Privacy Policy

Last updated: September 21, 2026

This Privacy Policy explains how GROSSMARGIN LLC ("Grossmargin," "we," "us," or "our") collects, uses, stores, discloses, and protects information in connection with our websites and services, including:

• grossmargin.io — our marketing site, newsletter, contact forms, and free tools (such as the Section 174 tool and the team-equity quiz); and
• Grossmargin Connect (connect.grossmargin.io) — our application that connects your accounting and business systems to AI agents.

By using our websites or services, you agree to the practices described in this Policy. If you do not agree, please do not use our services.

1. Who we are

Grossmargin is operated by GROSSMARGIN LLC, based in New York, United States. For any privacy question or request, contact us at hello@grossmargin.io.

2. Information we collect

Information you provide. When you contact us, subscribe to our newsletter, use a tool, or create an account for Grossmargin Connect, we collect information such as your name, email address, company name, and anything you choose to include in a message or form.

Account and authentication data. Grossmargin Connect uses Google Sign-In. When you sign in, we receive your name, email address, and Google account identifier from Google. We do not receive your Google password.

Connection credentials. To connect a third-party system to Grossmargin Connect, you authorize an OAuth connection or store a credential. OAuth access and refresh tokens are held by our authentication provider (Nango) and used to obtain short-lived access tokens on demand. Credentials you store directly in a Vault are encrypted at rest with AES-256-GCM; the credential's name, description, and type remain in plaintext so you can identify it.

Data accessed from connected systems. When an AI agent you have authorized makes a request, Grossmargin Connect fetches the specific data needed to fulfill that request from the connected system and passes it through to the agent. See Section 4 for how we handle data from Intuit QuickBooks Online.

Usage and log data. We collect standard technical information such as IP address, browser type, pages viewed, and timestamps, and we keep an audit log recording each time a stored credential is revealed or a connected system is accessed.

3. How we use information

We use information to:

• provide, operate, secure, and improve grossmargin.io and Grossmargin Connect;
• authenticate you, maintain your connections, and route authorized requests from your AI agents to the systems you have connected;
• respond to your inquiries and send you communications you have requested (such as our newsletter — you can unsubscribe at any time);
• maintain audit logs, detect and prevent fraud or abuse, and comply with legal obligations.

We do not sell your personal information, and we do not use data accessed from your connected accounting systems for advertising or to train machine-learning models.

4. QuickBooks Online (Intuit) data

Grossmargin Connect can connect to Intuit QuickBooks Online using the QuickBooks Online Accounting API, with the com.intuit.quickbooks.accounting scope only.

What we access. With your authorization, we access accounting data in your QuickBooks Online company (for example, accounts, customers, vendors, invoices, bills, and transactions) as required to fulfill a request made by an AI agent you have connected.

How we use it. QuickBooks data is fetched live at the time of a request and proxied directly to the AI agent you have authorized. We use it solely to fulfill that request on your behalf.

Storage. We do not persist, cache, or store your QuickBooks Online financial data in our databases. What we retain is limited to: (a) the OAuth connection reference needed to reach your QuickBooks company (managed through Nango), and (b) an audit log entry recording that an access occurred. QuickBooks data itself passes through in memory and is not written to our storage.

Sharing. QuickBooks data is disclosed only to the AI agent you have explicitly authorized to make the request, and to the infrastructure subprocessors listed in Section 6 to the extent required to transmit it. We do not sell it or share it for advertising.

Disconnecting and deletion. You can revoke Grossmargin Connect's access at any time from within QuickBooks (Settings → Apps / Connected apps → Disconnect) or by removing the connection inside Grossmargin Connect. On disconnection, the OAuth connection and its tokens are revoked and removed so that no further access is possible. Because we do not store QuickBooks financial data, there is no cached copy of that data to delete. To delete your Grossmargin Connect account data (audit logs and connection metadata), email hello@grossmargin.io.

Our use of information received from Intuit APIs adheres to the Intuit Developer terms and applicable API policies.

5. AI agents and your data

Grossmargin Connect is designed to hand authorized data to AI agents (such as Claude and Claude-based tools) that you connect. When you direct an agent to read from a connected system, that data is transmitted to the agent's provider and handled under that provider's terms and privacy policy. You control which agents you connect and what you ask them to do.

6. Service providers and subprocessors

We share information with a limited set of service providers who process it on our behalf, under contractual confidentiality and security obligations:

• Vercel — application hosting and delivery.
• Neon / PostgreSQL — database hosting for accounts, connection metadata, and audit logs.
• Nango — OAuth connection management and token storage/refresh for connected systems.
• Google — sign-in and authentication.
• AI providers you connect (e.g., Anthropic / Claude) — receive the data you direct an agent to access.

We may also disclose information if required by law, to enforce our agreements, or to protect the rights, safety, and security of Grossmargin, our users, or the public.

7. Data retention

We retain account information, connection metadata, and audit logs for as long as your account is active and as needed to provide the service, resolve disputes, and meet legal obligations. As described above, we do not retain QuickBooks Online financial data. You may request deletion of your account data at any time.

8. Security

We use administrative, technical, and physical safeguards to protect information, including encryption in transit (TLS) and encryption at rest for stored credentials (AES-256-GCM). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International users and connections

Grossmargin Connect supports companies in the United States and Canada. Information may be processed in the United States and in the regions where our subprocessors operate. Where required, we rely on appropriate safeguards for cross-border transfers.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. To exercise any of these rights, email hello@grossmargin.io. You can unsubscribe from marketing emails using the link in any such email.

11. Children's privacy

Our services are not directed to children under 16, and we do not knowingly collect personal information from them.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above, and material changes will be reflected on this page.

13. Contact us

GROSSMARGIN LLC New York, United States hello@grossmargin.io