1. Introduction

Paprika Partners LLC ("Paprika Partners," "we," "us," or "our") is a boutique accounting and financial operations firm providing bookkeeping, accounting, and advisory services. We are committed to handling personal information responsibly.

This Privacy Policy has two parts:

• Part A: Website Visitors explains what we collect when you visit our website (paprikapartners.co) or contact us through it.

• Part B: Clients and Our Applications explains how we handle client data through the software applications and integrations we build and operate, including applications that connect to QuickBooks Online and Xero (the "Applications").

Sections 3 through 12 apply to both parts. Use of the Applications is also governed by our End User License Agreement at [paprikapartners.co/terms].

Part A: Website Visitors

A1. Information We Collect

Information You Provide

When you complete the contact form on our website, we may collect:

• Your name

• Your email address

• Your phone number (if provided)

• Your company or organization name (if provided)

• Any message or inquiry content you choose to submit

We do not collect payment information, Social Security numbers, or other sensitive financial data through our website.

Information Collected Automatically

When you visit our website, certain technical information is collected automatically through Google Analytics and standard web server logs. This may include:

• Your IP address (anonymized where required by applicable law)

• Browser type and version

• Operating system

• Pages visited and time spent on each page

• Referring website or source

• General geographic location (country or city level)

This information is collected via cookies and similar tracking technologies. See Section A3 for more detail.

A2. How We Use Website Information

• To respond to your inquiries and contact form submissions

• To communicate with you about our services

• To understand how visitors use our website and improve the user experience

• To analyze aggregate traffic patterns and referral sources via Google Analytics

• To comply with applicable legal obligations

• 
  

We do not use website visitor information for automated decision-making or profiling.

A3. Cookies and Tracking Technologies

Our website uses cookies to improve your browsing experience and to collect analytics data. Cookies are small text files stored on your device when you visit a website.

Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC. Google Analytics uses cookies to help us analyze how visitors use the site. The information generated (including your IP address) is transmitted to and stored by Google on servers in the United States. Google may use this information to evaluate your use of our site and to compile reports on website activity.

You can opt out of Google Analytics tracking by:

• Installing the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

• Adjusting your browser settings to refuse cookies

• Using our cookie consent mechanism (where present on the site)

For more information on how Google processes this data, see Google's Privacy Policy at https://policies.google.com/privacy.

Essential Cookies

Some cookies are necessary for the website to function properly. These cookies do not collect personal information and cannot be disabled.

A4. Website Data Retention

• Contact form submissions are retained for as long as is reasonably necessary to respond to your inquiry and for general business record-keeping purposes.

• Google Analytics data is retained in accordance with our configured retention settings (default: 26 months).

Part B: Clients and Our Applications

B1. Who This Part Covers

Our Applications are available only to clients who have engaged Paprika Partners under a written agreement, such as a letter of intent, engagement letter or services agreement (an "Engagement Agreement"). They are not offered to the general public.

When we process client data through the Applications, we act on the client's behalf and under its instructions, as described in the Engagement Agreement. The client remains responsible for its own obligations to the individuals whose information is stored in its systems, such as its customers, vendors, and employees. If this Part B conflicts with a client's Engagement Agreement, the Engagement Agreement controls.

B2. Information We Access Through the Applications

When a client connects a QuickBooks Online company or another business system to our Applications, we may access and process:

• Company information: business name, address, contact details, and account settings.

• Accounting data: chart of accounts, transactions, invoices, bills, payments, journal entries, products and services, and financial reports (such as profit and loss, balance sheet, and aging reports).

• Contact records: names, email addresses, phone numbers, and addresses of the client's customers, vendors, and employees, as stored in QuickBooks Online or other connected tools.

• Connection data: OAuth authorization tokens and QuickBooks company identifiers needed to maintain the connection. We never receive or store your Intuit login password.

• Data from other connected tools: records from systems such as Airtable that are used to create or update records in QuickBooks Online (for example, invoice details).

We access only the data needed to provide the Applications and our services to the client.

B3. How We Use Client Data

We use client data only to serve the client that connected it, including to:

• Provide bookkeeping, accounting, reporting, and advisory services under the Engagement Agreement

• Sync data between QuickBooks Online and other tools used in the engagement, including creating or updating invoices and other records

• Generate reports, summaries, dashboards, alerts, and notifications for the client and our team

• Maintain, secure, and troubleshoot the Applications

• Comply with legal and professional obligations

We do not sell client data, use it for advertising or marketing to anyone other than the client, or combine it with other clients' data for our own purposes.

Use of AI Tools

Some Applications use AI services, such as Anthropic's Claude, to help summarize, categorize, or analyze client data as part of our work. We use these services under commercial terms that do not permit the provider to use our data to train its models. Our team reviews AI-assisted output, and it is not used to make automated decisions that have legal or similarly significant effects on individuals.

B4. Service Providers for the Applications

We share client data only with service providers that help us run the Applications, and only the data each one needs to perform its function:

• Intuit (QuickBooks Online): accounting platform the Applications connect to

• Airtable: data management and workflow

• Slack: team communication and notifications

• Anthropic: AI processing

• [Hosting provider, e.g., AWS / Vercel / Render]: hosting and running the Applications

Each provider handles data under its own terms and privacy commitments.

B5. Client Data Retention and Disconnecting

• We keep data accessed through the Applications only while the connection is active and as needed to provide our services.

• Clients can disconnect an Application at any time from QuickBooks Online (Settings > Apps / Connected apps) or by emailing admin@paprikapartners.co. Disconnecting stops further data access but does not undo records the Application already created or changed in QuickBooks Online.

• After a client disconnects an Application or the engagement ends, we stop accessing that client's QuickBooks Online data and delete or de-identify stored Application data within [90] days, unless we must keep it longer for legal, tax, or professional record-keeping obligations, or the client asks us to keep it.

• Clients may request deletion of stored data at any time.

B6. Requests From Individuals in Client Records

If you are a customer, vendor, or employee of one of our clients and have a question or request about your information, please contact that business directly. If you contact us instead, we will forward your request to the client, or respond as the client instructs, as permitted by law.

Sections Applying to Both Parts

1. Legal Basis for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Legitimate interests: Responding to inquiries, improving our website, and analyzing usage patterns.

• Contract: Performing our Engagement Agreement with a client, including operating the Applications.

• Consent: Where you have explicitly consented to the use of cookies for analytics purposes.

• Legal obligation: Where processing is required to comply with applicable law.

You may withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal.

2. How We Share Information

We do not sell, rent, or trade personal information. Beyond the service providers described in Sections A3 and B4, we may share information only in these limited circumstances:

• Legal requirements: If required by law, court order, or governmental authority.

• Business transfers: If Paprika Partners is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to the same protections described in this policy.

Where we share data with international third parties, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office, as applicable.

3. Your Rights

Depending on your location, you may have certain rights regarding your personal information. For information we process on a client's behalf (Part B), please see Section B6.

EEA, UK, and Swiss Residents (GDPR / UK GDPR)

• Access: Request a copy of the personal data we hold about you.

• Rectification: Request correction of inaccurate or incomplete data.

• Erasure: Request deletion of your personal data.

• Restriction: Request that we limit how we use your data.

• Portability: Receive your data in a structured, machine-readable format.

• Objection: Object to processing based on legitimate interests.

• Complaint: Contact your local supervisory authority (for example, the ICO in the UK or your EU data protection authority).

California Residents (CCPA / CPRA)

• Know what personal information we collect, use, share, or sell.

• Request deletion of personal information we hold about you.

• Request correction of inaccurate personal information.

• Opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising).

• Non-discrimination for exercising your privacy rights.

Australian Residents

Australian residents have rights under the Privacy Act 1988 and the Australian Privacy Principles, including the right to access and correct personal information we hold about you, and to complain to the Office of the Australian Information Commissioner (OAIC).

To exercise any of these rights, contact us at admin@paprikapartners.co. We will respond to verifiable requests within the timeframes required by law (generally 30 days, or up to 45 days where permitted with notice).

4. International Data Transfers

Paprika Partners is based in the United States. If you are outside the United States, information you provide may be transferred to and processed in the United States. We take steps to ensure appropriate safeguards are in place for such transfers, in accordance with applicable data protection laws.

5. Children's Privacy

Our website and Applications are not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

6. Security

We take reasonable technical and organizational measures to protect personal and financial information from unauthorized access, disclosure, alteration, or destruction. These include encrypting data in transit (TLS/HTTPS), storing authorization tokens securely [and encrypted at rest], limiting access to staff who need it, and using multi-factor authentication on the systems we use to run the Applications.

If we become aware of a security incident affecting your information, we will notify affected clients and individuals as required by law. No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

7. Third-Party Links and Services

Our website may contain links to third-party websites, and our Applications connect to third-party services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. If changes materially affect how we handle client data, we will make reasonable efforts to notify affected clients. Continued use of our website or Applications after any changes means you accept the revised policy.

9. Contact Us

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have a concern about how we handle personal information, please contact us:

Email: admin@paprikapartners.co

paprikapartners.co

217 Diamond Oaks Rd. Roseville, CA 95678

We aim to respond to all privacy-related inquiries within 30 days.