Privacy policy.

1. Who we are

“Lumetrin”, “we” and “us” mean Lumetrin Consulting Services LLC. We build Lumetrin OS, a business operating system that service businesses use to manage their customers, sales pipeline, communications and operations. Lumetrin OS is available at app.lumetrin.com. We also operate this website, lumetrin.com.

2. What this policy covers

This policy covers:

• Lumetrin OS — the platform businesses sign in to, and the connections they make from it to services such as Facebook and Gmail.
• lumetrin.com — this website.

Businesses that use Lumetrin OS (“business customers”) decide what information about their own customers and leads they put into, or bring into, the platform. We handle that information to provide Lumetrin OS to the business. If you are a customer of a business that uses Lumetrin OS, that business’s own privacy policy explains how it uses your information, and you can contact the business directly. You can also contact us, and we will help direct your request.

Websites that a business publishes through Lumetrin OS under its own name carry that business’s own privacy policy.

3. Information we handle

Account and workspace information

• The name and email address of each person who signs in to Lumetrin OS, and the credentials used to sign in.
• The business (workspace) each person belongs to, and their role in it, which determines what they can see and do.
• Business settings a customer enters, such as its trading name and contact details.

Information businesses keep in Lumetrin OS

Depending on which features a business uses, this can include:

• contacts and leads — names, email addresses, phone numbers and similar details;
• sales opportunities, follow-ups, notes and activity history;
• records specific to the business’s industry, such as rental applications, reservations and documents uploaded for them;
• enquiries submitted through a website the business publishes with Lumetrin OS.

Communications

• Text messages (SMS). When a business uses Lumetrin OS texting, we store the messages sent and received, the phone numbers involved, delivery status, and a customer’s choice to stop or restart receiving texts.
• Calls. We store call details such as the numbers involved, time and duration. Call recording is off by default. A business can turn it on only after entering the disclosure it gives callers, and it is responsible for any notice or consent the law requires. If recording is turned on, recordings (and transcripts, where enabled) are stored.
• Facebook Messenger. Described in section 4.
• Gmail. Described in sections 13 and 14.

Payments

Where a business takes payments through Lumetrin OS, payment details are handled by our payment processor, Stripe. Card details are held by Stripe; Lumetrin OS keeps records of the payment, such as amount and status. Where a business connects its QuickBooks company, the invoice and payment records sent to it are described in section 15.

Technical and security information

• Cookies needed to keep you signed in and to end inactive sessions (section 7).
• An audit record of important actions in Lumetrin OS, such as changes to records or settings, including who acted, what changed and when.
• IP addresses, used in hashed form to limit repeated sign-in and password-reset attempts, and in the standard logs kept by our hosting and sign-in providers.

lumetrin.com

This website has no analytics and no advertising or tracking scripts. Its demo and access forms validate what you type in your browser and then tell you plainly that nothing was stored or sent; no personal information leaves the page. Its fonts and images are served from this site itself.

4. Facebook and Meta data

A business can connect its Facebook Pages to Lumetrin OS so that leads from its Facebook Lead Ads forms, and messages sent to its Page on Messenger, arrive in its own Lumetrin OS workspace. Messenger is on by default for each connected Page, and an administrator can turn it (or Lead Ads) off for any Page. A business administrator makes the connection. Facebook’s own window asks which Pages and business portfolios to share, and Lumetrin receives only what the person grants.

What we receive and why

Lead forms start off

Finding a Page’s forms does not start collecting leads. Every newly found form starts off, and the business turns on only the forms it wants. If a lead arrives from a form that is off, or from a form Lumetrin OS has not seen before, no contact or opportunity is created and the person’s answers are not stored. We keep a record that a lead arrived, with the names of the form’s fields only, so the business can see what it received. A form Lumetrin OS has not seen before is added to the business’s list, turned off.

What we do not do

• We do not create, edit or manage ads, and we do not publish posts to a Page. Facebook may show a permission to manage a Page’s ads; Lumetrin OS uses it only to list the Page’s lead forms.
• Messenger replies are sent only by the business’s staff, within Messenger’s standard reply window. Lumetrin OS does not send marketing messages on Messenger.
• Each Facebook Page can be connected to only one business. Lumetrin OS decides which business a lead or message belongs to from its own record of the connected Page, never from the incoming message. One business cannot see another business’s Facebook data.

Disconnecting

An administrator can disconnect a Page, or all of the business’s Pages, in Lumetrin OS. Disconnecting deletes the stored Page access token and the list of that Page’s forms. Contacts, opportunities, lead records and Messenger conversations already created remain in the business’s workspace as part of its records, until deleted on request (see our data deletion page). Disconnecting in Lumetrin OS does not remove the app’s permission on Facebook. To remove it, go to your Facebook settings under Business integrations and remove the app.

5. How we use information

• To provide Lumetrin OS: sign-in, the features a business uses, and its connections to services such as Facebook, texting and payments.
• To keep each business’s information separate and to control who in a business can see what.
• To keep the service secure: detecting misuse, verifying that notifications really come from the services that sent them, and keeping an audit record.
• To send the service messages a business asks us to send, such as notifications to its staff or customers.
• To support business customers and to maintain and improve Lumetrin OS.
• To meet legal obligations.

Gmail data is used only as sections 13 and 14 describe.

6. Who we share it with

We share information only as needed to run Lumetrin OS:

• The business customer whose workspace the information belongs to, and the people it authorises.
• Service providers that run parts of the service for us: Vercel (hosting), Supabase (database, sign-in and file storage), Twilio (texting and calls), Stripe (payments), Resend (email delivery), and ImprovMX (forwarding of email sent to privacy@lumetrin.com to the mailbox where we read it).
• Services a business connects, such as Meta (Facebook and Messenger). When a business replies on Messenger, for example, the reply is sent through Meta.
• Google, which receives Lumetrin OS’s requests to read a connected Gmail account, including search words an administrator types in Mail. Gmail data itself is shared only as sections 13 and 14 allow.
• Intuit, whose QuickBooks Online service receives the records a business sends to its QuickBooks company, and receives Lumetrin OS’s requests to read from that company, including the names and email addresses it looks up to find an existing customer. QuickBooks data is described in section 15.
• Legal and safety reasons, where the law requires it or to protect the rights, property or safety of our users, the public or Lumetrin.
• A business transfer, such as a merger or acquisition, subject to this policy.

7. Cookies

Lumetrin OS uses only the cookies it needs to work: cookies from our sign-in provider that keep you signed in, two cookies of our own that remember how you signed in and end your session after a period of inactivity, and a short-lived cookie used only while you reset your password. We do not use analytics, advertising or tracking cookies. lumetrin.com sets no cookies.

8. Security

Our safeguards include:

• database rules that keep each business’s information separate;
• role-based access within a business;
• server-only storage of Facebook access tokens;
• read-only Gmail permission, and encrypted, server-only storage of each Gmail connection’s tokens;
• encrypted, server-only storage of each QuickBooks connection’s tokens;
• verification of the signatures on notifications from Meta, Twilio, Stripe and Intuit;
• automatic sign-out of inactive staff sessions;
• an audit record of important actions.

No system is perfectly secure, and we cannot guarantee absolute security.

9. How long we keep information

We keep a business’s information while it uses Lumetrin OS, or until it asks us to delete it, and as long as needed for the purposes in this policy and to meet legal obligations. Some records, such as the audit record and payment records, may be kept after other information is deleted. Disconnecting Facebook deletes the stored Page access token immediately, as described in section 4. Gmail tokens are kept until Gmail is disconnected, reconnected or removed, as described in sections 13 and 14. QuickBooks tokens are deleted when QuickBooks is disconnected, as section 15 describes. Lumetrin OS keeps no copy of email.

10. Your choices and requests

• If you use Lumetrin OS, you can ask us to access, correct or delete information about you by emailing privacy@lumetrin.com. Your business’s administrator can also update or remove much of it.
• If a business holds your information in Lumetrin OS, for example because you filled in its Facebook lead form or messaged its Page, contact that business first. It controls those records. You may also email us at privacy@lumetrin.com, and we will help.
• Facebook data: see section 4 and our data deletion instructions.
• Gmail data: see sections 13 and 14.
• QuickBooks data: see section 15.

We may need to verify your identity before acting on a request.

11. Children

Lumetrin OS is a tool for businesses. It is not directed to children, and we do not knowingly collect children’s information for our own purposes.

12. Pinterest integration (read-only, internal use)

Lumetrin has a Pinterest Developer application in progress, working name “Lumetrin Visual Reference”. It gives read-only access to Pinterest boards and Pins curated by Lumetrin’s founder, used internally for visual reference and design research. It requests only read-only permissions: boards:read, pins:read, and the minimal read-only account permission Pinterest requires to sign in. It does not create, edit, delete or publish Pins, and does not change boards.

13. Gmail and Google data

Lumetrin OS includes a read-only Mail page. It can show one Gmail account that Lumetrin manages. Email for Lumetrin’s own addresses, and for business addresses whose email is delivered to that account, can be read there by the people allowed to see it. Lumetrin connects this account itself, through Google’s own sign-in and consent window. Where Lumetrin has made it available, a business can also connect its own Gmail account to Lumetrin OS. That is a separate mailbox, which only that business’s owners and administrators can read; section 14 describes it. This section describes the account Lumetrin manages.

What we access and why

• Read-only access to Gmail, through Google’s “View your email messages and settings” permission. Lumetrin OS cannot send, delete, move, label or change email. It does not read or change Gmail settings.
• The connected account’s email address, to show which mailbox is connected.
• Each message’s sender, recipients, subject and date; its delivery details (the addresses it was delivered to, and the mail servers it passed through); Gmail’s short preview of it; its text; Gmail’s labels on it (such as Inbox and Unread); and the names, types and sizes of its attachments, but not their contents. We use these to list and display mail, and to decide which business a message belongs to from the address it was sent to.
• Gmail’s own IDs for conversations, to open a conversation and to link to it in Gmail.
• The access and refresh tokens Google issues for the connection, so Lumetrin OS can read the mailbox without asking for consent each time.

How we use it

• Lumetrin OS reads mail from Gmail only when an authorised person opens Mail, and shows it on that page. Nothing in Lumetrin OS reads Gmail in the background. Mail sent to Lumetrin’s own addresses is shown only to Lumetrin’s platform administrators. Mail sent to a business address whose email is delivered to the account is shown only to that business’s administrators.
• We use Gmail data only to provide this Mail feature. We do not use or transfer it for advertising, we do not sell it, we do not use it to decide creditworthiness or for lending, and we do not use it to build profiles or to develop, improve or train artificial-intelligence or machine-learning models.
• No one at Lumetrin reads Gmail data except the authorised administrators using Mail, unless the account owner has agreed to it for specific messages, it is needed for security, such as investigating abuse, or the law requires it.

How we store and protect it

• We do not store the content of email messages. Lumetrin OS keeps only the connected address, the permission Google granted, which administrator connected it, the connection’s status and dates, and the access and refresh tokens. The tokens are encrypted, kept on our servers and never sent to a browser.
• Our hosting provider, Vercel, processes email while a Mail page is shown. Our database provider, Supabase, stores the encrypted tokens.

Sharing

We do not transfer Gmail data to anyone except:

• the authorised administrators described above, through the Mail feature;
• Vercel and Supabase, which run this feature for us;
• where needed for security, such as investigating abuse;
• where the law requires it;
• as part of a merger, acquisition or sale of Lumetrin’s assets, and then only after obtaining the account owner’s explicit prior consent.

Disconnecting and deletion

• When a platform administrator disconnects Gmail in Lumetrin OS, Lumetrin OS deletes the stored tokens from our database in that same step. If the deletion cannot be completed, Lumetrin OS shows an error, and the connection stays in place until it is removed.
• When it can still read the stored token, Lumetrin OS also sends Google a request to revoke Lumetrin’s access, unless a business has connected the same Google account under section 14. Revoking would end that business’s connection too, so in that case Lumetrin OS deletes the stored tokens without asking Google. Sending a request does not by itself confirm that Google has completed it. The account owner can confirm or remove Lumetrin’s access at any time on their Google Account’s third-party connections page.
• A successful reconnection replaces the stored tokens with new ones and deletes the previous ones from our database. It does not ask Google to revoke anything.
• Copies of deleted tokens (encrypted) and of the other connection details may remain in our database provider’s routine backups until those backups expire.
• Email stays in Gmail. Lumetrin OS keeps no copy of it.

Limited Use

Lumetrin OS’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This statement covers this section and section 14.

14. Gmail accounts that businesses connect

Where Lumetrin has made this feature available to it, a business that uses Lumetrin OS can connect its own Gmail account, so that its owners and administrators can read the business’s email on Lumetrin OS’s Mail page. That mailbox belongs to the business, and the business decides whether to connect it. It is separate from the account Lumetrin manages, described in section 13. We handle this mailbox’s data on the business’s behalf, to provide Mail to it. The business is responsible for having the right to connect the mailbox, and for any notices or consents the law requires for this access.

Connecting

• Only a business’s owners and administrators can connect, reconnect or disconnect its Gmail. They start in Lumetrin OS, from Settings → Integrations → Gmail or from the Mail page, and finish in Google’s own sign-in and consent window. Lumetrin never sees the Google account’s password.
• Before Google’s window opens, Lumetrin OS explains what it will be able to see and what it keeps, and the owner or administrator confirms that they are authorized to connect the mailbox for the business. Lumetrin OS records who confirmed, when, and which version of that notice they accepted.
• Lumetrin OS asks Google only for read-only access to Gmail, Google’s “View your email messages and settings” permission. If Google grants anything beyond that and basic sign-in information, the connection is refused, and no tokens or address are stored. Lumetrin OS may then still be listed in the Google Account until access is removed there.
• A business can connect one Gmail account at a time.
• The connection belongs to the business, not to the person who made it. If that person leaves the business, it stays in place until an owner or administrator disconnects it, or a Lumetrin platform administrator removes it, as described under “Disconnecting and deletion” below.
• If the Gmail account belongs to a Google Workspace organization, that organization’s Google administrator may need to allow Lumetrin OS before it can be connected.

What we access and why

• The connected account’s email address, to show the business which mailbox is connected.
• To list and search mail, Gmail returns and Lumetrin OS reads, for each message in a conversation:
  • its sender, recipients, subject and date;
  • its delivery details: the addresses it was delivered to, and the mail servers it passed through;
  • Gmail’s short preview of it;
  • Gmail’s labels on it, such as Inbox, Unread and Sent.

  Lumetrin OS shows each conversation’s subject, sender, date and preview, whether it is unread, how many messages it has, and whether it has attachments.

• When an owner or administrator opens a conversation, Gmail returns each message in full, headers and text included.
  • Lumetrin OS shows each message’s sender, recipients (To and Cc), subject and date.
  • It shows the message text up to about 60,000 characters. Anything longer can be read in Gmail.
  • It shows the names and sizes of attachments. It does not download or open the attachments themselves.
  • Email written in HTML is shown as plain text, so images and other content linked from a message are not loaded.
• Search words an owner or administrator types. Lumetrin OS sends them to Gmail as a search, and Gmail matches them against senders, recipients, subjects and message text.
• Gmail’s own IDs for conversations and messages, to open a conversation and to link to it in Gmail.
• Gmail’s labels, to show which conversations are in the Inbox and which are unread. Mail shows the Inbox, or all mail; drafts, spam and trash are never shown.
• The access and refresh tokens Google issues for the connection, so Lumetrin OS can read the mailbox without asking for consent each time.

Lumetrin OS cannot send, delete, move, label or change email. Opening a message in Lumetrin OS does not mark it as read in Gmail. Lumetrin OS does not read or change Gmail settings.

Who can see it

• Only the business’s owners and administrators can read the connected mailbox in Lumetrin OS. The business’s other staff cannot open Mail.
• The business’s owners and administrators can see which Gmail address is connected, in Settings and in Mail.
• No other business can see the mailbox. Lumetrin OS decides which business a mailbox belongs to on its own servers, from the signed-in person’s business, never from anything a browser sends.
• Lumetrin’s own staff cannot read a business’s mailbox in Lumetrin OS. Gmail cannot be read, connected or disconnected from inside a support session, even one the business has allowed.
• Lumetrin’s platform administrators can see which Gmail address a business has connected and whether the connection is working, and they can remove the stored connection. They cannot read the mail.

How we use it

• Lumetrin OS reads a business’s Gmail only when one of its owners or administrators connects it (to read the account’s address), opens Mail, searches, or opens a conversation, and it shows the result on that page. Nothing in Lumetrin OS reads a business’s Gmail in the background.
• We use this Gmail data only to show the business its own mailbox in Mail.
  • We do not use or transfer it for advertising, and we do not sell it.
  • We do not use it to decide creditworthiness or for lending.
  • We do not use it to build profiles, or to develop, improve or train artificial-intelligence or machine-learning models.
  • No artificial-intelligence feature in Lumetrin OS reads Gmail.
• No one at Lumetrin reads a business’s Gmail data except in these cases:
  • the business has agreed to it for specific messages;
  • it is needed for security, such as investigating abuse;
  • the law requires it.

How we store and protect it

• We do not store the content of a business’s email: no messages, subjects, senders, previews or attachments.
• For each connected business, Lumetrin OS keeps:
  • the connected Gmail address;
  • the access and refresh tokens, encrypted, and when the access token expires;
  • the identifier of the Google sign-in client that obtained the tokens, and the permission Google granted;
  • whether the connection is working or needs reconnecting;
  • which owner or administrator connected it;
  • when it was first connected, and when it was last updated.
• The tokens are encrypted, kept on our servers in storage that no signed-in account can read, and never sent to a browser.
• Each time an owner or administrator starts connecting Gmail, Lumetrin OS keeps a record of who started, when, and which version of the notice shown before connecting they accepted.
• Our audit record notes:
  • each start of a connection, with the version of the notice that was accepted;
  • each connection and reconnection, with the Gmail address and the person who connected it;
  • each disconnection, with the Gmail address that was released;
  • each removal by a Lumetrin platform administrator, with the Gmail address that was released and the reason given.
• After a disconnection or removal, Lumetrin OS keeps three things: a record, without the address, that the business’s Gmail is disconnected; the records of each start of a connection; and the audit record.
• Our hosting provider, Vercel, processes email while a Mail page is shown. Our database provider, Supabase, stores the encrypted tokens and the details listed above.
• The web address of a Mail page includes any search words typed, and Gmail’s ID for an open conversation.
  • These may appear in our hosting provider’s standard request logs, and in the viewer’s browser history.
  • Lumetrin OS writes no email content to logs.

Sharing

We do not transfer a business’s Gmail data to anyone except:

• the business’s owners and administrators, through Mail;
• Vercel and Supabase, which run this feature for us;
• where needed for security, such as investigating abuse;
• where the law requires it;
• as part of a merger, acquisition or sale of Lumetrin’s assets, and then only after obtaining the business’s explicit prior consent.

Disconnecting and deletion

• An owner or administrator can disconnect Gmail at any time, from Settings → Integrations, including after Gmail has been turned off for the business.
  • In that same step, Lumetrin OS deletes the stored tokens and the connection details listed above from our database, and records the disconnection.
  • If the deletion cannot be completed, Lumetrin OS reports it, and the connection stays in place until it is removed.
• Before deleting, Lumetrin OS asks Google to revoke Lumetrin’s access, when all of these are true:
  • it can still read the stored token;
  • the access was granted to this same Lumetrin OS app;
  • no other connection in Lumetrin OS uses the same Google account. That means another business’s connection, or the account Lumetrin manages.

  Otherwise it deletes this business’s tokens without asking Google; when another connection shares the account, this is because revoking would end that connection too. In every case, Lumetrin OS then tells the owner or administrator that it deleted the access it kept, and that Lumetrin OS may still be listed in the Google Account until it is removed there. It does not say whether Google confirmed a revocation, because that answer could reveal that another connection uses the same Google account.

• A Lumetrin platform administrator can also remove a business’s stored connection, for example for a business that no one can sign in to any more. They must give a reason, which is recorded in the business’s audit record. Removal deletes the stored tokens and the connection details, as Disconnect does, and Google is asked to revoke Lumetrin’s access under the same conditions. Removal never opens the mailbox.
• The business, or the account’s owner, can confirm or remove Lumetrin’s access at any time on the Google Account’s third-party connections page.
  • Once access is removed there, Lumetrin OS can no longer read the mailbox, and it shows that Gmail needs reconnecting.
  • The stored tokens, which no longer work, stay in our database until an owner or administrator disconnects or reconnects Gmail in Lumetrin OS, or a Lumetrin platform administrator removes the connection.
• A successful reconnection replaces the stored tokens with new ones and deletes the previous ones from our database. It does not ask Google to revoke anything.
• Copies of deleted tokens (encrypted) and of the other connection details may remain in our database provider’s routine backups until those backups expire.
• The audit record described above, which includes the Gmail address, is kept as section 9 describes.
• Email stays in Gmail. Lumetrin OS keeps no copy of it.
• A business that stops using Lumetrin OS can disconnect Gmail first, or ask us at privacy@lumetrin.com to remove the connection. If a business’s records are deleted, its Gmail tokens are deleted with them, without asking Google to revoke; access can then be removed in the Google Account.

Limited Use

Lumetrin OS’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. It will also adhere to the Google Workspace API User Data and Developer Policy.

15. QuickBooks accounts that businesses connect

A business that uses Lumetrin OS can connect its own QuickBooks Online company, a service from Intuit Inc., so that Lumetrin OS can send the business’s customers, invoices, payments and refunds to it and read back changes made there. The QuickBooks company belongs to the business, and the business decides whether to connect it. We handle this information to provide the connection to the business.

Connecting

• Only a business’s owners and administrators can connect or disconnect QuickBooks. They start in Lumetrin OS, from Settings → Integrations → QuickBooks, and finish in Intuit’s own sign-in and consent window. Lumetrin never sees the Intuit account’s password.
• Lumetrin OS asks Intuit only for its accounting permission (com.intuit.quickbooks.accounting).
• A business can connect one QuickBooks company at a time, and a QuickBooks company can be connected to only one business on Lumetrin OS at a time.
• No customer, invoice, payment or refund is sent until an owner or administrator has chosen the date from which to start. A record then waits for any other setting it needs, such as where a kind of charge goes, although its customer may already have been sent. QuickBooks items are created only as described below.
• If a connection is refused, for example because the company does not keep its books in US dollars or is already connected to another business, no access keys or company details are kept. Lumetrin OS may still be listed under the company’s connected apps in QuickBooks until the business removes it there.

What we send

Once QuickBooks is set up, Lumetrin OS sends the business’s QuickBooks company:

• Customers: a person’s name, the organization they gave, their email address and phone number. A person is sent only when an invoice or payment for them is sent, so leads and other contacts are not. Where the name is already used in QuickBooks, or there is no name or organization, the customer’s name there includes a short code.
• Invoices: dates, amounts and line descriptions, such as a rental period, or the description a staff member typed on a manual invoice, and a manual invoice’s number.
• Payments: the amount, date, the invoice it pays and a short payment reference.
• Refunds: amount and date.
• Items: Lumetrin OS creates a QuickBooks item only when an administrator asks it to, using the name and income account the administrator chooses. Before it creates one, it looks for an existing item with the same name and uses that if there is exactly one.
• Updates and voids: later changes to a customer’s details in Lumetrin OS are sent as updates, using Lumetrin OS’s values even where they were changed in QuickBooks. The due date of an open manual invoice is updated when it changes in Lumetrin OS, unless the invoice was changed, or money was applied to it, in QuickBooks since Lumetrin OS last sent or checked it. An invoice or payment that is later voided, cancelled or failed in Lumetrin OS is voided in QuickBooks, unless it was deleted there or is held for a person to review. Lumetrin OS does not delete records in QuickBooks.

Lumetrin OS does not send addresses, a contact’s notes or messages, uploaded documents or card details. Each invoice, payment and refund it sends carries a Lumetrin OS reference in its private note.

What we read

• When a business connects, Lumetrin OS reads the QuickBooks company’s profile (including name, legal name and country) and currency settings, to confirm which company it is and that it can be connected. It keeps only the company’s name and identifier.
• To let an administrator choose where each kind of charge goes, it reads the company’s items and accounts.
• To avoid creating duplicates, it looks up an existing QuickBooks customer with the same email address before it creates one, and with the same name if QuickBooks says the name is taken. If exactly one has the same email address and name, Lumetrin OS uses it and may update its name, organization, email and phone.
• Intuit notifies Lumetrin OS when records in the connected company change; each notification names the record and what happened, and carries no record contents. Lumetrin OS may also check for recently changed customers, items, invoices, payments and refunds. That check reads every recently changed record of those kinds in the company, including ones Lumetrin OS did not send.
• Apart from the reads above, it reads records only to find, update or void what it sent, and to tell whether a record it sent has been changed, deleted, voided or paid in QuickBooks.
• Other than the connection’s details (the company’s name and identifier), the choices an administrator makes, and the identifiers, version numbers and totals below, Lumetrin OS does not keep copies of what it reads from QuickBooks. It keeps a record of each link between a Lumetrin OS record and a QuickBooks record (the identifiers on both sides, QuickBooks’ version number for the record, a fingerprint of what was sent, its status and when it was last synced), the type and identifier of each changed QuickBooks record that Intuit reports or that a check finds needs attention, and the outcome of each sync. Where a check finds that the total of a record it sent is different in QuickBooks, it keeps the total it found there, and the total the business accepts if it chooses to.
• A change that needs attention is flagged for the business to review. Reading it changes nothing in QuickBooks, and none of the business’s Lumetrin OS customer, invoice or payment records.

How we store and protect it

• The connection’s access tokens are stored encrypted, on the server only, in storage no signed-in account can read, and are never sent to a browser.
• Lumetrin OS verifies the signature on each notification from Intuit before recording anything.

Sharing

Through this connection, Lumetrin OS sends QuickBooks data to Intuit, as described above, and to no one else. The service providers in section 6 that host Lumetrin OS hold it for us. Lumetrin OS uses QuickBooks data only to provide the connection to the business that owns the QuickBooks company. It does not sell it, share it with other businesses, or use it for advertising.

Disconnecting and deletion

• An owner or administrator can disconnect QuickBooks at any time, from Settings → Integrations.
  • Disconnecting stops anything more being sent or read, asks Intuit to revoke Lumetrin OS’s access, and deletes the access tokens Lumetrin OS stored for the connection.
  • If the tokens cannot be deleted at that moment, Lumetrin OS says so, and they stay encrypted and are used only to ask Intuit to revoke access, until they are deleted or replaced the next time QuickBooks is connected.
  • If Intuit cannot be reached, Lumetrin OS says so, and Lumetrin OS may still be listed under the company’s connected apps in QuickBooks until the business removes it there.
• The business can also remove Lumetrin OS’s access itself, under the company’s connected apps in QuickBooks. After that, Lumetrin OS can no longer read from or write to the company, and an administrator has to reconnect QuickBooks for it to work again.
• Disconnecting does not delete or change anything already in QuickBooks.
• The record of each link and sync described above, and the audit record of connecting and disconnecting, are kept as section 9 describes.
• Intuit’s privacy statement describes how Intuit handles information in the business’s QuickBooks account.

16. Changes to this policy

We will update this policy when our practices change, and change the date at the top. If a change is significant, we will tell business customers before it takes effect.

17. Contact

Lumetrin Consulting Services LLC.
Privacy, access and data-deletion requests: privacy@lumetrin.com.