Privacy Policy

Last updated September 21, 2026

QBAdvisor ("we," "us," "Comptrolla") is a business-insights assistant that connects to a company's own QuickBooks data and helps its owner review daily briefings, ask questions, and manage staff/vendor contacts. This policy explains what we collect, why, how long we keep it, and the rights you have over it. We've tried to keep it in plain language rather than pure legal boilerplate, while still covering what applicable law requires us to disclose.

1. What we collect

• Account information — your name and email address, used to sign in. If you sign in with Google, Facebook, or Apple, we receive the identifier and email those providers share with us, not your password.
• Your QuickBooks business data — the data your own QuickBooks connection (via QBHub, the sync engine you install on your own machine) sends to your own private QBAdvisor account: customers, vendors, invoices, bills, and standard financial reports (balance sheet, profit & loss, trial balance, general ledger). This is the same data already in your QuickBooks file.
• Staff and vendor contacts you add — names, emails, and group memberships you enter yourself, used only to address the directive emails you choose to send.
• Your company profile — if you're a company owner, the details you choose to enter about your business: legal name, address, phone number, business email, tax ID, fiscal-year start, and logo.
• Your conversations with the app — questions you ask and the AI-generated briefings, insights, and recommendations you receive, so you can review your own history.
• Photos and images — photos you attach to a conversation and the logo you upload for your company, stored so they can be shown back to you.
• Voice — if you dictate a message, the recording is sent to our AI provider (Google) to be turned into text; we keep the text, not the audio. If you use the optional live voice call, your speech is streamed to our voice provider (ElevenLabs) to conduct the call, and we keep the written transcript of it in your conversation history.
• Device and push-notification identifiers — if you enable notifications, a device token used solely to deliver them to your own device.
• Basic technical data — sign-in timestamps and device/app-version information, used for security (e.g. detecting suspicious sign-ins) and troubleshooting.

We do not knowingly collect more than is needed for the purposes described in this policy.

2. Why we process it, and on what legal basis

We process your information to:

• Provide the Service itself — this is necessary to perform our contract with you (our Terms of Service);
• Generate AI briefings, answers, and recommendations using an AI model (Google's Gemini API);
• Send the directive emails you explicitly approve, via our email provider, Resend;
• Maintain the security and integrity of the Service, which is a legitimate interest we and our clients share; and
• Comply with legal obligations we're subject to, where applicable.

We do not use your data to train AI models, and we do not sell it or use it for advertising.

3. Who can see it

Your company's data is kept logically separate from every other company's: each record belongs to a single company, and access to it is controlled by company membership. Within a company's workspace, only people you or the account owner have invited, at the access level they were granted (Owner, Manager, or Viewer), can see it. Our own authorized administrators can also access workspace data, including conversations, when needed to provide support, investigate a problem, or keep the Service secure.

4. Third parties we rely on

• Google, for the Gemini AI model that powers briefings and chat answers and turns dictated speech into text, and optionally for Google Sign-In.
• Resend, to deliver directive emails you approve.
• Firebase (Google), for authentication and related infrastructure.
• Apple and Meta (Facebook), only if you choose to sign in with those providers.
• ElevenLabs, only if you use the optional voice-call feature.
• Cloudinary, to store the photos and logos you upload.
• Expo, which relays the push notifications you've turned on (with Apple's and Google's notification services); it receives your device token and the notification text.
• Render, our hosting provider, where the Service and its database run.

Each receives only the minimum data needed to perform its function and is contractually or by its own published policy restricted from using it for any other purpose. Some of these providers process data on servers located outside the Philippines (principally the United States); where that occurs, we rely on that provider's own published safeguards (such as standard contractual clauses or equivalent certifications) as the basis for that transfer.

5. How long we keep it

We retain your account information and Your Data for as long as your account remains active, and for a reasonable period afterward to comply with legal, accounting, or security obligations, resolve disputes, and enforce our agreements. When no longer needed, we delete or anonymize it. You can request earlier deletion at any time — see Section 7.

6. Security

We use industry-standard technical and organizational measures to protect your information, including encryption in transit, access controls limiting who can reach production data, and per-company data separation. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and, where required, the relevant regulator (in the Philippines, the National Privacy Commission) without undue delay and in accordance with applicable law.

7. Your rights

Depending on your location, you may have some or all of the following rights over your personal data, which we honor regardless of where you're located as a matter of policy: to be informed that your data is being processed; to access a copy of it; to correct it if inaccurate; to object to certain processing; to have it erased or blocked; to receive it in a portable format; and to lodge a complaint with your local data protection authority (in the Philippines, the National Privacy Commission). You may exercise any of these rights, or ask us to delete your account and its data entirely, at any time by contacting us below or by following the steps on our account deletion page.

8. Children's privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Cookies and similar technologies

The mobile app does not use browser cookies. The web sign-in page relies on your browser's own storage, managed by our authentication provider (Firebase), only to keep you signed in — no advertising or third-party tracking technology is used.

10. Changes to this policy

We may update this policy from time to time. If we make a material change, we will provide reasonable notice — for example, by email or an in-app notice — before it takes effect. The "Last updated" date above always reflects the current version.

Questions about this policy, or a request under Section 7? Contact qbadvisor@comptrolla.com.