Orion Invoicing Privacy Policy

Effective date: August 17, 2026

Operator and data contact: Thomas King
Notice address: 3540 Kirkridge St, Santa Rosa, California 95403, United States
Privacy contact: [email protected]

1. Scope and current status

This Privacy Policy explains how Orion Invoicing (“Orion Invoicing,” the “Software,” “we,” “us,” or “our”) handles information. Orion Invoicing is currently a private, internal integration intended to help the operator work with an authorized QuickBooks Online account. It is not currently a public marketplace or multi-tenant service.

An Intuit developer application and a reviewed local integration candidate exist, but production approval, production credentials, production OAuth connection, and production enablement are not currently complete. The candidate has not been deployed or connected to an Intuit account. Its public connection routes, production transport, and accounting writes are disabled. The public website presently provides informational and legal pages; it does not connect, reconnect, or disconnect an account or perform an accounting action.

This Policy covers information handled by Orion Invoicing and its owner-controlled infrastructure. It does not govern Intuit’s processing through QuickBooks Online or independent services that the operator does not control.

2. Information handled

When the QuickBooks integration is enabled for an authorized account, the Software may handle:

• Connection information: OAuth credentials and tokens, QuickBooks realm or company identifier, and provider record identifiers.
• Customer information: customer display name, primary email address, and an optional reference to an existing payment term.
• Invoice information: customer, line-item descriptions, quantities, rates, amounts, dates, payment terms, recipient, status, and provider record identifiers.
• Operational records: private action approvals, approval ledgers, policy and usage state, mutation journals, action results, error classifications, audit or reconciliation evidence, and metadata-only diagnostic records.
• Support communications: sender identity and address, message content, and information the sender chooses to include.

The reviewed local candidate's diagnostic records may contain a timestamp, environment class, operation class, status or error class, a bounded Intuit transaction ID (intuit_tid) when Intuit supplies one, a local correlation ID, and a safe journal or reconciliation reference. The Intuit transaction ID is support correlation metadata only. It is not authorization or proof that an action succeeded.

Diagnostic records and support exports exclude OAuth credentials, authorization headers, access or refresh tokens, client secrets, raw request and response bodies, customer names or email addresses, invoice content, realm and owner identifiers, full URLs, query strings, and exception text. Authorized users should provide only information needed for legitimate invoicing and should not send passwords, access tokens, client secrets, or unnecessary customer data through support email.

3. Website and infrastructure data

The current Orion Invoicing application server intentionally suppresses application request logging and does not parse request bodies on informational, legal, launch, or disabled connection routes. Cloudflare and infrastructure providers may independently process connection metadata such as IP addresses, timestamps, security signals, or request headers under their own policies.

The public website does not use advertising trackers and Orion Invoicing does not use information for advertising or unrelated profiling.

4. Sources of information

Information may come from:

• an authorized user who enters or approves an action;
• the connected QuickBooks Online company through Intuit’s APIs;
• Orion Invoicing’s approval, policy, journaling, audit, and reconciliation processes;
• messages sent to [email protected]; and
• Cloudflare and the owner-controlled VPS infrastructure to the extent their systems generate operational or security metadata.

5. Purposes

Information is used only as needed to:

• connect an authorized QuickBooks Online company;
• prepare and, after exact approval, create customers or invoices;
• read requested QuickBooks Online records;
• send invoices after separate exact approval;
• enforce one approval permitting no more than one attempt;
• avoid automatic retries after an ambiguous write;
• maintain policy, usage, approval, audit, and reconciliation state;
• diagnose errors, prepare owner-controlled metadata-only support exports, secure the Software, and prevent misuse;
• answer support and privacy requests; and
• meet applicable legal obligations.

Orion Invoicing does not sell personal information and does not use it for advertising.

6. Approval and write handling

Consequential QuickBooks Online writes are designed to require exact private owner approval. One approval permits no more than one attempt. If a write may have reached QuickBooks Online but its result is uncertain, the Software is designed not to retry automatically. Authorized users should independently verify consequential results in QuickBooks Online.

7. Disclosures and providers

Information may be disclosed only as reasonably necessary in these circumstances:

• Intuit and QuickBooks Online: to perform authorized functions. Intuit processes information under its own terms and privacy notices.
• Cloudflare: for DNS, secure tunnel routing, security, and inbound email routing.
• RackNerd and network infrastructure providers: to host and transport the owner-controlled Linux VPS. The server is currently observed in Santa Clara, California, United States, on AS36352 HostPapa network infrastructure.
• The destination email provider: to receive messages forwarded from [email protected].
• Legal and safety needs: where disclosure is reasonably believed necessary to comply with valid law or legal process, protect rights or safety, investigate misuse, or support a lawful transfer or reorganization of the Software.

Providers operate under their own terms and privacy practices. Orion Invoicing does not claim control over provider retention, subprocessors, or processing locations.

8. Storage and security

Approval records, policy and usage state, mutation journals, audit or reconciliation evidence, and private diagnostic files may be stored on an owner-controlled Linux server with restricted filesystem access. The reviewed local candidate keeps diagnostic files and exports owner-private and validates the export schema before sharing. The public application origin is bound to localhost and reached through Cloudflare Tunnel.

Production credentials and production state are not currently provisioned. Before any production activation, persistent refresh tokens and realm identifiers must be encrypted, with key material stored separately from the credential store. That production storage is an activation requirement, not a description of the current disabled candidate.

The operator uses access restrictions and fail-closed operational controls appropriate to the current limited internal release. Orion Invoicing does not claim SOC certification or any other security or legal-compliance certification. No security method eliminates all risk.

9. Retention

Orion Invoicing keeps information only as long as reasonably needed for operation, security, reconciliation, disputes, or legal obligations. Current operational rules are:

• production OAuth tokens are not presently held; in the reviewed local candidate, disconnect attempts revocation through Intuit's discovery-advertised endpoint, removes active local credentials, and retains only a minimal non-QuickBooks outcome record, including a conservative result when the provider response or local durability is uncertain;
• customer and invoice payloads are not retained by the public website; operational records may retain the minimum identifiers and evidence needed to attribute and reconcile requested actions;
• approval ledgers, mutation journals, and reconciliation evidence may be retained while needed to prevent duplicate attempts, resolve uncertain outcomes, support accounting records, or meet legal obligations;
• the local candidate's default private diagnostic store is bounded by size to one active file of up to 256 KiB and up to three rotated files; this is Orion's internal default, not an Intuit retention requirement, and no fixed time-based diagnostic retention period is claimed;
• diagnostic support exports contain only validated metadata and remain owner-controlled unless the operator chooses to share one for support;
• the application server does not maintain web access logs for the current informational and disabled routes;
• support email is retained in the destination mailbox only as needed to answer the request, maintain necessary records, or meet legal obligations; and
• if backups containing eligible deleted data are later introduced, deletion may complete as those backups expire rather than immediately.

An unresolved or disputed accounting action may be retained longer than ordinary operational data until reconciliation or the relevant obligation is complete. More specific production retention schedules will be adopted and reflected here before Orion Invoicing expands beyond its current private internal use.

10. Access, correction, and deletion

Authorized users can review and correct many customer and invoice records directly in QuickBooks Online. Requests concerning information held by Orion Invoicing may be sent to [email protected].

Subject to applicable law and verification of the requester, a person may request access, correction, deletion, restriction, objection, or a portable copy where those rights apply. Disconnecting or revoking QuickBooks access is separate from asking Orion Invoicing to delete information it holds. Rights vary by jurisdiction and may be limited where minimal records must be retained for reconciliation, security, applicable legal recordkeeping, or legal claims.

11. Disconnecting QuickBooks Online

An authorized user may revoke access through Intuit's account or app-connection controls. The current public website has no active connect, reconnect, callback, or disconnect route.

In the reviewed local candidate, connection starts only through an owner-authenticated flow with strict, single-use state validation. Terminal authorization failures require reconnection. Refresh and disconnect operations are serialized, and the Software does not automatically replay a business write after authorization repair or reconnection.

Disconnect attempts revocation through Intuit's discovery-advertised endpoint, stops further processing for the connection, removes active local credentials, and records only a minimal non-QuickBooks outcome. If the provider response or local durability is uncertain, the outcome remains marked as uncertain rather than treated as confirmed revocation. Repeating disconnect after local disconnection is idempotent.

Revocation or disconnect does not itself delete information held by Intuit and is separate from a request to delete information held by Orion Invoicing. Minimal records may remain where needed for reconciliation, security, disputes, or applicable legal recordkeeping. Questions about information held by Intuit must be directed to Intuit under its policies and account tools.

12. International processing

The owner-controlled VPS is currently observed in California, United States. Cloudflare, Intuit, email, hosting, network, and support infrastructure may process or access information from other locations under their own practices. Orion Invoicing is presently intended for the operator’s internal United States business use and does not represent that it has implemented mechanisms required for offering the Software in every jurisdiction.

13. Children

The Software is intended for authorized business users aged 18 or older and is not directed to children. The operator does not knowingly seek personal information directly from children through the public website.

14. Changes

This Policy may be updated as the Software, providers, or legal requirements change. The current version will be posted at this URL with its effective date. Material changes will be communicated to authorized users by email or another reasonable direct method when appropriate or legally required.

15. Contact

Privacy, security, and support requests may be sent to:

Thomas King
3540 Kirkridge St, Santa Rosa, California 95403, United States
[email protected]