Privacy Policy

Lightweight Labs LLC ("Company," "We," "Us," or "Our") operates instabooks (the "Service"). This Privacy Policy explains what personal information We collect, how We use and share it, the rights You have, and how You can exercise them.

By using the Service, You agree to the practices described here. If You do not agree, do not use the Service.

1. Who We Are

The data controller for personal information processed through the Service is Lightweight Labs LLC, 17 East 13th Street, Suite 7B, New York, NY 10003, United States. You can reach Our privacy contact at founders@lightweightlabs.com.

2. Personal Information We Collect

2.1 Account and Identity Information

When You create an Account, We collect Your name, email address, authentication credentials (such as identifiers returned by Intuit OAuth), and information You provide in account settings.

2.2 QuickBooks Online Data

When You authorize the Service to connect to Your Intuit account, We access QuickBooks Online data on Your behalf using the OAuth scopes You authorize. This data may include financial records, transactions, accounts, customers, vendors, employees, payroll metadata (where applicable), attachments, and related metadata. We mirror this data into Our systems to provide a fast user interface. Your QuickBooks Online account remains the system of record; You can revoke Our access at any time from within Your Intuit account.

2.3 Usage Information

We collect information about how You interact with the Service, including IP address, browser type and version, operating system, device identifiers, pages and features used, click paths, timestamps, referring URLs, and error and performance diagnostics.

2.4 Cookies and Similar Technologies

We use cookies, local storage, web beacons, and similar technologies for (a) authentication and session management, (b) preferences and functionality, (c) security and fraud prevention, and (d) product analytics. The categories of technologies We use are:

• Strictly necessary — required for the Service to function (login, security, load balancing).
• Functional — remember preferences and improve usability.
• Analytics — measure feature usage and product performance via PostHog (Our analytics processor). See Section 4.
• Error monitoring — capture client-side errors via Sentry to help Us debug.

We do not use cookies for cross-context behavioral advertising. You can control cookies through Your browser settings; disabling strictly necessary cookies will prevent the Service from functioning.

2.5 Communications

If You contact Us (email, support, chat), We collect the contents of Your message and any information You include.

3. How We Use Personal Information

We process personal information to:

• Provide, operate, secure, and improve the Service;
• Authenticate You and maintain Your Account;
• Connect to and synchronize with QuickBooks Online on Your behalf;
• Communicate with You about the Service, including service announcements, security notices, and changes to terms;
• Provide customer support and respond to requests;
• Analyze usage to improve features and performance;
• Detect, prevent, and respond to fraud, abuse, security incidents, and unlawful activity;
• Comply with legal obligations and enforce Our agreements; and
• With Your consent, send You marketing or promotional communications. You may opt out at any time (see Section 9).

4. Subprocessors and Sharing

We share personal information with the third parties listed below, who act as Our service providers or processors under contractual obligations of confidentiality and data protection. The current list is also maintained at instabooks.io/subprocessors:

• Amazon Web Services (AWS) — cloud hosting, storage, and infrastructure (United States).
• Intuit Inc. — provider of QuickBooks Online; We exchange data with Intuit on Your behalf based on the OAuth scopes You authorize.
• PostHog — product analytics (events, feature usage, session metadata).
• Sentry — application error monitoring and performance diagnostics.

We may also share personal information:

• With Your direction or consent, for example when You enable an integration or instruct Us to share information with a third party.
• For legal reasons, when We believe in good faith that disclosure is required by law, legal process, or government request, or is necessary to protect Our rights, the safety of users, or the integrity of the Service.
• In a business transaction, such as a merger, acquisition, financing, reorganization, or asset sale. We will provide notice and ensure the recipient honors this Policy or provides comparable protection.
• With affiliates, who are required to honor this Policy.

5. We Do Not Sell or Share Personal Information for Cross-Context Behavioral Advertising

We do not sell personal information, and We do not share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"), or under similar laws in other states. We also do not knowingly sell or share the personal information of consumers under the age of 16.

6. How Long We Keep Information

We retain personal information only as long as needed for the purposes described in this Policy, subject to legal obligations:

• Account information — for the life of Your Account and a reasonable wind-down period after closure.
• QuickBooks Online mirrored data — for the life of Your authorized connection. We delete or de-identify mirrored data within thirty (30) days after You disconnect, subject to backups (see below).
• Backups — operational backups are retained for up to ninety (90) days and then expire automatically.
• Audit and security logs — typically retained for up to one (1) year for security, incident response, and abuse-prevention purposes.
• Analytics data — retained in PostHog according to Our configured retention (currently up to twelve (12) months at event-level granularity, longer in aggregated form).
• Marketing communications — until You opt out, plus a suppression record to honor Your opt-out.
• Records required for legal, tax, or accounting compliance — for the period required by applicable law.

7. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, audit logging, and regular security review as part of Our participation in Intuit's developer security audit program. No security measure is perfect; You access the Service at Your own risk and are responsible for keeping Your credentials confidential.

8. International Transfers

The Service is operated from the United States. If You access the Service from outside the United States, Your information will be transferred to and processed in the United States. By using the Service, You consent to the transfer of Your information to a jurisdiction whose data protection laws may differ from those in Your jurisdiction. Where required by law (for example, for transfers from the European Economic Area, United Kingdom, or Switzerland), We will use appropriate safeguards such as Standard Contractual Clauses.

9. Your Rights and Choices

9.1 Rights for All Users

You may:

• Access, review, and update Your Account information from within the Service;
• Disconnect the Service from Your Intuit account at any time, which will end Our access to QuickBooks Online data on Your behalf;
• Close Your Account and request deletion of associated personal information;
• Opt out of marketing communications by following the unsubscribe link in any marketing email or by emailing Us; transactional and operational messages (security notices, billing, service updates) may continue.

To exercise any of these rights, email founders@lightweightlabs.com. We may need to verify Your identity before fulfilling a request and will respond within the time required by applicable law (generally 45 days for U.S. state-law requests). We will not discriminate against You for exercising Your rights.

9.2 California Residents (CCPA / CPRA)

If You are a California resident, You have the right to:

• Know the categories and specific pieces of personal information We have collected about You, the sources, the purposes for collection, and the third parties with whom We share it;
• Delete personal information We have collected about You, subject to exceptions permitted by law;
• Correct inaccurate personal information We hold about You;
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising — We do not sell or share (see Section 5), so no opt-out is required; and
• Limit the use and disclosure of sensitive personal information — We do not use or disclose sensitive personal information beyond what is permitted under CCPA § 1798.121(a) without further use limits.

You may exercise these rights by emailing Us at founders@lightweightlabs.com. You may designate an authorized agent to make a request on Your behalf with written authorization. We will not discriminate against You for exercising Your rights.

Categories of personal information collected in the past 12 months (CCPA § 1798.140 categories): identifiers (name, email, IP address, account identifiers); commercial information (Service usage); internet/network activity (browsing within the Service, device/usage information); professional/employment-related information when present in QuickBooks Online data You authorize Us to access (e.g., vendor or employee records); and inferences drawn from the foregoing. We collect this information from You, from Intuit (with Your authorization), and automatically from Your use of the Service. We disclose this information to the categories of recipients described in Section 4.

9.3 Virginia, Colorado, Connecticut, Utah, Texas, and Other U.S. State Privacy Laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states with comprehensive consumer privacy laws have rights similar to those described above, including the rights to access, correct, delete, and obtain a portable copy of personal information, and to opt out of targeted advertising, sale, and certain types of profiling. We do not engage in targeted advertising, sale, or profiling that produces legal or similarly significant effects. To exercise rights, email Us at founders@lightweightlabs.com. You may appeal a decision regarding a request by replying to Our response with the word "appeal" in the subject line; if Your appeal is denied, You may contact Your state attorney general's office.

9.4 European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

If You are located in the EEA, UK, or Switzerland, Our legal bases for processing are:

• Contract — to provide the Service You requested;
• Legitimate interests — to secure, debug, and improve the Service, prevent fraud, and operate Our business, balanced against Your rights;
• Consent — for marketing communications and optional cookies, where required; and
• Legal obligation — to comply with applicable law.

You have the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to withdraw consent at any time. You also have the right to lodge a complaint with Your local supervisory authority. To exercise these rights, contact founders@lightweightlabs.com.

10. Children's Privacy

The Service is intended for use by businesses and adults. It is not directed to children, and We do not knowingly collect personal information from anyone under the age of 18. If You believe a minor has provided Us with personal information, please contact Us and We will take appropriate steps to delete it.

11. Marketing and Email Choices (CAN-SPAM)

We may send You marketing emails about the Service and related products, with Your consent where required. Every marketing email includes an unsubscribe link. You can also email founders@lightweightlabs.com to opt out. Transactional and operational messages — security notices, billing, important service announcements, and responses to Your requests — will continue regardless of marketing preferences.

12. Links to Other Websites

The Service may link to websites operated by third parties. We have no control over and are not responsible for the privacy practices of those websites; You should review their privacy policies.

13. Changes to This Policy

We may update this Policy from time to time. If We make a material change, We will provide notice by email or in-product notice, and We will update the "Last updated" date at the top. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

14. Contact

For privacy-related questions or to exercise Your rights:

• By email: founders@lightweightlabs.com
• By mail: Lightweight Labs LLC, 17 East 13th Street, Suite 7B, New York, NY 10003