This Privacy Policy explains how the Leadstone MCP integration (the "Application", "we", "us", "our"), operated by Leadstone, handles information when it connects to third-party services such as Intuit QuickBooks Online. The Application is a private, internal tool used solely by its authorized operator to view and analyze the operator's own business data. We do not sell personal information, and we do not use accessed data for advertising or for any purpose unrelated to operating the Application.
When you authorize the Application to connect to a QuickBooks Online company, it accesses the following, on a read-only basis:
The Application also stores OAuth tokens (a refresh token and short-lived access tokens) that let it connect to the authorized company on your behalf. It does not receive or store your QuickBooks Online password.
Accessed data is used solely to present it to the authorized operator and to answer the operator's questions about their own business — for example, which invoices are outstanding, how receivables are aging, or how the business is performing. The data is not used for any other purpose.
To provide its functionality, the Application relies on the following service providers ("sub-processors"), and data may be transmitted to and processed by them for that sole purpose:
We share information with these providers only to operate the Application. We do not sell data, and we do not share it for advertising. We may disclose information where required to do so by law or valid legal process.
The Application's server may run in the United States (Google Cloud), and the sub-processors above may process data outside your country of residence. By using the Application to connect a QuickBooks Online company, you acknowledge that data may be transferred to and processed in the United States and by the providers listed above.
OAuth tokens are retained for as long as the Application remains connected to your company and are deleted when you disconnect the Application or revoke its access. Business data retrieved from QuickBooks Online is not permanently stored by the Application beyond what is needed to answer a given request; any files the operator chooses to download are under the operator's own control.
We protect stored credentials using access-restricted files (restrictive file permissions) on storage that is encrypted at rest, and secrets are never committed to source control or written to request logs. Access is limited to the authorized operator. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
You may disconnect the Application at any time from within Intuit / QuickBooks Online (Settings → Apps), or by revoking its authorization, which stops further access and invalidates its tokens. You may also contact us to request deletion of any retained tokens or information the Application holds.
The Application is a business tool that is not directed to children and does not knowingly collect information from children.
We may update this Privacy Policy from time to time. The "Last updated" date above reflects the current version.
Leadstone — artur@leadstone.ca