This Privacy Policy explains how Maverix Group (“we”, “us”, “our”) handles
information in connection with the Maverix QBO Connector (the “App”), an
internal integration that connects our QuickBooks Online account to Anthropic’s
Claude assistant for use by our authorized staff.

The App is for internal business use only. It is not offered to the public
or to external customers.

1. Information the App accesses

When connected to our QuickBooks Online company, the App accesses accounting
data through Intuit’s QuickBooks Online Accounting API, including invoices,
estimates, customers, products and services, company information, and financial
reports. The App also receives and stores OAuth 2.0 access and refresh tokens
issued by Intuit to maintain the connection.

The App does not access QuickBooks Payments or Payroll data, and does not
process card or bank payment transactions.

2. How we use the information

Accounting data is used solely to fulfill requests made by our authorized staff
within Claude — for example, retrieving sales reports or creating and updating
invoices. The App does not use the data for advertising, profiling, or resale.

3. Storage and retention

  • OAuth tokens are stored in a Supabase (PostgreSQL) database, restricted to
    service-role access, and are used only to authenticate API requests.
  • An audit log of write actions (create, update, delete) is stored to support
    troubleshooting and accountability. It records the action and a short summary,
    not full financial records.
  • The App does not maintain a persistent copy of QuickBooks financial data;
    such data is retrieved on demand and processed in-session.
  • OAuth tokens are deleted when the connection is revoked or disconnected. Audit
    logs are retained for up to 12 months and then deleted.

4. Service providers and disclosure

We use the following providers strictly to operate the App:

  • Anthropic (Claude): processes data transmitted during a user’s session to
    fulfill that user’s request. Data is not used to train Anthropic’s models.
  • Supabase: secure storage of OAuth tokens and the audit log.
  • DigitalOcean: hosting of the App server.

We do not sell or share QuickBooks data with any other party. Data is accessible
only to our own authorized staff.

5. Security

Data is encrypted in transit (TLS/HTTPS) and at rest (provider-managed
encryption). API credentials are stored as encrypted environment secrets and are
never hardcoded or exposed to the browser. Access to the App is gated by a
high-entropy secret token, and users authenticate through their own
multi-factor-capable Claude accounts.

6. Data location

The App server is hosted in Singapore. Data transmitted to Anthropic is
processed on infrastructure located in the United States.

7. Your choices

Because this is an internal application, access is managed by Maverix Group. To
request information about, or deletion of, data held by the App, contact us
using the details below.

8. Changes

We may update this Privacy Policy from time to time. The “Last updated” date
above reflects the most recent revision.

9. Contact

Maverix Group — itech@maverixgroup.co.th