Privacy Policy

1 Introduction & Scope

This Privacy Policy describes how IRD Invoice ("we", "us", or "our") collects, protects, uses, and discloses information obtained through our integration with QuickBooks Online and our web application services.

This policy applies specifically to all users who link their QuickBooks Online accounts, create administrator accounts, or utilize our invoice generation services. By connecting to or using the application, you agree to the collection and handling of information in accordance with this Privacy Policy.

2 Information We Collect

To provide our tax invoice generation services, we process the following categories of data:

3 How We Use Your Information

We process the information collected strictly for the following legitimate purposes:

• Generating IRD Tax Invoices: Reading invoice records from your QuickBooks Online tenant and formatting them into the official Sri Lanka Inland Revenue Department (IRD) Tax Invoice layout;
• Automating Tax Calculations: Accurately calculating Sri Lanka Value Added Tax (VAT) at the statutory 18% rate (or custom tax exemptions) and generating total invoice amounts in figures and words;
• Rendering PDF Downloads: Creating print-ready, high-resolution PDF tax invoices for your commercial distribution and local tax documentation;
• Maintaining Authenticated Sessions: Managing your secure login state and active QuickBooks Online connection session;
• Compliance & Security: Detecting, preventing, and addressing technical errors, API rate limit issues, or unauthorized security incidents.

4 Intuit Developer Terms & Data Protection Compliance

In adherence to Intuit's developer standards, we explicitly commit to the following:

• NO Sale of Data: We will never sell, rent, lease, barter, or transfer any data retrieved from QuickBooks to third parties, data brokers, or advertising networks for any reason.
• NO Unauthorized Profiling: We will not use QuickBooks user data to build consumer profiles, display targeted third-party advertising, or conduct unauthorized tracking.
• NO Unapproved AI Model Training: We will not use your private financial invoices or proprietary business records to train generalized machine learning or artificial intelligence models.
• Minimal Access Principle: We only request the minimum API permissions required to read invoices and company names for generating your IRD tax documents.

5 Data Sharing & Third-Party Disclosures

We do not disclose your personal or financial data to outside third parties, except in the following limited and necessary situations:

• Intuit Inc.: During OAuth 2.0 authorization handshakes and API queries to fetch your company's invoice records from Intuit's servers;
• Cloud Infrastructure Providers: Highly secure cloud server infrastructure and hosting providers operating under strict confidentiality and data protection obligations;
• Legal & Regulatory Compliance: If required to do so by applicable law, lawful judicial subpoena, or official directive from Sri Lankan law enforcement or regulatory authorities.

6 Data Security & Storage Practices

We implement comprehensive technical, administrative, and physical safeguards to ensure the confidentiality, integrity, and security of your financial and personal data:

• Encryption in Transit: All data transmitted between your browser, our application, and Intuit's QuickBooks APIs is encrypted using industry-standard Transport Layer Security (TLS 1.2 / TLS 1.3 with 256-bit encryption);
• Session Security: Application session cookies are configured with strict security flags, randomized cryptographic secrets, and explicit expiration timers;
• Credential Hashing: Administrative passwords are saved using industry-standard bcrypt cryptographic hashing (work factor 10) with unique salt generation;
• Zero Permanent Financial Storage: We do not store full copies of your historical invoice transaction database on our servers; invoice data is fetched on-demand from QuickBooks when requested by your active session.

7 Data Retention & Deletion Policy

We retain your personal and integration data only for as long as necessary to fulfill the operational purposes described in this Privacy Policy:

• QuickBooks Session Data: Temporary invoice caches and active OAuth tokens are maintained only for the duration of your authorized session;
• Instant Session Destruction: When you click the "Disconnect" button or log out, your active session and cached tokens are immediately purged;
• Complete Data Purge Request: You may request permanent deletion of your account metadata and administrative access at any time by emailing us at sandeepa@onestep.lk. We will process and fulfill verified deletion requests within fourteen (14) business days.

8 Your Rights & Disconnection Controls

You have full control over your data and integration rights:

• Revoke QuickBooks Access: You can disconnect the integration at any moment via the "Disconnect" button in the app header, or directly through your Intuit Account dashboard at accounts.intuit.com under Connected Apps.
• Access & Correction: You have the right to request information regarding any personal data we hold about you and request corrections if inaccurate;
• Data Portability: All invoices can be generated and exported immediately in standard PDF format;
• Withdrawal of Consent: You may withdraw your consent for future data processing at any time by ceasing application use and revoking integration tokens.

9 Cookies & Local Storage

Our web application uses essential first-party cookies and browser local storage strictly for security, session persistence, and UI state:

• Session Cookie (connect.sid): A secure HTTP-only cookie used to maintain your authenticated connection status between requests;
• Local Storage (auth_token): Used to store temporary administrative JSON Web Tokens (JWT) for admin portal actions.

We do not use third-party advertising cookies, marketing pixels, or analytics trackers.

10 Children's Privacy

Our application is designed exclusively for commercial business entities, accountants, and enterprises. We do not knowingly collect or solicit any personal information from individuals under the age of 18. If we learn that we have inadvertently collected information from a minor, we will promptly delete it.

11 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations, regulatory guidance from the Sri Lanka Inland Revenue Department, or Intuit Developer Program requirements.

When changes are made, we will update the "Effective Date" at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12 Data Protection Contact Information

If you have questions, feedback, or concerns regarding this Privacy Policy, or if you wish to exercise your data deletion or privacy rights, please contact our designated privacy desk: