Privacy Policy.

1. Who we are

First Light ("First Light", "we", "us") is a custom software and automation firm based in Mount Maunganui, New Zealand. We build and operate software integrations that connect business systems such as QuickBooks Online, Unleashed, Shopify and Cin7 for our business clients.

This policy covers:

• this website, firstlight.dev; and
• our integrations, the software we build and run that connects to a client's accounts in third-party systems (each an "Integration"), including any Integration that connects to Intuit QuickBooks Online.

We handle personal information in line with the New Zealand Privacy Act 2020. Where we handle personal information about people in Australia, we also follow the Australian Privacy Principles where they apply to us.

2. Information we collect

Through this website

• Information you send us. If you email us, we receive your name, email address and anything you choose to include in the message.
• Technical information. Our hosting provider, Cloudflare, processes standard request data such as IP address, browser type and the pages requested in order to serve and protect the site. Fonts are loaded from Google Fonts, which receives your IP address when your browser requests them.

This website does not use analytics, advertising or tracking cookies, and it has no forms.

Through our Integrations

When a client connects an Integration to one of their accounts, we process data from that account on the client's behalf, to deliver the service they have engaged us for. For a QuickBooks Online Integration this may include:

• Connection credentials: OAuth access and refresh tokens issued by Intuit and the QuickBooks company ID (realm ID). We never see or store your Intuit password.
• Accounting records the Integration needs to do its job, such as bills, bill numbers, totals, currencies, dates and vendor names.
• Matching records from connected systems, for example purchase orders, supplier invoice references and totals read from Unleashed.
• Operational logs recording what the Integration read, changed or skipped, used for troubleshooting and audit.

Business records like these can contain personal information, for example the name of a sole-trader supplier or a contact person. We only access the data scopes needed for the Integration to work.

3. How we use information

• To provide, operate, monitor and support the Integration a client has engaged us for: for example, reading QuickBooks bills and correcting bill numbers to match supplier invoice references.
• To respond to enquiries and communicate with clients.
• To keep our systems secure and to diagnose faults.
• To meet our legal obligations.

We do not sell personal information, use client data for advertising, or use data obtained through QuickBooks Online or any other connected system for any purpose other than delivering the client's Integration.

4. Who we share information with

We share information only with the service providers that host and run our systems, and only as far as they need it:

• Google Cloud / Firebase: hosts our Integrations, stores connection credentials and keeps operational logs. Data may be stored in the United States.
• Cloudflare: hosts and protects this website.
• The systems you connect, such as Intuit QuickBooks Online and Unleashed. Data moves between these systems as the Integration requires. Their own privacy policies govern how they handle data.

We may also disclose information where the law requires it, or with the client's consent.

5. Overseas storage

Some of our service providers store or process data outside New Zealand, including in the United States and Australia. We use providers that apply security safeguards comparable to those required by the New Zealand Privacy Act 2020.

6. Security

• All data is encrypted in transit (HTTPS/TLS) and at rest by our hosting provider.
• OAuth tokens are stored in a database that is closed to all client-side access and can only be reached by our server-side code.
• Access to production systems is restricted to the First Light staff who build and support the Integration.
• Integrations request only the access they need, and the Integrations we build for QuickBooks never write to systems they only need to read.

If a privacy breach is likely to cause serious harm, we will notify the affected client, affected individuals and the Office of the Privacy Commissioner as the law requires.

7. How long we keep information

• Connection credentials are kept while the Integration is connected. When a client disconnects or ends the engagement, we delete them. A client can also revoke access at any time from their Intuit account (Apps › Connected apps), which invalidates the tokens immediately.
• Operational logs are kept for 30 days (our hosting provider’s standard log retention), then deleted automatically.
• Accounting records are read for processing and are not copied into a separate store of our own, apart from what appears in operational logs.
• Email correspondence is kept for as long as needed for the business relationship and our record-keeping obligations.

8. Your rights

You can ask to see the personal information we hold about you and ask us to correct it. Where we process data on a client's behalf, we will help that client respond to your request. Contact us at enquiries@firstlight.dev. We will respond within 20 working days.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner in New Zealand or, in Australia, to the Office of the Australian Information Commissioner.

9. Changes to this policy

We may update this policy from time to time. The current version is always published on this page, with the date it was last updated.

10. Contact

First Light
Mount Maunganui, New Zealand
enquiries@firstlight.dev