Privacy Policy

1. Introduction

Bolt Systems, LLC ("we," "us," or "our") operates Quoining (the "Service"), a multi-entity GAAP accounting platform available at quoining.com. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard information when you visit our website, create an account, or use the Service.

The Service is currently offered only in the United States. Our core application hosting and the customer database are in AWS us-east-1 in the United States; some optional integrations Customer enables (listed on the Sub-processors page) may process limited Customer data outside the United States. This policy is designed to align with applicable US consumer-privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), and the Delaware Personal Data Privacy Act ("DPDPA").

By using the Service you acknowledge that you have read this Privacy Policy. If you do not agree with our practices, please discontinue use of the Service.

2. Scope & Applicability

This Privacy Policy applies to:

• Visitors to quoining.com and related marketing pages.
• Individuals who create an account on the Service (“Users”).
• Organization administrators who manage entities, team members, and integrations.
• Third-party individuals whose personal information our customers enter into the Service (such as a customer's vendors, customers, or employees whose information appears in accounting records).

Business-to-business context.Quoining is a B2B platform. When our customers upload or input data about their own vendors, customers, employees, or other individuals into the Service, we act as a service provider/processor on behalf of our customer, who is the business/controller. Our customers are responsible for ensuring they have an appropriate legal basis to provide that data to us and for responding to consumer rights requests under applicable US state privacy laws. This Privacy Policy governs our own data practices; our customers' use of data they process through the Service is governed by their own privacy policies and our Data Processing Agreement.

This policy does not apply to third-party websites, products, or services linked from the Service. Review the privacy policies of any third-party service you access.

3. Definitions

For purposes of this Privacy Policy:

• Personal Information. Information that identifies, relates to, or could reasonably be linked with a particular individual or household, as defined by US state privacy laws. Includes names, email addresses, IP addresses, device identifiers, and financial-account identifiers.
• Sensitive Personal Information. A subset of Personal Information that includes financial-account numbers and tax identification numbers. See Section 16 for our handling of Sensitive Personal Information.
• Processing. Any operation performed on Personal Information.
• Business / Controller. The entity that determines the purposes and means of processing.
• Service Provider / Processor. The entity that processes Personal Information on behalf of the business.
• Sub-processor. A third party that processes Personal Information on behalf of our customers in connection with the Service. The current list is at quoining.com/subprocessors.
• Service. The Quoining accounting platform, including the web app, public API, integrations, and related services.

4. Information We Collect

4.1 Information You Provide Directly

• Account information: Name, email address, password (hashed and salted), company name, job title, and role.
• Entity and corporate information: Legal entity names, business tax-identification numbers (EINs), states of formation, fiscal-year settings, corporate structure, and multi-entity hierarchy.
• Financial data: Chart of accounts, journal entries, bank statements, credit-card transactions, vendor and customer records, invoices, bills, purchase orders, payments, receipts, budgets, forecasts, model settings, generated reports, spreadsheet-export settings, and other accounting data you upload, create, import, process, or export.
• Banking data via Plaid:When you connect a bank account, Plaid transmits account balances, transaction history, and account metadata. Plaid's handling is governed by Plaid's privacy policy.
• Blockchain and cryptocurrency data: Wallet addresses you provide for crypto accounting, and publicly available on-chain transaction data retrieved via the Moralis blockchain API (Ethereum and other supported EVM chains) and the Blockstream API (Bitcoin). When you run a fair-value price refresh, current market prices are retrieved by asset symbol from Moralis or CoinGecko - no wallet or account data is sent for pricing. We never store private keys, seed phrases, or wallet passwords.
• Employee and payroll data via Gusto: When you connect Gusto, we receive payroll-run summaries, employee-level wage breakdowns, tax withholdings, benefit deductions, employer contributions, and net pay amounts. See Section 17 for our handling of payroll data.
• E-commerce data via Shopify: Payout summaries, order data, product information, and inventory details necessary to generate accounting journal entries.
• Expense and corporate-card data via Ramp: Transaction data, expense reports, merchant details, and category information.
• Accounts-payable data via Bill.com: Vendor records, bill details, and payment status.
• Tax-compliance data via Avalara: Transaction details for automated tax calculation.
• Document inbox data: Documents forwarded to your Quoining email inbox (invoices, receipts, statements) are processed using AI extraction to identify amounts, dates, vendors, and line items.
• Payment information: Billing address and payment-method details for your Quoining subscription, processed by Stripe. We do not store full payment-card numbers.
• Communications: Messages, feedback, support requests, and other content you send to us.

4.2 Information Collected Automatically

• Usage data: Pages visited, features used, actions taken, time spent, search queries, and module usage patterns.
• Device information: Browser type and version, operating system, device type, screen resolution, and language preferences.
• Log data: IP address, access times, referring URLs, HTTP methods, response codes, and error logs.
• Authentication logs: Login timestamps, authentication method used, session duration, and IP address at login.
• Cookies and similar technologies: Session cookies for authentication, plus opt-in analytics. The full disclosure is in our Cookie Policy.
• Marketing-attribution storage:When you arrive on a marketing page with UTM parameters in the URL, we store the first set we see in your browser's local storage under q_utm_params so we know which marketing channel referred you at signup. This happens regardless of analytics-cookie choice because it is operational, not analytics. See the Cookie Policy for detail.

4.3 Information We Do Not Collect

We do not collect:

• Biometric data (fingerprints, facial recognition, voiceprints, retina scans).
• Precise geolocation data (GPS coordinates). We may infer approximate region from IP address for security purposes.
• Racial or ethnic origin, religious beliefs, political opinions, trade-union membership, or sexual orientation.
• Health or medical data.
• Genetic data.
• Private keys, seed phrases, or wallet passwords for cryptocurrency.

5. How We Use Your Information

We use the information we collect for the following purposes:

5.1 Service Delivery & Operations

• Provide, operate, maintain, and improve the accounting Service.
• Process your financial data and generate reports, financial statements, trial balances, and other accounting outputs.
• Run the SmartGL engine, which synthesizes bank, credit-card, and bill data into a general ledger.
• Process bank reconciliations, period close, and year-end close.
• Support multi-entity consolidation, intercompany eliminations, and currency translation.

5.2 Account Management & Authentication

• Authenticate your identity and manage your account, including two-factor authentication.
• Manage role-based access control and entity-level permissions.
• Process team invitations and multi-company access.

5.3 AI-Powered Features

• AI transaction categorization: suggest GL-account mappings for imported transactions.
• AI Accountant: natural-language financial-data entry assisted by AI.
• AI PDF bank-statement parsing: extract transactions from uploaded PDF statements.
• AI-assisted footnote generation for financial statements.
• AI-assisted period-close features (anomaly detection, flux analysis, narrative drafts).
• Document-inbox AI extraction: identify amounts, dates, and vendors from forwarded documents.

See Section 7 for detail on our AI practices.

5.4 Billing & Payments

• Process subscription payments and manage billing through Stripe.
• Send invoices, receipts, and payment-related communications.

5.5 Communications

• Send administrative communications (verification, security alerts, service updates, password reset).
• Respond to support requests.
• Send marketing communications only to addresses that have opted in; every marketing email contains an unsubscribe link as required by CAN-SPAM.

5.6 Security & Compliance

• Detect, prevent, and address fraud, unauthorized access, security issues, and technical problems.
• Enforce rate limits to protect the Service from abuse.
• Maintain an immutable audit trail for financial integrity.
• Comply with legal obligations, including tax recordkeeping and lawful requests.
• Enforce our Terms of Service.

5.7 Analytics & Improvement

• Monitor and analyze aggregated usage trends to improve user experience.
• Track performance metrics and diagnose technical issues via Sentry error monitoring.
• Run A/B and feature evaluation (aggregated, non-identifying) when analytics cookies are consented to.

6. How We Share Your Information

We do not sell or share your Personal Information for cross-context behavioral advertising, and we do not engage in “targeted advertising” as defined under US state privacy laws. We share Personal Information only in the following circumstances:

• Service providers (sub-processors). Third-party vendors who process data on our behalf under written contracts. Each sub-processor is contractually obligated to protect your data and use it only to perform services for us. The current list is at quoining.com/subprocessors.
• Legal requirements. When required by law, subpoena, court order, or governmental regulation, or when we believe in good faith that disclosure is necessary to protect our legal rights, your safety or the safety of others, or to investigate fraud.
• Business transfers. In connection with a merger, acquisition, bankruptcy, reorganization, or sale of all or a portion of our assets. We will notify account admins by email and post a prominent notice at least 30 days before any change in ownership or use of Personal Information.
• With your consent. When you explicitly authorize us to share your information with a third party.
• Other users in your organization. Information may be visible to other users in your organization who have been granted access by your account administrator, subject to role-based permissions and entity-level access controls.
• Professional advisors. Attorneys, auditors, and insurance providers as needed, subject to confidentiality obligations.

7. AI & Automated Processing

Quoining uses AI subprocessors to power its AI features: Anthropic (Claude), OpenAI, and Google (Gemini). Which provider processes a given request depends on your organization's AI provider configuration. We believe in transparency about how AI processes your data.

7.1 Where AI Is Used

• AI transaction categorization.Transaction descriptions, amounts, and merchant names are sent to your organization's configured AI provider to suggest GL-account mappings. A human user must review and approve before the categorization takes effect.
• AI Accountant. Your natural-language prompts plus relevant contextual data (chart of accounts, entity names, recent transactions) are sent to your configured AI provider. Outputs are drafts that require human review and confirmation before posting.
• AI PDF bank-statement parsing. PDF content is sent to your configured AI provider to extract structured transaction data. Extracted data is presented for review before import.
• AI period-close features. Anomaly detection, flux analysis, and close-narrative generation use financial data with your configured AI provider to draft insights. All outputs are advisory and require human review.
• Document inbox extraction. Forwarded documents are processed to identify amounts, dates, vendors, and line items for proposed categorization.
• AI-assisted footnotes. Footnote drafts use your configured AI provider. Editing and review are required.

7.2 What Is Sent to AI Providers

We send only the data needed for the specific function. That may include transaction descriptions, amounts, dates, merchant names, chart-of-account names and numbers, entity and department names, PDF content, and your natural-language prompts. Which provider receives a given request depends on your organization's AI configuration. None of Anthropic, OpenAI, or Google train their models on data submitted through their commercial / paid APIs. See each provider's privacy policy: Anthropic, OpenAI, and Google.

7.3 No Solely Automated Decisions

We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects. AI outputs in Quoining are suggestions or drafts that require human review and confirmation before they affect financial records or external filings. AI outputs may be wrong; you remain responsible for verifying them.

7.4 Opting Out of AI

You can disable AI features for your company in Settings; the Service remains fully functional without AI.

8. Sub-processors

We use a limited set of third-party sub-processors to deliver the Service, including AWS for hosting, Stripe for billing, Plaid for bank connections, Anthropic / OpenAI / Google for AI features, Sentry for error monitoring, Better Stack for status and uptime monitoring, and Google and Microsoft for optional single sign-on. The canonical, current list with purpose, data categories, and location is maintained at quoining.com/subprocessors and we will provide at least 30 days' notice before adding a sub-processor that materially changes the scope of processing.

9. Cookies & Tracking Technologies

We use the following types of cookies and storage:

• Strictly necessary cookies: Authentication, session management, CSRF protection, and core functionality.
• Server-backed preferences: Most in-app preferences (theme, sidebar, layout) live in our database keyed to your account, not in cookies.
• Analytics cookies:Loaded only after you select “Accept All” on the consent banner (Google Analytics 4 on marketing pages, PostHog inside the app).
• Marketing-attribution local storage: First UTM parameters seen on a marketing page are kept in browser local storage for use at signup.

You can manage cookies through the consent banner or your browser settings. We do not currently parse the Global Privacy Control (GPC) browser signal as a separate opt-out, because we do not sell or share personal information for cross-context behavioral advertising. Full disclosure is in our Cookie Policy.

10. Data Security

We maintain technical and organizational measures designed to protect Personal Information. A fuller description is in our Security overview and our Data Processing Agreement.

10.1 Encryption

• In transit: TLS 1.2 or higher enforced on all endpoints.
• At rest: AES-256 for the production PostgreSQL database (AWS RDS) and document storage (AWS S3).
• Field-level: AES-256-GCM with primary/previous key support for designated sensitive fields (third-party integration credentials, Plaid access tokens, API keys, and customer-provided tax-identification numbers).

10.2 Access Controls

• Role-based access control with per-company and per-entity scoping.
• Two-factor authentication available for all users.
• All sessions invalidated on password change.
• Rate limiting on authentication endpoints.
• Internal administrative access is time-limited, IP-bound, mandatory 2FA, and fully logged.

10.3 Audit Logging

• Every mutation is logged with actor identity, IP address, user agent, timestamp, and a description of the change.
• Audit rows are protected by database triggers that block UPDATE and DELETE.
• Each row includes a monotonic sequence number for gap detection.
• Audit logs are available to enterprise customers on request.

10.4 Application & Infrastructure

• Hosted on AWS in the United States (us-east-1).
• AWS Web Application Firewall in front of the application load balancer with OWASP rules, SQL-injection detection, and per-IP rate limiting.
• AWS GuardDuty enabled for continuous threat detection.
• Environment variables validated at startup; the Service refuses to start with missing or invalid configuration.
• Input validation with Zod on user-submitted data; HTML output sanitization.

10.5 Incident Response

We maintain a documented incident-response plan. In the event of a confirmed security incident affecting your Personal Information, we will:

• Notify affected users without undue delay and in any event no later than 72 hours after we confirm the incident, where applicable law requires notification or where the incident is material;
• Describe the nature of the incident, the categories and approximate number of records affected, the likely consequences, and the measures we have taken or proposed;
• Notify state attorneys general and other regulators as required by applicable US state breach-notification laws; and
• Document the incident internally regardless of notification thresholds.

11. Administrative Access

Authorized Quoining personnel may access your account data in the following limited circumstances:

• Customer support, when you contact us for assistance and troubleshooting requires reviewing your account configuration or data.
• Account recovery,for example to trigger a password-reset email or, on master-admin authorization, to disable a user's two-factor authentication so the user can regain access.
• Compliance and audit, to verify data integrity, investigate suspected fraud, or respond to legal obligations.
• System maintenance, to diagnose and resolve technical issues affecting your account.

All administrative access is subject to the following safeguards:

• Restricted to authorized personnel with a documented business need.
• Certain destructive operations (including disabling a user's 2FA, deleting a company, and removing a user account) are restricted to master administrators; other administrative operations are restricted to admins and rate-limited.
• An administrator cannot directly set a user's password. An administrator can trigger a password-reset email which the user must confirm via the link to actually change the password.
• Administrators cannot change your subscription payment method.
• Every administrative session is recorded in the immutable audit trail with actor identity, IP address, user agent, and timestamps. When an administrator is impersonating a Customer account, the session may be recorded in Sentry Replay for the duration of the impersonation, with text inputs and media masked.
• Impersonation tokens are HMAC-signed, expire after 5 minutes, and are bound to the originating subdomain.
• Audit records of administrative access are available to enterprise customers on request.

12. Data Location

The Service is offered only in the United States. Our core application hosting and the customer database are located in AWS us-east-1 in the United States. Some optional integrations Customer enables may process limited Customer data outside the United States: Shopify (Canada), Moralis (European Union), and Better Stack (European Union / United States) are listed on the Sub-processors page with their locations. We will update this policy and the Sub-processors page before adding a new processor that materially changes the locations involved.

13. Your Privacy Rights

Depending on the US state where you reside, you may have some or all of the following rights regarding your Personal Information:

• Right to know / access. Request disclosure of the categories and specific pieces of Personal Information we have collected, the sources, the business purposes, and the categories of third parties with whom we share it.
• Right to correct. Request correction of inaccurate or incomplete Personal Information.
• Right to delete. Request deletion of your Personal Information, subject to legal retention requirements and other recognized exceptions.
• Right to portability. Receive a machine-readable export of your Personal Information.
• Right to opt out of sale or sharing. We do not sell or share Personal Information for cross-context behavioral advertising; you may submit an opt-out request at any time and we will record it.
• Right to limit use of Sensitive Personal Information. Limit our use of Sensitive Personal Information to purposes necessary to provide the Service.
• Right to opt out of profiling for decisions with legal or similarly significant effects. We do not engage in this kind of profiling. See Section 7 for our AI practices.
• Right to non-discrimination. We will not deny services, charge different prices, or provide a different quality level for exercising your privacy rights.

To exercise any of these rights, contact us at privacy@quoining.com. We will acknowledge your request within 10 business days and respond substantively within 45 calendar days. If we need additional time (up to an additional 45 days), we will notify you of the extension and the reason.

How we verify. For requests submitted via the email associated with your Quoining account, we verify ownership of that email. For other requests, we may ask you to provide information sufficient to verify your identity. We will not fulfill a request if we cannot verify your identity or authority.

Authorized agents. You may designate an authorized agent to make a request on your behalf with written authorization or a power of attorney; we may still ask you to verify your own identity.

14. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). This section supplements Section 13 with California-specific disclosures.

14.1 Categories of Personal Information Collected

In the preceding 12 months we have collected the following CCPA categories of Personal Information:

• Identifiers: Name, email address, IP address, account identifier.
• Financial information: Bank-account numbers (encrypted), transaction data, billing information.
• Commercial information: Subscription details and purchasing history.
• Internet or other network activity: Browsing and interaction patterns within the Service.
• Professional or employment information: Job title, company name, role.
• Inferences: AI-generated transaction-categorization suggestions based on patterns.

14.2 Purposes

We collect and use Personal Information for the purposes described in Section 5: providing the Service, processing payments, security and fraud prevention, debugging, account maintenance, and service improvement.

14.3 No Sale or Sharing

We do not sell your Personal Information.We have not sold Personal Information in the preceding 12 months and have no plans to do so. We do not “share” Personal Information for cross-context behavioral advertising. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age.

14.4 Submitting a Request

Email privacy@quoining.com. The CCPA/CPRA response timeframe is 45 calendar days, extendable by an additional 45 days with notice.

14.5 Financial Incentives

We do not offer financial incentives, price differences, or service differences in exchange for the retention or sale of Personal Information.

15. Other US State Privacy Rights

Residents of Virginia, Colorado, Connecticut, and Delaware (and certain other US states with comprehensive consumer-privacy laws) have rights substantially similar to those described in Section 13, including access, correction, deletion, portability, and the right to opt out of targeted advertising, sale of Personal Information, and certain profiling. We do not engage in targeted advertising, sale, or profiling that produces legal or similarly significant effects.

15.1 Appeal

If we decline to act on your request, you may appeal by emailing privacy@quoining.com with the subject “Privacy Rights Appeal” and a description of your original request. We will respond to appeals within 60 days. If your appeal is denied you may contact your state attorney general:

• California: oag.ca.gov/privacy
• Virginia: oag.state.va.us
• Colorado: coag.gov
• Connecticut: portal.ct.gov/AG
• Delaware: attorneygeneral.delaware.gov

16. Sensitive Personal Information

Given the nature of accounting software, certain categories of Sensitive Personal Information are processed through the Service. Where US state privacy law applies, we use Sensitive Personal Information only for purposes necessary to provide the Service and do not use it for purposes such as inferring characteristics about you.

16.1 What We Process

• Bank-account identifiers. Plaid access tokens and account identifiers are encrypted with AES-256-GCM at the application layer.
• Tax identification numbers (EINs).Encrypted at the application layer; access restricted to administrators on the customer's side.
• Payment-card information. We do not store payment-card numbers; payments are processed by Stripe.
• Payroll data (Gusto integration). Wage and tax-withholding data is access-controlled and stored under company scope.

16.2 What We Do Not Collect

We do not collect, process, or store:

• Social Security Numbers of individuals (only employer EINs).
• Racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, health or medical data, biometric data, genetic data, sexual-orientation or sex-life data, precise geolocation data, or criminal-conviction data.

17. Employee & Payroll Data (Gusto integration)

When you connect Gusto, certain employee and payroll data is transmitted to Quoining for accounting purposes. Your organization is the business/controller for this data; Quoining processes it on your behalf as a service provider/processor and does not independently use it.

17.1 What We Receive

• Payroll-run summaries (dates, totals, pay period).
• Employee-level wage breakdowns (gross pay, net pay).
• Tax withholdings (federal, state, local).
• Benefit deductions and employer contributions.
• Employee names and identifiers for line-item attribution.

17.2 How We Use It

• Generate SmartGL journal entries.
• Populate payroll-related line items in financial statements.
• Support period close and reconciliation.

17.3 Employee Inquiries

Employees whose data is processed through Quoining via the Gusto integration should direct privacy inquiries to their employer (the controller). If we receive a request directly from an employee we will direct them to the employer and reasonably assist the employer in responding.

18. Calendar Data (Google Calendar and Microsoft Outlook)

Connecting a calendar is optional and is initiated by you. Quoining requests the narrowest scope that supports the feature: Google https://www.googleapis.com/auth/calendar.events  and Microsoft Graph  Calendars.ReadWrite. We never request the broader Google calendar scope, and we never create, modify, or delete calendars themselves — only events.

18.1 What We Access

• Events on your primary calendar within the date range you are viewing in the Quoining calendar — by default the coming 90 days, though other views (a specific month or week you navigate to) may include recent past events: title, description, start and end times, all-day flag, location, and the event's identifier and link.
• Events that Quoining itself created on your calendar, so we can keep them current.

Quoining stores the raw event record returned by Google Calendar. In addition to the fields listed above, that record can include other properties the provider attaches to an event — such as attendees, the organizer, meeting or video-conferencing links, attachments, and recurrence rules — which are retained with the event and deleted together with it when you disconnect.

18.2 How We Use It

• Display your existing commitments alongside Quoining's filing deadlines, close tasks, and report schedules in the in-app calendar.
• Create and update calendar events for the deadlines, close tasks, and report schedules you manage in Quoining.
• Compare an event we created against the version we last wrote, so we can tell you when it was changed outside Quoining.

Calendar data is synchronized only when a user chooses to sync. Quoining does not run background or scheduled calendar synchronization.

18.3 Limited Use

Quoining's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, calendar data is used only to provide and improve the calendar feature described above. It is never sold or transferred to third parties, never used for advertising, and never used to train generalized artificial-intelligence or machine-learning models. No human reads your calendar data except with your explicit permission for support, or where required by law. The same commitments apply to calendar data obtained from Microsoft Graph.

18.4 Storage, Retention, and Revocation

• Imported events are stored in our database, and OAuth tokens are stored encrypted at rest, so that sync can run without re-prompting you.
• Calendar data is safeguarded by the measures described in Section 10: TLS 1.2 or higher in transit and AES-256 encryption at rest for the database that stores imported events. OAuth access and refresh tokens additionally receive AES-256-GCM field-level encryption as designated integration credentials.
• Imported events are retained only for as long as your calendar remains connected; disconnecting removes them as described below.
• Disconnecting the calendar in Settings → Integrations deletes the events we imported and the stored OAuth tokens. Events that Quoining created on your calendar remain on your calendar and are yours to keep or remove.
• You may also revoke Quoining's access directly at myaccount.google.com/permissions or, for Microsoft accounts, in your Microsoft account privacy settings.
• Deleting a deadline in Quoining deletes the corresponding calendar event.

19. Data Retention

We retain data only as long as needed to provide the Service, comply with legal obligations (in particular IRS recordkeeping under IRC § 6001), and support legitimate business needs. The current schedule is summarized below; for the full schedule including grace and retention windows for company-account closure, see the Data Retention Policy.

On company-account closure, we proceed through a three-stage cycle — a 30-day grace period during which an admin can self-restore, a soft-deleted retention window in which admin-mediated recovery is possible, and a final hard purge of company-scoped records. Immutable audit-log rows are preserved with personal identifiers redacted. The full schedule is in the Data Retention Policy.

20. Data Portability & Export

Your data belongs to you. You can export it via:

• In-app exports— most tables and reports include CSV or PDF export from the UI.
• Financial statements— income statement, balance sheet, and cash-flow exports as PDF.
• Spreadsheet model exports— supported reports and Advanced Model Exporter can generate `.xlsx` workbooks from your actuals, budgets, forecasts, assumptions, and export settings.
• Public API (v1)— structured JSON access to accounts, bills, entities, invoices, journal entries, and trial-balance data.
• Full data export— available from Settings → Account; you may also request a complete export by emailing privacy@quoining.com and we will provide it within 30 days of a verified request, in a structured, commonly used, machine-readable format.

Exports include the data categories you have the right to receive under applicable law. Exports do not include derived data that is our trade secret (e.g., SmartGL engine logic), but include the outputs generated from your data.

Downloaded exports are controlled by you after delivery. Copies you download, email, upload to another service, or open in third-party spreadsheet software are outside Quoining's hosted environment and are governed by your own security practices and the terms and privacy policies of those third-party tools.

21. Do Not Track and Global Privacy Control

We do not currently respond to legacy “Do Not Track” (DNT) browser signals because no uniform standard for DNT exists. We do not currently parse the Global Privacy Control (GPC) browser signal either, because we do not engage in the activities for which GPC is an opt-out under California law (sale or sharing for cross-context behavioral advertising). If we later add any activity for which GPC would apply, we will implement GPC handling at the same time.

22. Data Minimization & Purpose Limitation

• Collection limitation. We collect the minimum data needed. Each data element has a defined purpose.
• Purpose limitation. We use Personal Information only for the purposes in this policy.
• AI minimization. AI features receive only what is needed for the specific function, not your entire accounting dataset.
• Integration minimization. Third-party integrations only run when you connect them. We request only the data scopes needed.
• Storage limitation. We do not retain data beyond the periods in Section 18 unless required by law or requested by you.

23. Children's Privacy

The Service is a business accounting platform not intended for use by anyone under 18. We do not knowingly collect Personal Information from children under 13. We comply with the Children's Online Privacy Protection Act (COPPA); because our Service is exclusively for business use we do not have a mechanism for parental consent and will delete any Personal Information collected from a child under 13 promptly on discovery.

If you believe a child has provided us with Personal Information, contact privacy@quoining.com.

24. Third-Party Links

The Service may contain links to third-party websites, products, or services. We are not responsible for their privacy practices, content, or security. Review the privacy policies of any third-party services you access. A link is not an endorsement.

25. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will:

• Update the “Last updated” date at the top.
• Provide notice via email to the address associated with your account, where the change is material to how we process your Personal Information.
• Display a prominent notice within the Service.

Your continued use of the Service after the effective date of a revised policy indicates acceptance of the updated policy.

26. Contact

For questions, concerns, or complaints about this Privacy Policy, our data practices, or to exercise a privacy right, contact us:

Response Timeframes

• General inquiries: within 10 business days.
• CCPA/CPRA verifiable consumer requests: within 45 calendar days (extendable by an additional 45 days, with notice).
• Other US state privacy-law requests: within 45 days (extendable by an additional 45 days, with notice).
• Appeal decisions: within 60 days.