CashFlow Privacy Policy
Maestro Assistance Comptable Inc.
36 rue Queen #402, Montréal, Québec H3C 2N5, Canada
Person in charge of the protection of personal information: Paulo Bottas, President
Contact: privacy@maestrocomptable.com
Effective date: 15-Sep-2026 · Version: 1.1
Ce document est également disponible en français. La version française prévaut.
1. What this policy covers
CashFlow is a cash-flow forecasting application operated by Maestro Assistance Comptable Inc. ("Maestro", "we", "us"). It connects to a business's QuickBooks Online company, keeps a copy of that company's accounting data, and produces a weekly cash-flow forecast for that business and for the Maestro professionals who serve it.
This policy explains what information CashFlow holds, why, where it is stored, who else touches it, how long we keep it, and what you can require of us. It applies to everyone who signs in to CashFlow and to the businesses whose QuickBooks data we hold.
It does not cover QuickBooks Online itself, which is operated by Intuit under its own privacy policy, or Maestro's accounting engagement with you, which is governed by your engagement letter.
2. What we collect
Account information. When you sign in, we receive your name, your email address and a unique identifier for your account from our identity provider. Your email is used to display who you are and to record who an invitation was issued for; it is never used as your account identifier, so two people sharing a mailbox remain two accounts. We do not collect or store passwords — authentication happens at the identity provider and we never see your credentials.
Session information. While you are signed in we hold a session record: a one-way hash of your session token, an expiry, and the identity assertion issued by the provider, which we keep only so that signing out of CashFlow also signs you out properly. The record is deleted when you sign out or when it expires. We do not log your IP address or your browser's user agent.
QuickBooks accounting data. Once a business authorizes the connection, we read from its QuickBooks company: the chart of accounts, company information and preferences, and money-movement documents — invoices, bills, payments, bill payments, deposits, purchases, journal entries, transfers, sales receipts, credit memos and vendor credits — together with the vendor and customer records those documents reference, and account balances. We also hold what we derive from that data: categorized transactions, balance observations over time, and the forecast itself.
We also keep, unchanged, the complete response QuickBooks returns for each record we read. That verbatim copy is only ever added to, never altered, and for invoices, sales receipts and customer records it can contain contact details — postal addresses, email addresses and telephone numbers — beyond the fields we use for the forecast.
Some of this is personal information. A sole proprietor's business is their livelihood; a vendor or customer record may name an individual. We treat the whole of it as confidential regardless of whether a given field is legally personal information.
Access credentials for QuickBooks. We hold the authorization tokens Intuit issues when a business connects. They are encrypted before they are stored, and each token is sealed against a label naming the legal entity it belongs to, so a token stored for one entity cannot be decrypted in the context of another. They are never displayed, logged or sent anywhere but to Intuit.
Your firm's professional judgment. Categories, classification rules and per-account overrides recorded by Maestro professionals in the course of serving you.
Change records. Changes to key records are logged with the identifier of the person who made them, so that a disputed figure can be traced. Secret values are stripped before a change record is written.
We do not collect anything else. CashFlow contains no analytics, no advertising technology, no tracking pixels and no third-party scripts. We do not buy information about you, and we do not enrich what you give us from outside sources.
3. Why we hold it
We hold this information for one purpose: to produce and maintain your cash-flow forecast and to let the people entitled to see it do so. Concretely, that means keeping the mirror of your accounting data current, categorizing money movements, computing the forecast, authenticating the people who sign in, controlling who can see which business's data, keeping the change records that make a figure traceable, and diagnosing failures when a synchronization breaks.
We do not use your information to market to you, we do not sell or rent it, we do not share it with anyone for their own purposes, and we do not use it to train machine-learning models.
No automated decisions about individuals. CashFlow forecasts a business's cash position. It does not make any decision about an individual based exclusively on automated processing — not about credit, employment, or anything else — and no individual profile is built from what it holds.
4. Who else touches it
We use a small number of service providers, each doing one thing:
| Provider | What they do | Where |
|---|---|---|
| Microsoft (Azure) | Hosts the application and the database holding all accounting data | Canada Central (Toronto), Canada |
| Microsoft (Entra External ID) | Authenticates people signing in; holds names, email addresses and sign-in records | United States |
| Microsoft (Microsoft 365) | Receives mail sent to our contact addresses. CashFlow itself sends no messages: an invitation is a link a Maestro administrator passes on to you by whatever channel they choose | Canada |
| Intuit | Operates QuickBooks Online, the source of the accounting data | Per Intuit's terms |
Beyond these, we disclose information only where the law requires it, or to our own professional advisors under a duty of confidentiality, and only what is necessary. We have never received a lawful demand for a client's data; if we receive one, we will notify the client unless the law forbids it.
Data outside Québec. Your accounting data is stored in Canada. Authentication data — your name, your email address and records of when you signed in — is stored by Microsoft in the United States, because Microsoft's identity service does not offer Canadian data residency for this type of tenant. We assessed this transfer before relying on it and rely on Microsoft's contractual commitments as the safeguard. No financial data ever reaches that service.
5. How long we keep it, and how to get it back or have it destroyed
We keep a business's information for as long as that business is active in CashFlow. The change records described above are kept for as long as the business they concern is in CashFlow, and are destroyed with it.
Account information — your name, your email address and the identifier our identity provider gives you — is kept for as long as your account exists, so that a past change stays attributable to a person rather than to an identifier nobody can read. A session record lasts only until you sign out or it expires.
Getting a copy. A firm administrator can export a copy of a business's data at any time, as a set of CSV files with a manifest: the business itself and its legal entities, the list of who has been granted access to it — including the email address each invitation was issued to — the bank accounts, the transactions and their lines, the balance history, vendors and customers, the document expectations, the categories and overrides, and the current forecast.
Not everything we hold is in the export. It leaves out the verbatim copy of what QuickBooks returned, because that data is already yours inside QuickBooks and can be exported from there; it also leaves out the change records, the firm-wide category list, the synchronization history and any projection errors.
Disconnecting. Disconnecting a QuickBooks company stops our reading immediately — we read nothing further from it — and we ask Intuit at the same time to revoke the authorization. We cannot promise that request always reaches Intuit: if the call fails we log it, disconnect anyway, and stop using the connection regardless. It does not by itself destroy what we have already copied, so that reconnecting later does not lose your history.
Destruction. On request, or when a business leaves, we destroy that business's data. The business's QuickBooks connection has to be disconnected first; destruction also will not run while a synchronization is under way, or while another business is still connected to the same QuickBooks company. Destruction is immediate and irreversible. What remains is a record that the destruction happened — who requested it, when, and how much was destroyed — and, for each export ever made of that business's data, a record that the export was served — who requested it, when, and which files it contained. Neither record carries any of the destroyed content. We keep them as proof that the destruction occurred and as a record of which exports were served before it.
Sign-in records held by Microsoft follow Microsoft's own retention for that service.
6. How it is protected
Everything travels over encrypted connections and is encrypted where it is stored. QuickBooks access tokens carry a second layer of encryption, and each one is sealed against a label naming the legal entity it belongs to, so a token stored for one entity cannot be decrypted in the context of another.
Separation between businesses is enforced by the database itself rather than by application code: every query runs in the context of the person making it, and data belonging to a business you cannot see returns nothing rather than an error that would confirm it exists. Where access has been granted for a single legal entity inside a business rather than for the whole of it, the same enforcement applies at that finer boundary. The application's database role holds only the privileges it needs; it cannot read the change log or alter historical observations, and the append-only history — the verbatim copy of what QuickBooks returned, the synchronization history, the balance observations and the change log — can be destroyed only through a single named, audited operation.
We hold no payment card information. CashFlow never writes to QuickBooks; our authorization is used to read.
7. Your rights
Under Québec's Act respecting the protection of personal information in the private sector, you may:
- access the personal information we hold about you;
- have it corrected if it is inaccurate, incomplete or ambiguous;
- have it destroyed, or withdraw a consent you gave;
- receive it in a structured, commonly used technological format, or have it communicated to someone else, where the law provides for it;
- be informed of the reasons behind a decision that concerns you, where one was made.
Write to privacy@maestrocomptable.com or to the postal address above. We respond within 30 days. There is no charge. These requests are handled by us on receipt; they are not self-serve features of the software. If you are not satisfied with our answer, you may complain to the Commission d'accès à l'information du Québec.
8. Cookies
CashFlow sets three cookies, all strictly necessary and all inaccessible to scripts in your browser: one that keeps you signed in, and two short-lived ones that protect the sign-in and QuickBooks connection flows against forgery. There are no analytics or advertising cookies, so there is nothing here for you to consent to or opt out of.
9. If something goes wrong
If a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information and the people concerned promptly, and we keep a register of confidentiality incidents as the law requires.
10. Changes
We will post any change to this policy here with a new effective date. If a change materially affects how we use information already collected, we will tell affected users directly before it takes effect.
11. Contact
Paulo Bottas, President Person in charge of the protection of personal information Maestro Assistance Comptable Inc. 36 rue Queen #402, Montréal, Québec H3C 2N5, Canada privacy@maestrocomptable.com