MarginTracePrivacy Policy
MarginTrace reads your business data; it does not collect your customers’ personal data. The app reads sales, discount, refund, item-cost, and staff records from your Clover account and summary profit-and-loss figures from your QuickBooks Online company — all read-only — to explain unexpected margin movement. It never requests your customers’ records, never stores customer names, contact details, or payment card data, and never writes anything back to either system.
1. Who we are
MarginTrace (the “app”) is built and operated by Orumio (“we”, “us”).
| Operator | Orumio |
|---|---|
| Representative | Masanori Iwata |
| Address | Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan |
| Contact | support@orumio.com |
| Telephone | Disclosed without delay in writing or by email upon request. Please send requests to the contact address above. |
When you install the app for your business, you remain the controller of the data in your Clover and QuickBooks Online accounts. We process that data only to provide the app to you, as described here.
2. What the app reads
Access to both platforms is granted by you through their official authorization flows (OAuth). The app requests the minimum read scope it needs and performs read-only API calls; it has no code path that creates, changes, or deletes records in Clover or QuickBooks Online.
2.1 From Clover
- Orders and their line items (amounts, quantities, dates, order state);
- discounts, including the recorded approver reference where your Clover point of sale captured one;
- refunds and credits (amounts and dates);
- inventory items, prices, and item costs;
- your staff list — employee names or nicknames and their Clover identifiers;
- merchant profile basics — business name, timezone, currency — and the app’s own subscription status.
The initial import covers the most recent 90 days; after that the app polls for new activity roughly daily.
2.2 From QuickBooks Online
- Summary profit-and-loss figures per period (income, cost of goods sold, gross profit, expenses, net income, uncategorized amounts);
- freshness metadata — the company’s book-close date and the time of the most recent transaction update. To find that time, the app fetches the single most recently updated record of each sales/purchase transaction type and keeps only its “last updated” timestamp; nothing else from those records is stored or logged.
Beyond that timestamp check, the app does not read QuickBooks customer, vendor, or employee records, invoice or bill contents, bank feeds, or payroll data — and it stores none of them. Intuit’s consent screen describes the standard accounting scope, which is broader than what the app actually requests from the API; QuickBooks Online offers no narrower read-only scope.
2.3 Deliberately not collected
- Your customers’ personal data — no names, email addresses, phone numbers, or postal addresses, from either platform;
- payment card data of any kind;
- transaction-level accounting detail from QuickBooks Online.
3. Personal data the app stores
The one category of personal data in the app’s own database is your staff list: the employee names or nicknames and identifiers read from Clover, plus references linking orders, refunds, and discount approvals to those identifiers. Everything else the app stores is business data — amounts, dates, item names, computed findings — or opaque platform identifiers.
Staff references exist for one purpose: showing you where sales, discounts, or refunds concentrate when margin moves. The app is deliberately built not to assign personal blame. A statement naming an account is only ever shown when the underlying platform recorded an explicit actor field (such as a discount’s approver), and it is always phrased as where activity is concentrated, never as who is responsible.
4. Why we process it
One purpose: to provide the app — evaluating whether your data can support trustworthy findings, computing the weekly margin bridge, and presenting verified contributors with their evidence. We do not, and the app has no mechanism to:
- use your data for marketing, advertising, or profiling;
- sell or share your data with anyone;
- use your data to train machine-learning models;
- build cross-merchant analytics or audience products from your data.
The app makes no automated decisions about people. It computes arithmetic over your sales records and shows you the result; every number is produced by deterministic code, not by an AI model.
5. AI-assisted wording
After the numbers are computed, the app may ask Anthropic’s Claude API to phrase the finding’s summary in plain language. What is sent are the computed aggregate figures only: dollar movements, percentages, contributor categories (such as “discounts” or “product mix”), week dates, and the app’s own deterministic template sentences — which may name the products carrying a movement. Staff names are never sent to the AI service, and its output is machine-checked before display — any attempt to introduce new numbers, causal claims, or person-level statements is rejected and a deterministic template is shown instead. Our use of the Anthropic API is under commercial terms that do not permit the data to be used for model training.
6. Who else processes it
The app runs on a deliberately small set of services. There is no analytics SDK, no advertising technology, and no third-party script in the serving path.
| Service | Role | Data it can see |
|---|---|---|
| Clover (Fiserv) | Your point-of-sale platform | Your store data at the source; governed by Clover’s own terms |
| Intuit | Your accounting platform | Your books at the source; governed by Intuit’s own terms |
| Vercel | Application hosting (United States) | Data in transit while a request is served, plus runtime logs (§8) |
| Neon | Managed Postgres database (United States) | Everything described in §2–§3, at rest |
| Anthropic | AI text generation (United States) | Computed aggregate figures only, as described in §5 — never staff names |
Our database and application servers are located in the United States; the operator is based in Japan. If your business is elsewhere, your data is processed in those locations.
7. How it is protected
- Minimisation first. Customer personal data is never read, so it can never be stored, logged, or breached here.
- Encryption in transit. The app is served only over HTTPS, and all platform and database connections use TLS.
- Encryption at rest. Our database provider encrypts all data and backups at rest.
- Credentials encrypted a second time. Your Clover and QuickBooks access tokens are additionally encrypted with AES-256-GCM at the application layer before they reach the database; the encryption key is managed outside the database.
- Tenant isolation. Every record is keyed to your installation, and every query filters through it.
- Access control. The app is operated by a single person; there are no staff accounts or support agents with access to merchant data. Every account with access is protected by two-factor authentication and unique generated passwords.
8. Cookies and logging
The app sets a signed session cookie (mt_session) that keeps you signed in for up to 14 days after you authorize through Clover, and — only during the authorization round-trip itself — a short-lived state cookie that protects the OAuth flow against forgery and is removed when the flow completes. There are no advertising, analytics, or tracking cookies.
The app records usage events (install, connection completed, finding surfaced, feedback given) in its own database to understand whether the product works; nothing is sent to any third-party analytics service. Operational logs record identifiers, counts, timestamps, and errors — never access tokens.
9. How long it is kept
- While installed, your data is kept because it is the app: findings compare recent weeks against your own baseline history.
- When you uninstall, syncing stops immediately — the app reads nothing further from either platform.
- 30 days after uninstall, everything is permanently deleted: imported records, staff labels, computed findings, and the encrypted credentials. The 30-day window exists so a reinstall does not restart you from zero; reinstalling within it keeps your history.
- On request, we delete your data earlier — write to support@orumio.com.
10. Requests from staff members
If you work at a business that uses the app and want to know what it holds about you: the answer is your name or nickname as entered in that business’s Clover account, its Clover identifier, and references linking it to orders, refunds, and discount approvals. Such requests belong first to your employer, who controls the source data in Clover; we support them in answering, and you can also write to us directly at support@orumio.com.
11. Security incidents
If we confirm an incident affecting your data, we notify affected merchants directly and in plain language — what happened, what data was involved, what we have done, and what if anything you need to do — targeting within 72 hours of confirming it. We also report incidents to Clover and Intuit as their platform terms require, without waiting for a complete root-cause analysis.
12. Changes to this policy
If we change what the app does with data, we update this page and its version number before the change ships. Material changes are announced to installed merchants.
13. Contact
Questions, requests, or anything that looks wrong in this policy: support@orumio.com.