MarginTrace
Privacy Policy
MarginTrace reads your business data; it does not collect your customers’ personal data. The app reads sales, discount, refund, item-cost and staff records from your Clover account and summary profit-and-loss figures from your QuickBooks Online company — all read-only — to explain unexpected margin movement. It never requests your customers’ records, never stores customer names, contact details or payment card data, and never writes anything back to either system.
1. Who we are
MarginTrace (the “app”) is built and operated by Orumio (“we”, “us”).
| Operator | Orumio |
|---|---|
| Representative | Masanori Iwata |
| Address | Mitsuhashi Building 3F, 1-3-3 Kita-Aoyama, Minato-ku, Tokyo 107-0061, Japan |
| Contact | support@orumio.com |
| Telephone | We will disclose this without delay in writing or by email upon request. Please send requests to the contact address above. |
When you install the app from the Clover App Market, you are the controller of the data in your Clover and QuickBooks Online accounts, and we act as your processor: we process it only to provide the app to you, on your instructions. The terms of that relationship are set out in the End User License Agreement.
2. What the app processes
2.1 From Clover
Access to both platforms is granted by you through their official authorisation flows (OAuth). The app requests the minimum read scope each platform offers and performs read-only API calls; it has no code path that creates, changes or deletes records in Clover or QuickBooks Online. From Clover it reads:
- orders and their line items — amounts, quantities, dates, order state;
- discounts, including the recorded approver reference where your Clover point of sale captured one;
- refunds and credits — amounts and dates;
- inventory items, their listed amounts and their item costs;
- your staff list — employee names or nicknames and their Clover identifiers;
- merchant profile basics — business name, time zone, currency — and the app’s own subscription status.
The initial import covers the most recent 90 days; after that the app polls for new activity roughly daily.
2.2 From QuickBooks Online
- summary profit-and-loss figures per period — income, cost of goods sold, gross profit, expenses, net income, and the amounts left uncategorised;
- freshness metadata — the company’s book-close date and the time of the most recent transaction update. To find that time the app fetches the single most recently updated record of each sales and purchase transaction type and keeps only its “last updated” timestamp; nothing else from those records is stored or logged.
Beyond that timestamp check, the app does not read QuickBooks customer, vendor or employee records, invoice or bill contents, bank feeds, or payroll data — and it stores none of them. Intuit’s consent screen describes the standard accounting scope, which is broader than what the app actually requests from the API; QuickBooks Online offers no narrower read-only scope.
2.3 Deliberately not collected
- your customers’ personal data — no names, email addresses, phone numbers or postal addresses, from either platform;
- payment card data of any kind;
- transaction-level accounting detail from QuickBooks Online.
2.4 The personal data the app keeps
The app’s own database holds two kinds of personal data. The first is your staff list: the employee names or nicknames and identifiers read from Clover, plus the references linking orders, refunds and discount approvals to those identifiers. The second exists only if you ask for emails: the email address you enter on the Connections screen. It is never read from Clover or QuickBooks. Everything else the app stores is business data — amounts, dates, item names, computed findings — or opaque platform identifiers.
Staff references exist for one purpose: showing you where sales, discounts or refunds concentrate when margin moves. The app is deliberately built not to assign personal blame. A statement naming an account is only ever shown when the underlying platform recorded an explicit actor field, such as a discount’s approver, and it is always phrased as where activity is concentrated, never as who is responsible.
2.5 Stored by the app
| Data | Personal data? | Why it exists |
|---|---|---|
| Your Clover merchant identifier, business name, time zone, currency and installation status | No — business identifiers | Identifies your installation and the week boundaries a finding is computed on |
| Clover and QuickBooks refresh and access tokens, encrypted before they reach the database | No — credentials | Lets the app read your data on the weekly schedule while nobody is signed in |
| Orders, line items, discounts, refunds, inventory items and item-cost history imported from Clover | No, apart from the staff references in the next row | The record the weekly margin bridge is computed from, so a finding can be reproduced later |
| Your staff list — names or nicknames, Clover identifiers — and the references linking orders, refunds and discount approvals to them | Yes | Showing where activity concentrates when margin moves. Never sent to the AI service (§4) |
| Summary profit-and-loss figures per period and freshness metadata from QuickBooks Online | No | Cross-checking the computed movement against your books for the same month |
| The email address you enter for finding emails, and a record of each email sent — its kind, date, and whether it was sent or failed | Yes — only if you enter an address | Telling you when the first check of your imported weeks is done and when a week needs a look. Deleted when you stop emails |
| Findings, their contributions, the evidence behind each one and the feedback you give | Only by reference to the staff rows above | The product’s output and your record of what was investigated |
| Usage events — install, connection completed, finding surfaced, feedback given | No | Understanding whether the product works. Held in our own database and sent to no analytics service |
| Screen speed — for each button or link pressed, its kind (for example “open a finding”), the day, and how long the screen took to respond and to show the result | No — nothing identifies your store, your account or what was on the screen | Keeping the app fast. Held in our own database for 30 days and sent to no analytics service |
3. Why we process it
One purpose: to provide the app — evaluating whether your data can support trustworthy findings, computing the weekly margin bridge, and presenting verified contributors with their evidence — including, if you ask for it, emailing you when a week needs a look.
We do not, and the app has no mechanism to:
- use your data for marketing or advertising, or profile anyone for those purposes;
- sell or share your data with anyone;
- use your data to train machine-learning models;
- build cross-merchant analytics or audience products from your data.
The app makes no automated decisions about people. It computes arithmetic over your sales records and shows you the result; every number is produced by deterministic code, not by an AI model.
4. AI-assisted wording
After the numbers are computed, the app may ask our AI provider to phrase the finding’s summary in plain language. What is sent are the computed aggregate figures only: money movements, shares, contributor categories such as “discounts” or “product mix”, week dates, and the app’s own deterministic template sentences, which may name the products carrying a movement. Staff names are never sent to the AI service, and its output is machine-checked before display — any attempt to introduce new numbers, causal claims or person-level statements is rejected and a deterministic template is shown instead. Our use of that provider is under commercial terms that do not permit the data to be used for model training.
5. Who else processes it (sub-processors)
The app runs on a deliberately small set of services. There is no analytics SDK, no advertising technology, and no third-party script in the serving path.
Below, the providers we engage are described by what they do. Write to support@orumio.com for their names.
| Service | Role | Data it can see |
|---|---|---|
| Clover | The point-of-sale platform your sales run through | Your store data at the source, governed by your agreement with Clover |
| QuickBooks Online | The accounting platform your books live in | Your books at the source, governed by your agreement with Intuit |
| Our hosting provider (United States, primarily) | Application hosting, the database, scheduled jobs, runtime logs, and sending the finding emails you ask for | Everything the app stores, as listed above, at rest; data in transit while a request is served; the runtime logs described under logging; and, for each email, your address and its contents |
| Our AI provider (United States) | Wording of a finding’s summary sentence, after the numbers are computed | Computed aggregate figures only, as described in §4 — never staff names |
| Our email service (United States) | Receives and sends our email | What you write to support@orumio.com and the emails we send you |
Our database and application servers are located in the United States, primarily — the database is placed there with a location hint to our hosting provider — and requests are served from its global network. If you are in the European Economic Area or the United Kingdom, this means your data is transferred outside that region. We are established in Japan, which the European Commission and the United Kingdom have each recognised as providing adequate protection. Write to support@orumio.com if you need the details of the safeguards that apply to the onward transfer to our hosting providers.
6. How it is protected
- Minimisation first. Customer personal data is never read, so it can never be stored, logged, or breached here. From QuickBooks Online the app keeps period summaries and one timestamp, not transactions.
- Read-only by construction. The app requests read access, and its Clover and QuickBooks clients have no code path that creates, changes or deletes a record in either platform.
- Encryption in transit. The app is served only over HTTPS, and its calls to Clover and QuickBooks Online, and to our AI provider, use TLS. Its database is never reached over a network connection: our hosting provider hands the running app a binding to the database inside its own network, so there is no database endpoint, credential or connection string that could be intercepted or leaked.
- Encryption at rest. Our database provider encrypts all data and backups at rest. There is no self-managed backup or export pipeline.
- Credentials encrypted a second time. Your Clover and QuickBooks tokens are additionally encrypted with AES-256-GCM at the application layer before they reach the database, and the encryption key is managed outside the database. Refreshes are serialised per connection so a rotating token cannot be used twice.
- Tenant isolation. Every record is keyed to your installation, and every query filters through it.
- Access control. The app is operated by a single person. There are no staff accounts, contractors or support agents with access to merchant data. Every account with access is protected by two-factor authentication and a unique password stored in a password manager.
7. Logging
The app records usage events — install, connection completed, finding surfaced, feedback given — in its own database to understand whether the product works, and how quickly its screens answer each kind of press (the kind, the day and two durations, kept for 30 days); nothing is sent to any third-party analytics service. Operational logs record identifiers, counts, timestamps and errors — never access tokens, and never the contents of a record. Logs are held in our hosting provider’s runtime log storage.
8. Cookies and tracking
The app sets a signed session cookie (mt_session) that keeps you signed in for up to 14 days after you authorise through Clover, and — only during the authorisation round-trip itself — a short-lived state cookie that protects the OAuth flow against forged requests and is removed when the flow completes. When that sign-in starts from a link in one of our emails, a second short-lived cookie remembers which finding to return to, and is removed the same way. There are no advertising, analytics or tracking cookies.
9. How long it is kept
- While installed, your data is kept because it is the app: findings compare recent weeks against your own baseline history.
- When you uninstall, syncing stops immediately — the app reads nothing further from either platform.
- 30 days after uninstall, everything is permanently deleted: imported records, staff labels, computed findings, your email address and the encrypted credentials. The window exists so that a reinstall does not restart you from zero; reinstalling within it keeps your history, and the scheduled purge checks for that reinstall before it deletes anything.
- Your email address is deleted as soon as you stop emails — from the link in any email or on the Connections screen.
- Earlier deletion on request, at any time, by writing to support@orumio.com.
10. Requests from staff members
If you work at a business that uses the app and want to know what it holds about you: the answer is your name or nickname as entered in that business’s Clover account, its Clover identifier, and the references linking it to orders, refunds and discount approvals. Such requests belong first to your employer, who controls the source data in Clover; we support them in answering.
You can also write to us directly at support@orumio.com, and we will delete or correct data on your employer’s instruction.
11. Security incidents
If we confirm an incident affecting your data, we notify affected merchants directly and in plain language — what happened, what data was involved, what we have done, and what if anything you need to do — targeting within 72 hours of confirming it. We also report incidents to Clover and Intuit as their platform terms require, without waiting for a complete root-cause analysis.
12. Changes to this policy
If we change what the app does with data, we update this page and its version number before the change ships. Material changes are announced to merchants with an active installation.
13. Contact
Questions, requests, or anything that looks wrong in this policy: support@orumio.com.
MarginTrace · Version 1.6, 20 October 2026 · End User License Agreement
MarginTrace is an independent product of Orumio and is not affiliated with, endorsed by, or sponsored by Fiserv, Inc. or Intuit Inc. Clover and QuickBooks Online are trademarks of their respective owners.