Privacy Notice

1. Information we handle

• Account information: the email address you sign in with, and the authentication records kept by our authentication provider, including whether your email is verified.
• Your acceptance of these documents: your account identifier, email, the document versions you accepted and the time you accepted them.
• Business information you enter: figures, answers, corrections and the free-text explanations you write in the verification screens, kept with their exact wording so results stay auditable.
• QuickBooks Online records: when you connect it, we read accounting records such as accounts, invoices, sales receipts, payments, bills, expenses, journal entries, receivable and payable balances, and the Profit & Loss and Balance Sheet reports for the period you request. Intuit's accounting permission technically also permits writing, but this software only issues read requests: it does not create, change or delete anything in your books.
• Authorisation tokens: the access and refresh tokens issued by Intuit when you connect, stored in an encrypted, signed cookie marked HTTP-only, which means scripts running on the page cannot read it. The cookie is still sent by your browser with requests to this service, and anyone with access to your device or browser profile may be able to reach it.
• Device, request and error information: ordinary technical details of requests, such as timestamps, requested addresses, status codes and browser-reported information. Our own diagnostic logging for the QuickBooks connection is deliberately limited to a fault category, the HTTP status code, the endpoint that was called and Intuit's request reference; it does not write accounting records, request or response bodies, authorisation tokens or credentials into logs. We cannot rule out that the platforms hosting the service record additional request-level detail under their own operational logging, which we do not control.

2. Why we handle it

To build and display your financial model, to answer your questions and support you, to keep the service secure and detect misuse, to record your acceptance of these documents, and to fix defects. We do not sell your information, and we do not use it for advertising or profiling. Those two statements are about our own practices only; they are not a statement about what our providers do inside their own platforms.

3. Where information is kept in your browser

Your working model — connected sources, discovered facts, your answers, corrections and explanations — is saved in your browser's local storage under keys specific to your account, so one signed-in account's work is not shown to another. Signing out asks you to confirm, warns that answers and corrections kept only in this browser will be removed, offers a one-click backup file first, and then clears that account's working data; the private workspace offers the same clear-and-backup control on demand. Cleared work stays cleared after a reload. If you download a backup file, it is your copy on your device and we neither hold it nor can remove it for you.

Your sign-in session is held by the authentication library in your browser's local storage, not in a cookie we set. When the app is opened inside the development platform's preview frame, that session is instead brokered to the platform editor so the preview surfaces share one sign-in. If you connect QuickBooks Online, two cookies are set by this service: an encrypted cookie holding the connection and its tokens, and a short-lived one-time cookie used to protect the authorisation handshake (it lasts ten minutes; the connection cookie lasts up to 100 days unless you disconnect sooner). We set no advertising or cross-site tracking cookies, and our application code contains no analytics, tracking or measurement scripts. Our hosting and development platform may record its own request-level or product measurement data; we do not control that and do not claim otherwise here.

4. Assisted interpretation (AI)

When you use the “explain this” feature, the text of your message, the relevant question, the included conversation history for that question, and the facts needed for context are sent through the Lovable AI gateway to a model provider (currently an OpenAI model) to propose a structured interpretation. Any figure in a proposal is taken from the digits you actually wrote in your own message, and a proposal is recorded only after you confirm it. This is a safeguard in the software, not a guarantee of correctness: assisted interpretation can misread what you meant, and you should read each proposal before confirming it.

We have not independently verified the gateway's or the model provider's retention periods, training practices for content sent through the gateway, or the regions where that processing happens. We therefore make no claim that your content is excluded from all third-party training, retained for zero time, or processed only in the United States. If that matters to you, keep sensitive details out of those messages until we can confirm and publish those terms.

5. Service providers and where processing happens

The providers we can identify from how this service is actually built and configured are: Lovable, which provides the application hosting and the AI gateway; Supabase-backed authentication, database and serverless execution, which our configuration evidences as the backend (whether our contract for it is directly with Supabase or through the platform is something we are still confirming, and it does not change what is processed); the OpenAI model reached through the gateway; and Intuit, for the QuickBooks Online connection you authorise. We do not restate their own policies as if they were ours.

These providers operate internationally. Your information, including business figures you enter or import, may be processed and stored outside your state and outside your country, including in the United States. We have not independently verified the specific hosting region for each component, so we do not claim single-region processing.

We may also disclose information where required by law, to respond to lawful requests, to enforce our terms, or to protect rights, safety and the security of the service. We do not sell personal information.

6. Disconnecting is not deleting

Disconnecting QuickBooks Online clears the stored tokens, stops any further reading of your books, and attempts to revoke the authorisation at Intuit. That revocation depends on Intuit's service, so we cannot guarantee it succeeds; the local tokens are cleared either way, and you can also remove the app's access from your Intuit account. It does not by itself erase figures already imported into your working model. Clearing local working data removes the model cached in your browser but does not affect your QuickBooks records or your accepted-terms record.

7. Your controls and requests

You can view and correct the information in your workspace directly, disconnect QuickBooks Online at any time, clear locally stored working data (with a backup file offered first), and sign out. To request access to, correction of, or deletion of information we hold, email josh@bradleysecurity.com from the address you sign in with. We will verify that the request comes from you and that you are authorised to make it for the business before acting on it, and we will tell you what we removed, what we could not remove, and why.

What a deletion request covers and what limits it: we can remove your sign-in account and your terms-acceptance record, and we can end the QuickBooks authorisation. Working data held only in your browser is removed by you, using the clear control or your browser's settings; a backup file you downloaded is on your own device. Copies held inside our providers' systems — operational logs, security logs and routine backups — are removed on those providers' own cycles or by request to them, so removal there is not immediate and is not fully within our control. We may also keep the minimum needed to meet a legal obligation or to resolve a dispute. This is a manual, staff-operated process today: we have not yet exercised it end-to-end against a real account, so we do not promise a completion deadline.

8. Retention

We keep information for as long as it is needed for the purpose it was collected for, and then no longer. In practice that means: working data stays in your browser until you clear it, sign out, clear site data, or the browser removes it; your account and terms-acceptance records are kept while your access to the evaluation exists and until a deletion request is carried out; QuickBooks tokens are held in the encrypted cookie until you disconnect or the cookie expires (up to 100 days); and the one-time handshake cookie expires after ten minutes. We do not state fixed day counts we cannot enforce, and our providers keep their own operational, backup and security records on their own schedules, which we do not control.

9. Adults and business use

VizVantage is for business use by adults. It is not directed to children and we do not knowingly collect information from them.

10. Changes and contact

If this notice changes materially, we will present the updated version for acceptance before continued use of the private workspace. Questions: josh@bradleysecurity.com. VizVantage LLC may also be reached by mail at VizVantage LLC, PO Box 484, Hutchinson, MN 55350. See also the End User Licence Agreement.