Privacy Policy
Effective July 23, 2026
This policy explains how Collateral Base, LLC handles information through CB OS and Roll It Up, including the Turn & Pay connection to QuickBooks Online.
Information we handle
- Account, contact, store, and organization identifiers needed to provide and secure the service.
- QuickBooks company identity, bank-ledger account names and balances, and normalized financial-report rows and totals from profit and loss, balance sheet, cash flow, and accounts-payable aging reports.
- OAuth connection metadata and access credentials. OAuth tokens are encrypted at rest and are never displayed in Turn & Pay.
- Operational and security records such as connection status, sync timestamps, errors, and the identity of the authorized operator.
The QuickBooks connector does not retain raw provider responses, bank-login credentials, payment-card data, vendor banking instructions, or customer contact records. It does not import transaction memos.
How we use information
We use the information to show source-backed cash and accounting freshness, support payment planning, reconcile financial snapshots, maintain an audit trail, secure the service, and troubleshoot authorized connections. CB OS does not sell personal or QuickBooks data. We do not use connected QuickBooks data for advertising.
QuickBooks access
Intuit's accounting permission is technically broad, but this CB OS connector is implemented as read-only for company accounting data. Its provider adapter exposes only GET requests for company information, bank-ledger accounts, and supported reports. OAuth exchange, refresh, and revocation use the provider's authorization endpoints.
Sharing and service providers
We disclose information only to authorized users of the applicable store, when required by law, or to service providers that help operate the service. Current infrastructure may include Intuit for QuickBooks authorization and data, Vercel for application hosting, and Supabase for managed PostgreSQL infrastructure. These providers process information under their own terms and privacy obligations.
Security, retention, and deletion
We use encrypted credentials, tenant-scoped access controls, role checks, and audit records. No system can guarantee absolute security. Disconnecting QuickBooks revokes the provider token and replaces stored token material with a revocation marker. Normalized financial snapshots may remain as an operating and audit record until they are no longer needed or an authorized deletion request is completed, subject to legal and recordkeeping obligations.
Your choices
An authorized owner can disconnect QuickBooks from Turn & Pay. To request access, correction, or deletion of information, email tom@collateralbase.com. We will verify that the requester is authorized for the applicable organization before acting.
Regulated industry notice
CB OS supports licensed cannabis-retail operations. QuickBooks data is used for business operations and financial analysis; it is not used to sell cannabis or process a cannabis transaction.
Changes and contact
We may update this policy as the service changes. The effective date above identifies the current version. Questions may be sent to tom@collateralbase.com.