InvoHub Privacy Policy
Effective date: 29 October 2026
1. Who we are
InvoHub and its products, including InvoHub Connect for QuickBooks, are operated under the InvoHub brand by #ONE LAST MINUTE s.r.o. ("InvoHub", "we", "us"), the controller of the personal data described in this Policy. Our company details are set out in section 14. For all data protection matters, contact us at [email protected]. We have not appointed a data protection officer, as we are not required to do so under Article 37 of the GDPR.
2. Scope of this Policy
This Policy is common to all InvoHub products. It explains how we process personal data in connection with the website invohub.app, including its contact, feedback and beta sign-up forms, and with InvoHub Connect, currently InvoHub Connect for QuickBooks (each and together, the "Connector"), including its pages at my.invohub.app and mcp.invohub.app. When we launch another InvoHub product, we will add it to this Policy. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"). Each InvoHub product has its own terms of service. Capitalised terms not defined in this Policy have the meaning given in the InvoHub Connect Terms of Service at https://invohub.app/legal/connect/terms (the "Terms").
The Connector uses only a strictly necessary session cookie to keep you signed in. Neither the Connector nor invohub.app uses advertising or analytics cookies or other tracking technologies.
3. Our role
Controller. We act as controller for the personal data of users of our products and of persons who contact us, send us feedback or sign up for the closed beta: account, sign-in, communication, form, usage and security data (section 4).
Processor. Accounting Data in Connected Companies may contain personal data, for example names and contact details of customers, suppliers or employees. We process Accounting Data only on behalf of, and on the documented instructions of, the business that uses the Connector, which acts as controller. Where an accountant or bookkeeper uses the Connector for its client, it acts as processor for that client and we act as its sub-processor. Our obligations as processor are set out in the Data Processing Terms in Annex 1 to the Terms. Questions about such personal data should be addressed to the business concerned, and we will assist it as required by the GDPR.
Independent controllers. Intuit Inc., as the provider of QuickBooks Online, and the provider of each AI Service you connect process personal data under their own terms and privacy notices.
4. Data we process as controller
We process only the data needed to operate our website and products. We do not store Accounting Data.
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Name and email address of the person signing in; Intuit account identifier | Providing your account and the Connector; service communications | Contract, Art. 6(1)(b) | While your account is active, then 12 months to deal with any claims |
| Identifiers and names of Connected Companies; selected access level | Routing your requests to the right company; enforcing access levels | Contract, Art. 6(1)(b) | While the company is connected |
| QuickBooks authorisation credentials (access and refresh tokens), encrypted | Accessing QuickBooks Online on your behalf | Contract, Art. 6(1)(b) | While the company is connected; deleted when the company is disconnected in InvoHub, or promptly after we become aware that it was disconnected in QuickBooks Online |
| Sign-in data of your AI Service: client registration, authorisation codes and access and refresh tokens, stored only as hashes or in encrypted form | Allowing the AI Service you connect to act on your account | Contract, Art. 6(1)(b) | Until the tokens expire or are revoked; then deleted by a daily clean-up |
| Write-operation log (time, company, operation type, record reference), kept only for companies with Read-write access | Support, incident investigation, showing what was changed | Legitimate interests, Art. 6(1)(f) | 24 months |
| Usage, security and diagnostic records, without Accounting Data content | Operating and securing the Connector; preventing misuse; measuring service quality | Legitimate interests, Art. 6(1)(f) | 90 days, or longer only where needed to investigate a specific security incident |
| Contact, feedback and closed-beta sign-up forms on invohub.app: name, email address and your message | Responding to your enquiry or feedback; inviting you to the closed beta | Legitimate interests, Art. 6(1)(f), or steps at your request before entering into a contract, Art. 6(1)(b) | Up to 12 months after your enquiry is closed or, for beta sign-ups, after the closed beta ends |
| Marketing preferences and records of your consent | Sending information about other InvoHub products and services | Consent, Art. 6(1)(a) | Until you withdraw consent; records of consent and withdrawal for up to 3 years thereafter |
| Encrypted backups of our database (the data above, without Accounting Data) | Restoring the Connector after a failure | Legitimate interests, Art. 6(1)(f) | 30 days; data deleted from the live database remains in backups until they expire |
Where you use the Connector on behalf of an organisation, the contract is with that organisation. In that case, we process your personal data as its representative on the basis of our legitimate interest in performing that contract (Art. 6(1)(f)). Our legitimate interests are providing a secure and reliable service, supporting users, preventing misuse, and establishing, exercising or defending legal claims.
5. Sources of data and whether you must provide it
We receive your name, email address and Intuit account identifier from Intuit when you sign in with Intuit or connect a company, and the authorisation data of your AI Service from that service when you connect it. We collect other data from you, or generate it when you use the Connector.
Providing the data processed on the basis of Art. 6(1)(b) is necessary to use the Connector; without it, we cannot provide the service. Using the forms on invohub.app and consenting to marketing are voluntary. We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects for you.
6. Service messages and marketing
We use your email address to send you service messages: notices about availability, security and changes to the Connector, and updates to the Terms and this Policy. These messages are part of the service and are not advertising. We send marketing about other InvoHub products or services only if you have agreed to receive it. You can withdraw your consent at any time using the link in each message or by writing to [email protected].
7. Who receives your data
Hosting: DigitalOcean, LLC, as our processor, hosts the Connector and the website invohub.app, including its forms, with servers and encrypted backup storage (DigitalOcean Spaces) in Frankfurt, Germany (European Union). Requests to the website, including form submissions, pass through the content delivery network that DigitalOcean uses for the website, currently operated by its sub-processor Cloudflare, Inc., and may be handled at network locations outside the European Union before they reach our servers.
Email: Mailgun (Sinch), as our processor, using its European Union region (Germany), which delivers emails sent from our website and the Connector, including messages from the website forms, and keeps the closed-beta sign-up list; and our email hosting provider for the mailbox [email protected], for messages you send us and service notices we send you.
Intuit: we exchange data with Intuit Inc. to authenticate you and to carry out your requests in QuickBooks Online.
AI Services: Accounting Data and other content you request is transmitted to the AI Service you choose, at your direction. Its provider processes that data under its own terms and privacy notice.
Authorities, courts and professional advisers: where required by law, or where needed to establish, exercise or defend legal claims.
Successors: a buyer or successor in the event of a merger, acquisition or transfer of our business, which will continue to be bound by this Policy.
We do not sell personal data, and we do not use Accounting Data for advertising, profiling or training AI models.
8. Transfers outside the EEA
The servers of the Connector and of the website invohub.app are located in the European Union. Requests to the website may be handled at locations of DigitalOcean's content delivery network outside the European Economic Area (section 7). Some of our service providers and their sub-processors, including DigitalOcean, Cloudflare and Mailgun, are established in the United States or have group companies there and may access personal data from outside the European Economic Area, for example for support or security purposes. Such transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, or otherwise on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 and included in the provider's data processing agreement.
Transfers to an AI Service are made at your direction. Where we act as processor, they are made on the instructions of the business using the Connector, which is responsible for assessing them.
9. Security
QuickBooks authorisation credentials are encrypted at rest (AES-256-GCM), and the encryption key is kept separately from the database. Sign-in tokens of AI Services are stored only as hashes or in encrypted form. Backups are encrypted before they leave our server. All connections are encrypted in transit. Access to production systems is limited to personnel who need it for their role. Access to our hosting account requires multi-factor authentication, and our servers accept SSH keys only, with password login disabled. The access level of each Connected Company is enforced on our servers, and Accounting Data is not stored.
No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the supervisory authority and the persons affected where the GDPR requires us to do so.
10. Your rights
Under the GDPR, you have the right to access your personal data, to have it rectified or erased, to restrict its processing and, where processing is based on contract or consent and carried out by automated means, to receive it in a portable format.
You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. You may object at any time to processing for direct marketing, and we will then stop that processing. Where processing is based on your consent, you may withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal.
To exercise your rights, write to [email protected]. We may ask for information needed to verify your identity. We respond without undue delay and in any event within one month. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months, and we will inform you of the extension within the first month. Requests concerning personal data contained in Accounting Data are handled together with the business that acts as controller.
You may lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz) or with the supervisory authority of the EU or EEA member state where you live or work or where the alleged infringement took place.
11. International use
The Connector may be used from any country where QuickBooks Online and the AI Services are available. We process personal data in accordance with the GDPR and, to the extent they apply to our processing, with other applicable data protection laws, such as the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
12. Business use
Our website and products are intended for business use and are not directed at individuals under 18. We do not knowingly collect personal data of individuals under 18.
13. Changes to this Policy
We may update this Policy by publishing a new version with its effective date. We will notify you of material changes in advance by email or in the product.
14. Company details and contact
InvoHub is operated by #ONE LAST MINUTE s.r.o., a limited liability company incorporated in the Czech Republic, ID No. (IČO) 09286837, with its registered office at Jílovišťská 790, 155 31 Praha 5 – Lipence, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, file No. C 333886. Email: [email protected].