HD Retail Privacy Policy

1. Scope

This Privacy Policy applies to information processed through HD Retail, its associated websites, and its authorized integrations.

HD Retail is intended for business use. The business subscribing to HD Retail controls the information entered into the Application and determines which users and third-party accounts may be connected.

For personal information processed on behalf of a business customer, H&D generally acts as a service provider or data processor. The business customer remains responsible for its own privacy practices and legal obligations concerning its customers, employees, and other individuals.

2. Information We Collect

Depending on how HD Retail is configured and used, we may collect or process the following information.

Business and user information

• Business name, location, address, and contact information.
• User names, business email addresses, roles, permissions, and authentication information.
• Account settings, integration settings, and application preferences.
• Information submitted in support requests or other communications.

Retail and operational information

• Inventory records, product descriptions, pricing, costs, images, barcodes, and stock information.
• Sales, returns, discounts, taxes, fees, payment methods, payouts, and deposit information.
• Customer, vendor, memo, repair, job, layaway, commission, and employee information entered into or received by the Application.
• Store, location, register, and transaction identifiers.
• Reports, summaries, and other information generated through the Application.

Integration information

• Third-party company and account identifiers.
• Account mappings and synchronization settings.
• OAuth access and refresh tokens.
• Webhook information and integration events.
• Synchronization history, transaction identifiers, and error information.

Technical information

• IP address, browser type, device information, operating system, and session information.
• Application activity, timestamps, audit records, and feature usage.
• API request metadata, system logs, diagnostic information, and error reports.
• Cookies and similar technologies used for authentication, security, application functionality, and performance monitoring.

3. Plaid and Financial Account Data

HD Retail uses Plaid to allow authorized business users to connect financial accounts to the Application.

When a financial account is connected through Plaid, HD Retail may receive:

• Financial institution name.
• Account name, type, subtype, and masked account identifier.
• Plaid account and Item identifiers.
• Current or available account balances, when enabled.
• Transaction dates, amounts, descriptions, merchant or payee information, categories, locations, and pending status.
• Connection status, synchronization information, and related technical data.

HD Retail uses this information to:

• Import and display authorized bank activity.
• Identify and reconcile Shopify deposits and other business transactions.
• Match deposits with accounting records.
• Create financial summaries and reports.
• Support authorized accounting and reconciliation workflows.
• Detect duplicate records and troubleshoot synchronization issues.

HD Retail does not receive or store the online banking usernames or passwords entered by users through Plaid Link. Those credentials are handled by Plaid and the applicable financial institution.

We do not sell financial account information or use it for third-party advertising.

By choosing to connect a financial account, the user authorizes Plaid to access and transmit permitted financial information to HD Retail. Plaid's handling of information is governed by Plaid's End User Privacy Policy.

4. Shopify Data

When a customer connects Shopify, HD Retail may receive information through Shopify APIs and webhooks, including:

• Products, inventory, variants, and location information.
• Orders, sales, returns, refunds, discounts, and taxes.
• Payment methods, processing fees, payouts, and deposit events.
• Customer and transaction information necessary to provide authorized retail features.
• Shopify account, store, transaction, and location identifiers.

HD Retail uses Shopify information to operate inventory, sales, reporting, accounting, reconciliation, and other workflows authorized by the customer.

Where possible, HD Retail sends summarized accounting information to QuickBooks rather than individual Shopify transaction details.

5. QuickBooks Data

When a customer connects QuickBooks Online, HD Retail may access:

• QuickBooks company identifiers.
• Chart-of-accounts information.
• Account names, account numbers, and account mappings.
• Journal entries and related accounting information.
• Transaction identifiers and synchronization status.

HD Retail accesses QuickBooks information only as authorized by the customer and as reasonably necessary to provide accounting and synchronization features.

We do not sell QuickBooks data.

6. How We Use Information

We use information to:

• Provide, operate, maintain, and improve HD Retail.
• Authenticate users and administer permissions.
• Connect services authorized by the customer.
• Manage inventory, retail operations, and accounting workflows.
• Import, calculate, display, and synchronize financial information.
• Reconcile bank activity, deposits, sales, fees, returns, and taxes.
• Create authorized reports, summaries, and accounting entries.
• Maintain customer-selected mappings, configurations, and preferences.
• Detect duplicate transactions and prevent incorrect postings.
• Maintain audit records and synchronization history.
• Provide customer support and troubleshoot errors.
• Monitor performance and improve Application functionality.
• Protect HD Retail, its customers, and connected services from unauthorized access, fraud, misuse, and security threats.
• Comply with contractual, accounting, regulatory, and legal obligations.

We do not use customer financial information for unrelated advertising or marketing purposes.

7. How We Share Information

We may share information only as reasonably necessary to operate HD Retail or comply with applicable obligations.

Information may be shared with:

• Plaid, when a user connects or manages a financial account.
• Shopify, when necessary to operate the authorized Shopify integration.
• Intuit QuickBooks, when the customer directs HD Retail to retrieve, create, or update accounting information.
• Hosting, infrastructure, database, security, monitoring, logging, email, and support providers that process information on our behalf.
• Professional advisers, auditors, insurers, or governmental authorities when required by law or reasonably necessary to protect legal rights.
• A successor entity in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to applicable privacy requirements.

Service providers are permitted to process information only for the services they provide to us and are expected to protect it appropriately.

We do not sell personal information, customer accounting information, or financial account information. We do not share this information for cross-context behavioral advertising.

8. Data Retention

We retain information only for as long as reasonably necessary to:

• Provide HD Retail and its authorized features.
• Maintain accounting, reconciliation, synchronization, and audit history.
• Fulfill customer instructions and contractual obligations.
• Protect the security and integrity of the Application.
• Resolve disputes and enforce agreements.
• Comply with accounting, regulatory, and legal requirements.

Retention periods may vary according to the type of information, the customer's configuration, contractual requirements, and applicable law.

When an integration is disconnected, HD Retail stops future access through that connection and removes or invalidates the associated access credentials. Previously imported records may be retained when requested by the customer or when reasonably necessary for accounting records, audit history, security, dispute resolution, or legal compliance.

When information is deleted, it is removed from our active production systems first and then from routine backups as those backups are cycled and overwritten. Backup copies are retained for no longer than ninety (90) days. Information that remains in a backup is not returned to active use and stays subject to the security safeguards described in this policy for as long as it is retained.

9. Disconnecting Financial Accounts

Authorized users may disconnect a financial institution from HD Retail or contact us for assistance.

When a Plaid-connected account is disconnected:

• HD Retail stops retrieving new financial information through that connection.
• The associated Plaid connection is removed.
• The related access token is deleted or invalidated.
• Previously imported information is handled according to the retention practices described in this policy.

Users may also manage certain Plaid connections through Plaid Portal.

Disconnecting a financial account does not automatically remove accounting entries or other records previously created in Shopify, QuickBooks, or another third-party service.

10. Data Security

We maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

These safeguards include, where appropriate:

• Encryption of information in transit and at rest.
• Role-based access controls and least-privilege access.
• Secure storage of integration credentials and tokens.
• Authentication and session controls.
• Logging, monitoring, and audit records.
• Backup and recovery procedures.
• Vulnerability management and system updates.
• Restrictions on employee and contractor access.

No system can guarantee absolute security. Customers are responsible for protecting their devices, credentials, user permissions, and connected third-party accounts.

Customers must promptly notify us if they believe an account or integration has been compromised.

11. Customer Responsibilities and Control

Business customers control:

• Which users may access HD Retail.
• The roles and permissions assigned to those users.
• Which financial institutions, Shopify stores, QuickBooks companies, and other services are connected.
• The business information entered into the Application.
• The purposes for which the customer uses information obtained through HD Retail.

Customers are responsible for providing any notices and obtaining any permissions or consents required from their customers, employees, vendors, or other individuals whose information they process through HD Retail.

12. Access, Correction, and Deletion Requests

Users and business customers may contact us to request access to, correction of, or deletion of information maintained directly by H&D. Requests may be sent to the address or email address in the Contact Us section below.

We acknowledge requests within ten (10) business days of receipt and respond substantively within forty-five (45) days. Where applicable law permits, we may extend that period by an additional forty-five (45) days, and we will notify the requester of the extension and the reason for it before the first period ends. We do not charge a fee for responding to a request unless it is excessive, repetitive, or manifestly unfounded, in which case we will explain the charge before proceeding.

Before acting on a request, we may ask for information reasonably necessary to verify the requester's identity and, where someone is acting on another person's behalf, their authority to make the request. Information provided for verification is used only for that purpose.

Some requests may need to be submitted to the applicable business customer because that customer controls the information processed through its HD Retail account. When we receive a request that belongs with a business customer, we forward it to that customer and tell the requester we have done so.

We may retain certain information when reasonably necessary to:

• Comply with accounting or legal obligations.
• Maintain security and audit records.
• Complete authorized transactions.
• Detect or prevent fraud and misuse.
• Resolve disputes.
• Enforce contractual rights.

Requests concerning information maintained independently by Plaid, Shopify, QuickBooks, a financial institution, or another third party must be directed to that organization.

13. Cookies and Analytics

HD Retail uses cookies, session technologies, and similar tools as necessary for:

• Authentication and session management.
• Application security.
• Remembering user preferences.
• Maintaining Application functionality.
• Measuring performance and diagnosing errors.

We do not use customer financial information for third-party behavioral advertising.

14. Children's Privacy

HD Retail is intended for business use and is not directed to children under 18. We do not knowingly collect personal information directly from children through the Application.

15. State and International Privacy Rights

Depending on a person's location and applicable law, they may have rights concerning access, correction, deletion, portability, restriction, or objection to certain processing of personal information.

Requests may be submitted using the contact information below. We may need to verify the requester's identity and authority before completing a request.

We will not discriminate against an individual for exercising a privacy right provided by applicable law.

16. Third-Party Services

Plaid, Shopify, Intuit QuickBooks, financial institutions, and other third-party services maintain their own privacy policies and terms.

H&D is not responsible for how third-party services process information outside our control. Customers and users should review the privacy policies and terms of each connected service.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to HD Retail, our integrations, our data practices, or applicable requirements.

When we make material changes, we will update the effective date and provide notice when required by applicable law.