Privacy Policy

1. Scope and contact

This Privacy Policy describes how Arsenal Document Studio at forany.tech handles information when you visit the site, use the shared staff workspace, connect QuickBooks, or submit an issue report. The Service is administered by Jim Kerns, KC ProAdvisor. For privacy questions or requests, contact jim@kcproadvisor.com.

Your organization decides which staff may use its workspace and what business information they enter. If a request concerns your organization’s business records, we may need to coordinate with its authorized administrator.

2. Information the Service processes

• Staff accounts: names, email addresses, roles, account status, a password hash, invitation records, and session information. The application stores a hash of your studio password rather than the password itself.
• Documents and projects: customer or vendor names, project and staff assignments, addresses, descriptions, quantities, prices, terms, reference numbers, notes, selected QuickBooks record identifiers, and saved document metadata. Internal notes are part of the shared workspace.
• QuickBooks connection and lists: authorized company identifiers and names, connection status, verification dates, encrypted application credentials and access tokens, and the supported customer, vendor, product, service, account, term, class, and location data retrieved for your requests. Contact details, descriptions, and prices may be included in those records. Selected values can be saved in workspace documents.
• Activity and security: the user, time, document reference, and details associated with recorded actions, such as signing in, saving a document, managing accounts, or creating a QuickBooks record. The application derives rate-limit identifiers from IP addresses and other request information to limit abuse.
• Issue reports: the description you submit, optional contact email and screenshot, submission time, and document context such as page, project, reference, and revision.

Intuit receives your QuickBooks sign-in directly. The Service does not ask for your QuickBooks password. Do not put payment-card numbers, bank passwords, Social Security numbers, or unnecessary sensitive personal information in notes or screenshots.

3. How information is used

The Service uses information to authenticate staff, control access, display and save shared documents, retrieve QuickBooks lists, perform the record-creation actions you request, maintain activity history, investigate issues, and protect the workspace from misuse. Connecting a company permits the supported QuickBooks operations described in the interface; it does not enable all possible accounting operations.

The application has no feature for selling personal information, displaying third-party advertising, or sending marketing campaigns. It does not install advertising pixels or a third-party analytics SDK. This description concerns the application; hosting and identity providers have their own data practices described below.

4. Who can receive or access information

• Your organization’s staff and administrators: signed-in staff can view shared documents and recorded workspace activity. Administrators manage accounts and can edit shared documents. Issue reports and screenshots are restricted to the configured feedback administrator.
• Intuit / QuickBooks: when authorized, the Service sends requests and record data to Intuit and receives the data needed for the selected company’s supported functions. QuickBooks records you create remain in QuickBooks under your company’s access controls.
• Hosting and infrastructure providers: the Service is hosted through OpenAI Sites and uses Cloudflare runtime and storage services. These providers process information needed to deliver and operate the site, including network and security information. Optional site-owner sign-in uses the hosting platform’s identity service.
• Recipients you choose: you control copies you print, save as PDF, export from the local demo, or share outside the Service. Outgoing document email is not enabled in the current application.
• Legal or security matters: information may be disclosed when required by law or when necessary and lawful to address fraud, unauthorized access, or threats to the Service or others.

Provider notices: Intuit Privacy Statement, OpenAI Privacy Policy, and Cloudflare Privacy Policy. This policy does not replace those notices or promise a particular hosting region.

5. Cookies and browser storage

The staff workspace uses a secure, HTTP-only session cookie to keep you signed in. Studio sessions expire after eight hours unless ended earlier. Removing or blocking the session cookie prevents normal signed-in use. Hosting and identity services may also use cookies needed to provide their services.

The separate original form demo stores its test workspace in your browser’s local storage. Clearing that site storage removes the local copy; it does not remove records saved in the shared workspace or QuickBooks. Browser exports and PDFs remain wherever you save them.

6. Security

The application uses HTTPS, individual staff accounts, password hashing, restricted administrative actions, request-origin checks, and encrypted storage of QuickBooks application secrets and authorization tokens. QuickBooks tokens are kept on the server and are not returned to the browser. No website or storage system can guarantee complete security.

Protect your password, devices, and personal setup link. Tell the administrator promptly if an account or shared information may have been accessed without permission. If a security incident requires notices under applicable law, we will provide the required notices.

7. Retention, disconnection, and deletion

Saved workspace documents, staff-account records, audit history, and issue reports do not currently have an automatic deletion schedule. They remain stored unless removed through administrative action. Expiration of an invitation or session ends its usability; it does not necessarily erase the stored record.

Signing out, disabling a staff account, or disconnecting QuickBooks does not erase documents or audit history. A successful disconnect from the QuickBooks page revokes authorization through Intuit and removes this application’s stored access and refresh tokens. The company assignment and connection-related audit records can remain. Data already saved in QuickBooks is not deleted by disconnecting.

Contact us to request access, correction, or deletion. Retention decisions take account of the purpose of the information, your organization’s instructions, applicable legal obligations, and the need to resolve disputes or security issues. We do not promise immediate erasure of provider logs, backups, or copies your organization or recipients separately maintain.

8. Your choices and requests

You may stop using the Service, ask your administrator to disable your account, or ask an authorized administrator to disconnect QuickBooks. You can also contact jim@kcproadvisor.com to request access to, correction of, or deletion of personal information, or to exercise any other privacy right available under applicable law.

Include your name, the email associated with the Service, and a description of your request. Do not send passwords or authorization tokens. We may need to verify your identity and authority, coordinate with the organization responsible for the records, and consider applicable legal exceptions before acting. Any rights provided by applicable law remain available regardless of this notice.

9. Business audience

The Service is intended for authorized business users, not children under 13. If you believe a child’s personal information has been submitted, contact us so it can be reviewed and addressed.

10. Policy changes

We will update this page and its effective date when the information practices described here change. We will provide additional notice or request consent where required by applicable law. For questions about the current policy, contact Jim Kerns, KC ProAdvisor, at jim@kcproadvisor.com.