Privacy Policy

Last updated 29 August 2026

1. Who we are

Essntl Ltd, Office 1, 2a Curzon Road, London W5 1NF, United Kingdom ("we", "us") operates Invoice Generation via API (the "App"). We are the data controller for any personal data processed through the App. Contact: ady@rugina.net.

2. What the App is

The App is a private, internal tool. It connects our own QuickBooks Online company to an AI assistant so that authorised staff of Essntl Ltd can query and manage our own accounting records. It has no external users and is not made available to third parties.

3. Data we access

Through the QuickBooks Online Accounting API the App may read, create and update: company information; customers, vendors and employees (names, business contact details, addresses); invoices, estimates, bills, payments, items and chart-of-accounts data. Deletion operations are disabled in our deployment.

4. How data is processed and stored

• The App runs on devices owned and controlled by Essntl Ltd. QuickBooks data is retrieved on demand and is not copied into a separate database.
• OAuth credentials (client ID, client secret, refresh token) are stored in a local configuration file with restricted file permissions on the operator's device. They are never embedded in client-side code or exposed in logs.
• When a staff member asks the AI assistant a question, relevant QuickBooks data returned by the API is transmitted to our AI service provider (Anthropic, PBC) as part of the assistant conversation, solely to answer that request. This is subject to Anthropic's commercial data-handling terms, under which such inputs are not used to train models.
• Diagnostic logs, including Intuit request identifiers (intuit_tid) and error details, may be retained locally for troubleshooting.

5. Sharing

We do not sell, rent or otherwise share QuickBooks data with any third party, other than the AI service provider described above and Intuit itself. Data is never shown to anyone other than authorised Essntl Ltd staff.

6. Legal basis and retention

Processing is based on our legitimate interest in managing our own business accounts (UK GDPR Art. 6(1)(f)). Accounting records are retained in QuickBooks Online according to UK statutory requirements; the App itself retains no independent copies beyond transient processing and local diagnostic logs.

7. Your rights

Individuals whose data appears in our accounting records (e.g. customer contacts) may exercise their UK GDPR rights — access, rectification, erasure, restriction, objection — by contacting ady@rugina.net. You may also complain to the Information Commissioner's Office (ico.org.uk).

8. Disconnecting

Access can be revoked at any time from QuickBooks Online (Apps → My Apps → Disconnect) or by contacting us. On disconnection the stored refresh token becomes invalid and is deleted from our configuration.

9. Security

We follow Intuit's developer security requirements: OAuth 2.0 with CSRF state validation, TLS for all API traffic, credentials held outside source code, and least-privilege scopes (accounting only).

10. Changes

We may update this policy; the current version is always published at this address.

Essntl Ltd · Office 1, 2a Curzon Road, London W5 1NF, United Kingdom · ady@rugina.net