Privacy and Compliance

Financial records are used for owner bookkeeping, tax review, export, and CPA handoff only.

• Owner app access is passcode-protected and session-bound.
• CPA links are read-only, revocable, and time-limited.
• Public bundles expose source names, hashes, and review data, not server paths or secrets.
• Uploads are malware-scanned and parsed with local OCR first; when the owner enables AI backup, only the evidence needed for extraction is routed through the private OpenClaw gateway to the configured OpenAI model with response storage disabled.
• A connected QuickBooks company supplies accounting records for review matching only; imported rows are never auto-confirmed.
• BLACK369 does not sell financial data.

The app is ready for internal BLACK369 use; external customer onboarding needs a signed DPA first.

• Current data flows are limited to hosting and database/runtime infrastructure; Google APIs when configured; the self-hosted OpenClaw routing layer and OpenAI for owner-enabled AI review; and Intuit/QuickBooks when the owner connects a company.
• External customer data stays blocked until processor terms, subprocessors, and support access rules are approved.
• CPA access is a delegated review flow, not an admin account.
• AI backup scanning, Google integrations, and QuickBooks synchronization remain configurable and visible in Settings.

Records are tenant-scoped today, with one default BLACK369 owner tenant active.

• Core tables carry tenantId and use tenant-scoped indexes.
• Session cookies include tenant identity before protected routes load.
• Default tenant provisioning is explicit in seed and tenant helpers.
• New tenant onboarding requires isolated auth, scoped queries, and deletion proof before launch.

Tax records are retained for owner review until Gabe approves deletion or archive policy changes.

• Statement files, audit logs, import runs, and export runs preserve tax evidence and change history.
• Temporary malware-scan, PDF-render, and OCR working files are deleted after processing; temporary QA fixtures are deleted after validation.
• QuickBooks OAuth tokens are encrypted at rest. Disconnect first revokes access with Intuit, then removes local tokens; already imported review evidence remains in the bookkeeping audit trail until the owner explicitly approves deletion.
• CPA shares expire or can be revoked from Settings.
• Irreversible deletion of owner tax evidence requires explicit owner approval.