Effective date: June 16, 2026
Note: This policy describes the data practices of an internal QuickBooks Online automation tool operated by Maximum Potential. It is separate from and does not replace Maximum Potential’s clinical privacy policy, which governs the personal health information of clients of our autism and behaviour services.
1. Scope
This policy describes how the QuickBooks Automation Application (“the Application”), developed and operated by Maximum Potential (“we”, “us”), accesses and processes data from QuickBooks Online (“QBO”). The Application is a private, internal-use integration. It is not offered to third parties, not listed in any application marketplace, and not used to provide services to end users other than authorized employees and contractors of Maximum Potential.
2. What data we access
The Application connects to a single QBO company file under the authority of Maximum Potential’s QBO administrator. With administrator consent, it may read and (where the operator has enabled write operations) modify the following categories of data:
- Company profile and configuration (name, fiscal year, accounts of record)
- Customers, vendors, employees, and contacts
- Invoices, bills, payments, sales receipts, credit memos, refunds, and journal entries
- Chart of accounts, classes, departments, items, and tax codes
- Reports and analytics derived from the above (P&L, balance sheet, aged receivables/payables, etc.)
The Application does not access data from any QBO company other than the one explicitly authorized by the administrator.
3. How data is used
QBO data is used solely to perform automation, analysis, and reporting tasks initiated by authorized internal users. Specific uses include reconciling external systems (e.g. payroll exports from Wagepoint) against QBO records, generating internal financial reports, and assisting authorized users with bookkeeping operations they would otherwise perform manually inside QBO.
4. AI processing and Anthropic
The Application is operated alongside Anthropic’s Claude AI assistant. When an authorized user issues a request to Claude that requires QBO data, the relevant data returned by the QBO API is passed to Anthropic’s services to generate the assistant’s response. Anthropic processes this data subject to its own commercial terms and privacy commitments, including its retention and training practices for paid API and consumer traffic. We do not transmit QBO data to any other AI provider.
5. Storage and retention
OAuth refresh tokens and minimal configuration values are stored locally on the operator’s authorized workstation, with file permissions restricted to the workstation owner. Tokens may also be synchronized to Maximum Potential’s Microsoft 365 OneDrive tenant under organizational control. QBO data itself is not warehoused by the Application; it is fetched on demand for each request and not retained beyond the lifetime of that request, except where the user explicitly saves output (e.g. to a spreadsheet or report file). Refresh tokens are rotated automatically by Intuit and replaced in storage as part of normal operation.
6. Sharing with third parties
We do not sell, rent, or share QBO data with third parties. The only external services that touch QBO data in the normal operation of the Application are:
- Intuit, the source of the data, via the QuickBooks Online API.
- Anthropic, as described in Section 4.
- Microsoft, where data is incidentally stored in OneDrive or another Microsoft 365 service under Maximum Potential’s tenant agreement.
No analytics, advertising, or tracking services are used by the Application.
7. Security
The Application runs on workstations protected by Windows full-disk encryption, requires authenticated sign-in to Microsoft 365 with multi-factor authentication, and stores OAuth secrets in restricted-permission files. We follow Intuit’s published guidance on token storage and refresh-token rotation.
8. Access, correction, and revocation
Maximum Potential’s QBO administrator can revoke the Application’s access at any time from the QuickBooks Online “Apps connected to QuickBooks” panel. Upon revocation, all access and refresh tokens are invalidated immediately by Intuit. Because the Application does not warehouse QBO data, no further deletion request is necessary; deleting the connection and any locally saved output files completes data removal.
9. Changes to this policy
Material changes to this policy will be posted at this URL. The “Effective date” at the top reflects the most recent revision.
10. Contact
Questions about this policy or the Application’s data practices may be directed to: contact@maximum-potential.ca
Maximum Potential
Ontario, Canada