BLUE GRANITE ADVISORY LLC

Privacy notice

Effective November 5, 2026.

Who operates the portal

Blue Granite Advisory LLC (Blue Granite) provides this private CFO reporting portal for its clients and authorized team members. Contact cheryl@bgbks.com with privacy questions or requests. This notice covers the CFO portal, not the separate BlueTrue Books product, Blue Granite Connect CRM, or Intuit's own services.

Information processed

The portal processes account email addresses, authentication information, client-company records, company access assignments, financial summaries, and CFO insight drafts and publications. When a company authorizes a QuickBooks connection, the application processes connection identifiers, authorization tokens, and the financial reports needed for its dashboards. The portal supports sandbox testing and an owner-authorized live connection pilot for Legendary. Connection setup reads the authorized QuickBooks company name; the verified owner can import or refresh completed monthly or quarterly financial reports. Updates are manual. Future features may require additional data and an updated notice before activation.

Purposes and access

We use this information to authenticate users, restrict company access, display financial reports, provide CFO advisory services, troubleshoot connections, and protect and recover the application. Access depends on assigned company permissions and staff responsibilities. The firm's authorized owner can administer client data. A client account does not automatically receive access to another company's dashboard.

We do not sell portal information or use one client's financial information to provide another client's analysis. The current application does not use QuickBooks data to train AI models. AI and Google Sheets integrations are planned but are not enabled. We will describe relevant providers and data uses before those features process client information.

Providers and essential storage

Cloudflare provides application hosting and connection/dashboard storage. Supabase provides account authentication and the application database. Intuit handles QuickBooks authorization and supplies reports when a company connects. These providers process information needed for those services under their applicable terms. The application uses essential session and OAuth-flow cookies. The current portal does not include advertising pixels or marketing analytics. Infrastructure providers may process operational or security information such as network requests.

Security and backups

The application uses HTTPS, company access controls, protected session cookies, encrypted QuickBooks token storage, and authenticator support. Accounts with an enrolled authenticator must complete verification to access protected data. No system can guarantee absolute security. Owner-created application backup files are encrypted in the browser with an owner-held phrase. Those files do not include account credentials, MFA factors, or QuickBooks connection secrets and are not a full platform backup.

Retention, disconnection, and requests

We retain portal information for the client relationship and applicable business, contractual, and recordkeeping needs. Contact us to request access, correction, export, account closure, or deletion. We will verify your authority and explain any information we must retain and the applicable process. Disconnecting QuickBooks stops future authorized retrieval through that connection; it does not by itself delete previously imported reports, the original QuickBooks records, or separately retained backup copies. Backup copies may persist separately from the active application. Do not email passwords, authenticator codes, API credentials, or backup phrases.

Changes

Material changes to data use will be communicated before the changed feature is activated where required. New integrations will not be represented as active until they are deployed and configured.