Introduction
This Privacy Policy (“Policy”) describes how the NexTier Invoice App (“App”, “we”, or “us”) collects, uses, stores, and protects personal and business information. This Policy applies to users of the App, which is designed exclusively for generating invoices from CCH Practice Management data into QuickBooks Online.
This Privacy Policy is provided in compliance with QuickBooks Online (Intuit) developer requirements for production API access.
1. Information We Collect
The App collects and processes the following categories of information:
1.1 Account Credentials
- Usernames and password hashes — Stored locally in a SQLite database on your server using bcrypt/pbkdf2 hashing. Passwords are never stored in plain text.
- Session tokens — Generated for authenticated sessions, stored in the local SQLite database, and expire after 2 hours of inactivity.
- CSRF tokens — Rotated on every request to prevent cross-site request forgery attacks.
1.2 QuickBooks Online Data
The App connects to your QuickBooks Online account via OAuth 2.0 and may access:
| Data Category | Purpose |
|---|---|
| Customer / Contact information | Populating invoice recipients |
| Product/Service items | Mapping CCH billing categories to QuickBooks line items |
| Invoice records | Creating and managing invoices in your QuickBooks account |
| Terms / Payment terms | Applying correct payment conditions per invoice |
1.3 CCH Practice Management Data
The App connects to your local CCH Practice Management database and reads:
- Office / practice group names
- Partner names and revenue allocations
- Billing data and time entries
- Client information as required for invoice generation
1.4 Configuration Data
The App stores configuration settings (e.g., QuickBooks product mappings, excluded offices, scheduling preferences) in a local SQLite database and YAML files on your server.
2. How We Use Information
We use collected information solely for the following purposes:
- Invoice generation — Translating CCH Practice Management billing data into QuickBooks Online invoices.
- Authentication and session management — Ensuring only authorized users can access the App.
- Data synchronization — Maintaining product, customer, and term mappings between CCH and QuickBooks.
- Audit logging — Recording invoice creation events for accountability (stored locally).
3. Data Storage and Security
3.1 Local Processing
The App runs on a closed, private server. All data is processed and stored locally. No data is transmitted to NexTier’s servers or any third-party cloud service (except direct API calls to QuickBooks Online and CCH Practice Management).
3.2 Security Measures
- Passwords are hashed using bcrypt or pbkdf2:sha256 with unique salts.
- Sessions expire after 2 hours of inactivity and are cleaned up automatically.
- CSRF tokens protect all state-changing operations.
- Rate limiting prevents brute-force login attempts (10 failed attempts within 5 minutes triggers a 15-minute lockout).
- Cookies use HttpOnly and SameSite=Lax flags.
4. Data Sharing
We do not sell, rent, or share your data with third parties. The only external systems that receive data are:
- QuickBooks Online (Intuit) — Via OAuth 2.0 authentication. Data is shared only as necessary for invoice creation and synchronization.
- CCH Practice Management — Direct database connection for reading billing data.
5. Data Retention
Data is retained only as long as necessary to perform the App’s functions:
- User credentials and sessions — Stored until user deletion or administrative cleanup.
- Audit logs — Retained in the local SQLite database indefinitely unless manually purged.
- Configuration files — Persisted on your server until you choose to delete them.
6. Your Rights
As the data controller, you have the right to:
- Access — View all stored data via the App’s administrative interface or directly from the local SQLite databases.
- Correction — Modify configuration settings and user credentials at any time.
- Deletion — Delete users, sessions, audit logs, and configuration data through the App or by removing local files.
- Revocation of access — Revoke QuickBooks Online API access at any time via your Intuit account settings.
7. Children’s Privacy
The App is not intended for use by individuals under the age of 18 and is designed exclusively for business operations. We do not knowingly collect information from children.
8. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be reflected in the “Last updated” date at the top of this page. We encourage you to review this Policy periodically.
9. Contact Information
If you have questions about this Privacy Policy or wish to exercise any of your rights, please contact us:
- NexTier
- Email: corey@nextier.com