Privacy Policy

1. Who we are and what this covers

Anfa Holdings LLC, a Wyoming limited liability company doing business as anfa (“anfa”, “we”, “us”), provides finance-operations services and software that gives you a read-only link between your QuickBooks Online company and the tools you choose. This policy covers the getanfa.com website, your account at api.getanfa.com, the anfa software, and our advisory engagements. It explains what personal data we collect, how we use and share it, and the choices you have.

Contact for anything in this policy: hello@getanfa.com.

2. Defined terms

Personal Data

Information that identifies you or could reasonably be linked to you.

Visitor

Someone who browses getanfa.com without an account.

Account Holder

Someone who has created an account with us.

Connected Company

A QuickBooks Online company an Account Holder has authorised us to read.

Report Data

Reports and records retrieved from a Connected Company at your request, or at the request of a tool using your API key.

Processor

A third party that handles data on our behalf and under our instructions.

3. Personal data we collect, and why

3.1 Visitors

The website is static and sets no tracking cookies. Our hosting provider records aggregate request metrics. When you email us or book a session, we receive what you choose to share — typically your name, work email, company and a description of your needs — and we use it to respond and to run the engagement you asked about. Inquiries sent through the contact form are stored in our systems so we can follow up.

3.2 Account Holders

When you create an account we collect your company name, your email address and a password, which we store only as a salted one-way hash. We record when the account was created and when you last signed in, and we keep a short-lived record of failed sign-in attempts to protect the account from guessing. Sign-in and sign-up forms are protected by Cloudflare Turnstile, which may process technical information about your browser to tell people from bots. We use this data to operate your account, secure it, and contact you about the service.

3.3 Billing

Payments are handled by Stripe. When you start a trial or subscription, Stripe collects your card details directly; we never receive or store card numbers. We store Stripe’s identifiers for your customer record and subscription, the plan you chose, and the subscription’s status, so that your account reflects what you have paid for. Stripe processes your payment data under its own privacy policy.

3.4 Connected Companies

When you connect a QuickBooks Online company, Intuit sends us an access token and a refresh token for that company together with its QuickBooks company identifier. We store the tokens encrypted, the company identifier, the company name, a hashed copy of the API key we issue to you, and timestamps of when the connection was created, refreshed and last used. We never see or store your Intuit password. We use this data solely to keep the connection working and to retrieve the Report Data you request.

4. Report data

Report Data is retrieved from QuickBooks Online only when you, or a tool acting with your API key, ask for it. It is passed through to that request and is not stored by anfa. When you point a spreadsheet, an AI assistant or another application at your API key, the Report Data you request is delivered to that tool and becomes subject to that provider’s terms. You decide which tools to connect.

5. How we share personal data

We share personal data only as described here. We do not sell it.

• Intuit operates QuickBooks Online and the sign-in you use to authorise a connection, under Intuit’s own terms and privacy policy.
• Stripe processes payments and holds your card details.
• Cloudflare hosts the website and the software, including the encrypted connection store, and provides Turnstile abuse prevention.
• Tools you connect receive the Report Data you request through them.
• Our team, including contractors, may handle your information under confidentiality obligations to deliver the services you engage us for.
• Legal and safety. We may disclose information where the law requires it, or to protect the rights, property or safety of anfa, our clients or others.
• Business transfers. If anfa is involved in a merger, acquisition or sale of assets, your data may be transferred as part of it; we will notify you before your data becomes subject to a different privacy policy.

6. Legal bases

We process personal data to perform our contract with you (operating your account, connections and subscription), to pursue our legitimate interests (securing the service, preventing abuse, improving it), to comply with legal obligations (tax and accounting records), and, where required, with your consent. We comply with the privacy laws that apply to us, including applicable US state privacy laws and, for clients in Canada, Canadian federal and provincial privacy legislation where it applies.

7. Security

QuickBooks tokens are encrypted at rest with a key held separately from the database. Passwords are stored only as salted one-way hashes. API keys are stored only as one-way hashes; the key itself is shown once and cannot be recovered, only rotated. All traffic uses HTTPS. The software only ever reads from QuickBooks; it contains no code path that creates, changes or deletes records in your books. Treat your API key like a password: anyone holding it can read the connected company’s reports.

8. Retention and deletion

• Connection data is kept while the connection is active. When you disconnect — from inside QuickBooks or through your account — the tokens are revoked with Intuit and the connection record is deleted.
• Account data is kept while your account exists. Ask us to close your account and we will delete it, subject to the records we must keep by law.
• Billing records are kept for as long as tax and accounting law requires.
• Correspondence and engagement records are kept for as long as needed to serve you and to meet our legal obligations.
• Sign-in attempt records expire automatically within a short period.

9. International transfers

Our processors — Cloudflare, Stripe and Intuit — operate globally, so your data may be processed outside the country where you live. Each is bound by its own privacy commitments and, where applicable, by data-transfer safeguards. Report Data passes through our processors only transiently and is not stored by anfa in any country.

10. Your rights and choices

• Disconnect any company at any time, from QuickBooks (Apps → My apps) or from your account. The link stops working immediately.
• Rotate an API key from your account if you believe it has been exposed.
• Cancel your subscription at any time from your account.
• Access, correct or delete the personal data we hold about you, or object to or restrict its processing, by emailing hello@getanfa.com. We will respond within 30 days and honour the rights available to you under applicable law. If you are not satisfied, you may complain to the privacy regulator where you live.

11. Cookies

The website sets no tracking or advertising cookies. The software uses only cookies that are strictly necessary: a session cookie once you sign in, a short-lived cookie that protects forms against forgery, and a short-lived cookie during the QuickBooks connect flow. None is used for tracking.

12. Children

Our services are for businesses and are not directed at children under 16. We do not knowingly collect information from them.

13. Updates to this policy

We will post changes to this policy on this page and update the date at the top. For material changes affecting Account Holders, we will also email the address on your account before they take effect.

14. Contact

Anfa Holdings LLC, a Wyoming limited liability company
[registered address]
Questions or requests: hello@getanfa.com