Privacy Policy

Who operates this deployment

ASK OS is deployed separately for each school or organization. The organization that provided your account is the operator responsible for this deployment and the primary contact for privacy requests.

Data we process

Depending on the features enabled by the operator, ASK OS may process:

• Account identity, role, department, session, and security information.
• Administrative actions and audit records.
• QuickBooks Online company information, accounts, items, customers, invoices, payments, and financial reports.
• QuickBooks OAuth credentials and connection metadata needed to maintain access.
• Operational logs, request identifiers, and synchronization status.

Why we process data

Data is used only to authenticate authorized users, administer the school, provide enabled operational and financial features, synchronize authorized QuickBooks records, protect the service, investigate errors, and meet legal obligations.

QuickBooks Online

A system administrator must intentionally connect a QuickBooks company. ASK OS requests read-only Accounting access. OAuth access and refresh tokens and the QuickBooks company identifier are encrypted at rest and are not exposed to browser JavaScript. ASK OS does not sell QuickBooks data or use it for advertising.

Isolation and sharing

Each school deployment has its own application services and database project. One school's QuickBooks data is not shared with another school. Data may be processed by infrastructure providers, including Railway for application hosting and Supabase for authentication and PostgreSQL storage, under the operator's service arrangements.

Retention and deletion

QuickBooks credentials and synchronized source records are retained while the connection is active and the data is needed for enabled features. Disconnecting through ASK OS revokes the Intuit authorization and removes the connection and its associated active synchronization records from the application database. Residual copies may remain in protected backups until the operator's backup retention period expires.

Other account, audit, and operational records are retained according to the operator's legal, security, and records-management obligations. Contact the operator to request access, correction, or deletion where applicable.

Security

ASK OS uses access controls, encrypted transport, protected session cookies, encrypted QuickBooks credentials, restricted database roles, and audit logging. No internet service can guarantee absolute security; suspected incidents should be reported through the Support page immediately.

Applicable law

This deployment is designed to align with the Republic of Kosovo's Law No. 06/L-082 on the Protection of Personal Data and with GDPR principles. See the End-User License Agreement for the governing-law clause that applies to your use of ASK OS.

Contact

Contact the operator at ask.os@askosova.org, or use the Support page.