Portal privacy

This notice covers the Computing America portal at oms.computingamerica.com, the Computing America sign-in, and the account, access and billing information they share with your organization's applications. Application content is handled under your organization's agreement with us and any privacy notice for that application. Our website has its own privacy notice.

Hyrax LLC d/b/a Computing America operates the portal. Where this notice says "we", that is who it means.

For your organization's account (who has access, what it subscribes to, what we invoice and what it paid), we are the controller: we decide what is kept, and this notice describes it.

For the content your people put into the applications, and for your QuickBooks company, we act on your organization's instructions. Your organization decides what goes in, and its agreement with us governs it. If you are one of our client's people and have a question about that content, ask your organization first.

If your organization's owner or its accountant connects QuickBooks Online, we keep:

We read your company's information when you connect and keep its name and ID. We read active vendor and expense account lists when an authorized person opens the QuickBooks page, and the selected vendor and account when settings are saved. If you leave the vendor blank, we use your vendor named Computing America, and create it if there is none.

When an owner, authorized accountant or authorized member of our staff presses Send invoices, we check the connected company's information and create, update or delete bills for our invoices. We look up bills by stored ID or invoice number and verify the vendor and invoice number before changing them. Without a stored link, we also require one matching bill with our invoice identifier. We report conflicting or ambiguous matches for review without changing those bills. Our staff act on your organization's instructions. Payments recorded in QuickBooks are not brought back into the portal.

We do not request customer, sales, bank-account or payroll records. Apart from the company, vendor, expense account and bill records described above, we do not request other QuickBooks records. We use the information we read only to manage this connection and our bills.

When you disconnect from the portal, we request revocation from Intuit and delete our stored connection credentials even if Intuit cannot confirm revocation. Removing the app in QuickBooks revokes access there. The portal deletes its stored connection when Intuit subsequently rejects a token refresh; disconnect in the portal to remove it without waiting for that check. We keep the record of which invoice became which bill with the invoice, to help prevent duplicate bills if you reconnect to the same company. Bills already in QuickBooks remain there.

To provide the service and let the right people into it; to invoice your organization and record what it paid; to send invoices to QuickBooks when you ask; to answer requests; and to keep the service secure. We do not sell personal data, we do not use it for advertising, and we do not add you to a mailing list.

Where the EU or UK GDPR applies, we rely on our legitimate interests in providing and securing a business service and managing our relationship with your organization for its users' and business contacts' information. We rely on performance of a contract when the individual is a party to that contract and the processing is necessary to perform it, and on legal obligation when the law requires us to retain or disclose records.

The portal sets only the cookies it needs to work. They hold your signed-in session, the client an accountant has chosen, and the client one of our staff is viewing. A ten-minute cookie protects the QuickBooks connection while it is being made. The portal remembers your light or dark theme, and whether you turned visual effects off, in your browser's storage. There are no analytics, advertising or tracking cookies.

The portal and sign-in service use the following providers for these purposes:

Intuit is not our processor. When your organization connects QuickBooks Online, the bills we send go to your own QuickBooks company, and Intuit handles them under your organization's agreement with Intuit and Intuit's privacy statement.

We operate from the United States. Your information is processed in the United States and may be processed in other countries where the providers listed above operate. Processing locations depend on the service and its configuration.

Where applicable law requires an international transfer safeguard, it must be in place before the transfer. If your organization needs a particular processing location or transfer arrangement, contact info@computingamerica.com before providing data subject to that requirement. You can also ask us for the locations and transfer safeguards that apply to your service, and how to obtain a copy of any applicable safeguards.

An authorized owner can request account closure, export or deletion at info@computingamerica.com. We review the records against the purposes above, your agreement and applicable law, and explain any retention still required. Ask us for the retention settings that apply to your service.

Write to us at info@computingamerica.com to ask what we hold about you, correct it, delete it where we are not required to keep it, or receive a portable copy. We may need to verify your identity and authority to receive an organization's records. We do not treat you differently for making a request.

Where the EU or UK GDPR applies, you may also request restriction of processing, object to processing based on legitimate interests, and complain to your supervisory authority. We respond without undue delay and normally within one calendar month. Where the law permits an extension for a complex request or multiple requests, we explain the reason within that first month; the extension may be up to two further months.

For other requests, we respond within forty-five days, or sooner where applicable law requires. If the law permits an extension, we explain it before the initial deadline. To appeal a refusal, reply to our decision asking for a review. We respond within sixty days, or sooner where required, and explain how to contact the relevant regulator if we deny the appeal.

An owner can see and correct most of what we keep in the portal directly, and can remove people and accountants there.

The portal is served over HTTPS only. Every sign-in is checked by our sign-in service, and each request is limited to the organization it belongs to. QuickBooks credentials are encrypted at rest. Changes to people, licenses, billing and connections are written to the activity record. No system is perfectly secure; if a breach affects your data, we will tell your organization's owners as promptly as the law requires and as promptly as we can.

The portal is a business service. It is not directed at children under sixteen, and we do not knowingly collect their information.

If we change what we keep or why, we update this page and move the effective date at the top. We describe material changes here rather than folding them in silently.

Privacy questions, requests and appeals: info@computingamerica.com. The entity responsible is Hyrax LLC d/b/a Computing America.