This policy describes how ROOTS, the Company's internal accounting and operations system (the "Application"), handles data when it connects to QuickBooks Online. ROOTS is operated by 0924 Investments LLC (the "Company") for LeafSpring Schools and is available at roots.leafspringky.com. This page is hosted on Canopy, LeafSpring's operations platform at canopy.leafspringky.com. Canopy and ROOTS are both operated by 0924 Investments LLC for internal use only. The Application is a private application used only by the Company's own staff. It has no public users and does not collect information from the public.
The Application connects to the Company's own QuickBooks Online account using OAuth 2.0 authorization granted by a Company administrator. It requests the Intuit scope com.intuit.quickbooks.accounting, which allows both reading and writing. The Application reads the Company's own accounting records, such as sales receipts, refund receipts, credit memos, and account information, through Intuit's authorized API.
The Application also creates journal entries in QuickBooks Online. It does so only after internal approval: an accountant reviews each entry and a person then releases it. The Application does not delete QuickBooks data.
Retrieved data is used exclusively for the Company's internal business reporting, reconciliation and bookkeeping. It is not used for advertising, profiling, resale, or any purpose unrelated to the Company's own operations. No generative AI processes QuickBooks data in the Application.
The Application also receives data from two other platforms the Company uses. Payroll data comes from Gusto, through Dataddo and through file export. Tuition billing data comes from Playground, through Canopy.
Data retrieved by the Application is stored in the Company's internal, access-controlled systems. OAuth credentials and tokens are encrypted at rest and are never embedded in client-side code or exposed in logs. Access to the Application and its data is limited to authorized Company personnel. Signing in to ROOTS requires multi-factor authentication.
The Company does not sell, rent, or share data retrieved through the Application with any third party. Because the data belongs to the Company itself, no third-party disclosure occurs in the ordinary operation of the Application.
Data is retained in accordance with the Company's internal records retention practices and applicable legal requirements, and is deleted or archived when no longer needed for those purposes.
A Company administrator may revoke the Application's access to QuickBooks Online at any time through Intuit's connected-app settings or by disconnecting within the Application at roots.leafspringky.com/qbo/disconnect. When the Application is disconnected, its stored OAuth tokens are deleted and it can retrieve no further data.
The Company may update this policy as the Application evolves. The effective date above reflects the current version.
Questions regarding this policy: privacy@leafspringky.com.