Privacy Policy

The App only reads data from accounts that an authorized Apex Brewery administrator has connected:

• QuickBooks Online (via Intuit's API, with the accounting scope): invoices, including invoice number, date, customer name, line items, quantities, amounts, discounts and tax, and the company name of the connected QuickBooks company.
• GoTab: accounting ledger entries (amounts, business day, item and account names, tab identifiers), fiscal-day status and location names.
• Breww: sales order data (order number, date and value, and, where configured, customer, location and tax).
• Mug Club sheet: a spreadsheet Apex Brewery publishes as CSV, containing only the date, amount and membership tier of each Mug Club sale (no member names or contact details).
• Contract brewing sheet: a spreadsheet Apex Brewery publishes as CSV, containing the date, amount and client business name of each contract brewing sale.

Some of this business data can include the names of customers or other businesses. The App does not request or store payment card numbers, bank account details, passwords or government identifiers.

The data is used only to produce sales reports for Apex Brewery: totals, comparisons with earlier periods, charts, rankings of products and customers, and CSV exports requested by staff. We do not use it for advertising, we do not sell it, and we do not use it to build profiles of individuals.

• Sales data is fetched on demand and held in the App's server cache for a limited time (minutes for recent data; up to a few days for completed past periods) to stay within the providers' rate limits. It is not copied into a separate database.
• Connection credentials: API keys are kept in the server's environment configuration. The QuickBooks OAuth access and refresh tokens are stored on the App's server, readable only by the App, until QuickBooks is disconnected or the tokens expire.
• CSV exports are generated when a staff member requests them and are downloaded to that person's device; the App keeps no copy.

The App uses only strictly necessary cookies: a sign-in session cookie that keeps authorized staff logged in (it expires after a few days or when they sign out), and a short-lived cookie while connecting QuickBooks or GoTab that protects that flow against forgery (it expires after 10 minutes or when the connection completes). The App uses no analytics, advertising or tracking cookies.

We do not sell, rent or share data obtained through the App with third parties. Data is exchanged only with the services it comes from (Intuit, GoTab and Breww) in order to read it, and with our hosting provider, which runs the App's servers on our behalf. We may disclose information if required by law.

All requests to QuickBooks, GoTab and Breww are made from the App's server over encrypted connections (HTTPS); API keys and tokens are never sent to web browsers. Access to the App requires signing in with an account issued to Apex Brewery personnel; passwords are stored only as salted one-way hashes. No system is perfectly secure, but we take reasonable measures to protect the data the App handles.

• An administrator can disconnect QuickBooks at any time from the App's QuickBooks settings page, which revokes the App's access at Intuit and deletes the stored tokens. Access can also be revoked from the QuickBooks Online account settings (Apps).
• GoTab and Breww access can be revoked by removing or rotating the API credentials with those providers.
• Customers or other individuals whose information appears in Apex Brewery's sales records can contact us to ask about it; we will respond in line with applicable law.

We may update this policy as the App changes. The effective date at the top shows when it was last revised.