QuickBooks Privacy Policy

1. Who we are

This policy applies to Al-Khwarizmi API, operated by Al-Khwarizmi Company for Trading Pharmaceuticals, Medical Devices and Laboratory Supplies / Limited in Sulaymaniyah, Iraq.

2. Information the integration processes

When an authorized user connects the integration to QuickBooks Online, it may process:

• QuickBooks company information and accounting records requested for internal reports, reconciliation, review, analysis, or export.
• OAuth access and refresh tokens and the QuickBooks company identifier (realm ID) required to maintain the authorized connection.
• Limited technical metadata, including request time, HTTP status, operation name, and Intuit transaction identifier (intuit_tid) for troubleshooting.

The integration does not collect a user's Intuit password.

3. How information is used

QuickBooks information is used only for Al-Khwarizmi's internal accounting, reporting, reconciliation, analysis, and user-requested exports. The current integration is read-only and does not create, edit, or delete QuickBooks accounting records.

4. Sharing and sale

Al-Khwarizmi does not sell QuickBooks data, use it for advertising, or make it available to unrelated third parties. Data is not displayed to or used by anyone other than authorized Al-Khwarizmi personnel, except where disclosure is required by applicable law or necessary to protect the company and its systems.

5. Storage and security

OAuth tokens and the QuickBooks company identifier are encrypted at rest, with the encryption key stored separately and access restricted to the company-controlled service account. HTTPS is required for the production connection. Technical logs exclude credentials, OAuth tokens, QuickBooks record contents, query strings, and exported report data.

6. Retention and deletion

Connection credentials are retained only while the integration remains authorized or until they expire or are revoked. Disconnecting the integration revokes the Intuit authorization and removes the locally stored connection token. User-requested reports or exports remain within company-controlled storage until deleted under Al-Khwarizmi's internal records practices.

7. Choices and access

An authorized user may disconnect the integration through its disconnect process or revoke access from Intuit. Al-Khwarizmi personnel may contact the company to request access to, correction of, or deletion of locally retained integration information, subject to applicable legal and record-keeping requirements.

8. Changes to this policy

This policy may be updated when the integration's operation or legal requirements change. The effective date above will be revised when material changes are published.

9. Contact

Questions about this policy or the integration may be sent to contact@al-khwarizmi.co or directed to Al-Khwarizmi Company, Office number 6, Second Floor, Dania Trade Center, Ibrahim Ahmed Street, Sulaymaniyah City, Sulaymaniyah Governorate, Iraq.