Privacy Policy

JobShopFlow (operated by Powers Bros) · Effective June 26, 2026

JobShopFlow is a private, internal business management system (ERP) used by a single company and its employees. This policy explains what data the application handles, including data accessed through its integration with QuickBooks Online (Intuit), and how that data is protected.

Who this applies to

JobShopFlow is not a public product and is not offered to the general public. It is used only by authorized employees of the company that operates it. There is no public sign-up.

Information we handle

• Business records created by employees in the ERP (customers, estimates, sales orders, invoices, vendors, purchase orders, and related notes).
• QuickBooks Online data accessed via Intuit's official API: customer, item, and tax-code records (read, to map them to ERP records) and invoices (created or updated in the connected QuickBooks company).
• Connection credentials: OAuth access and refresh tokens, and the QuickBooks company identifier (realm ID), for the connected QuickBooks company.
• Account and access data: employee login accounts and session information.

How we use QuickBooks (Intuit) data

QuickBooks data is used solely to keep the company's own ERP and its own QuickBooks Online account in sync — primarily to export invoices created in the ERP into QuickBooks and to match customer, item, and tax records between the two systems. QuickBooks remains the system of record for accounting. We store the QuickBooks identifiers (including the company's realm ID), sync status, and mapping information needed to link ERP records with their QuickBooks counterparts, and we do not use QuickBooks data for unrelated purposes. Business records created in the ERP may contain customer, item, invoice, tax, and other accounting-related information needed for normal business operations.

How data is protected

• All traffic is encrypted in transit using HTTPS/TLS, including all communication with Intuit's APIs.
• OAuth access and refresh tokens are encrypted at rest using AES-256-GCM, with the encryption key stored separately from the database, and are never exposed to users.
• Session cookies are restricted to HTTPS and marked HTTPOnly and SameSite, so they are not accessible to client-side scripts.
• OAuth tokens, passwords, and QuickBooks financial data are not intentionally written to application logs.
• Data is stored in a managed PostgreSQL database that requires SSL for all connections, with regular automated backups.
• Access requires authentication and is restricted by role; the QuickBooks connection is managed from an administrators-only area of the application.

Data sharing

We do not sell or share QuickBooks or business data with third parties. Data is processed only by the infrastructure providers required to run the application (the hosting provider and an application error-monitoring service). QuickBooks financial data is not sent to the error-monitoring service.

Disconnecting and data removal

An administrator can disconnect the QuickBooks connection at any time from the application's admin area. Disconnecting revokes the token with Intuit and removes the stored connection credentials from the application. Access can also be revoked at any time from within QuickBooks Online. Stored QuickBooks mappings can be deleted on request.

Data retention

Connection tokens are retained only while the QuickBooks connection is active and are removed or invalidated on disconnect. Business records are retained for as long as the company operates the system.

Contact

Questions about this policy can be directed to our support contact at support [at] powersbros [dot] com.