commissioner on request.

22. Children

The Service is a business tool sold to businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under the age of eighteen. If you believe a child has provided us with personal information, write to support@oberbuilt.ca and we will delete it.

23. Changes to this policy

We may update this policy — for example if we add a service provider, change where data is held, or add a feature that handles personal information differently.

When we do, we will change the "last updated" date at the top, and we will keep the change legible rather than silently editing. If the change is material — a new service provider, a new category of information, a new purpose, a change in where data is held, or a shortening of your rights — we will notify you by email at least 30 days before it takes effect, so you have the chance to object, to ask a question, or to leave. Our email links to the new version and to the version it replaces. A material change takes effect on the date given in that email, which is the same for every customer. If we do not email you — for example because we have no working email address for you, because you are on a free trial with no payment method on file, or because you had no subscription with us when we sent the emails — the change still takes effect on that date; the new version, with that date at the top, is published here from the day we send the emails.

Some changes cannot wait 30 days: a change the law, a court or a regulator requires, or one we must make to protect your information from an actual or reasonably suspected threat to its security — for example, to close a security weakness, or to tighten a security setting such as how long a sign-in lasts. Those take effect when we publish them, and go no further than their reason requires. If we have a working email address for you, we will still email you, as soon as we reasonably can and no later than 5 business days after we publish the change, saying what changed and why it could not wait. This never lets us use your information for a new purpose, collect a new category of it, or change where it is held without the 30 days' notice above, unless the law requires it; adding a service provider urgently is covered by section 12. If such a change also changes our Terms of Service and End User Licence Agreement to your disadvantage, section 27.5 of that agreement says how you can end your subscription because of it and get back what you paid for the rest of your current billing period.

Every version of this policy carries an effective date. We will not publish an undated policy. We keep a copy of every version we have published, and we will send you a copy of any of them if you ask us at support@oberbuilt.ca.

24. How to reach us

OberBuilt Inc. 612 – 3336 Portage Avenue Winnipeg, Manitoba R3K 2H9 Canada

Telephone: 431-478-1966 Email: support@oberbuilt.ca Privacy Officer: Our Chief Executive Officer — support@oberbuilt.ca

Our Terms of Service and End User Licence Agreement are published at https://obinv.oberbuilt.ca/legal/terms. This Privacy Policy is published at https://obinv.oberbuilt.ca/legal/privacy. Both are public — you never need an account or a password to read them.

OberBuilt Inc. is not affiliated with, endorsed by, sponsored by, or approved by Intuit Inc. Intuit and QuickBooks are registered trademarks of Intuit Inc.