Privacy Policy for Whetzel CPA Internal.
How our internal QuickBooks Online application handles client accounting data. This is separate from the website privacy policy.
Last updated: September 3, 2026
Whetzel & Co (“we,” “our,” or “the Firm”) operates an internal software application called Whetzel CPA Internal (the “Application”). This policy explains what data the Application accesses, how it is handled, and who it is shared with.
The Application is not a public product. It is a private, unlisted tool used solely by authorized personnel of the Firm to perform accounting, bookkeeping, and tax services for the Firm’s clients. It is not offered for sale, download, or use by anyone outside the Firm.
Who this policy covers
This policy describes our handling of data belonging to clients of the Firm whose QuickBooks Online company files are connected to the Application. Connection is made by the Firm’s owner acting under an engagement with the client.
What data the Application accesses
The Application connects to QuickBooks Online using Intuit’s OAuth 2.0 authorization with the com.intuit.quickbooks.accounting scope. Within a connected company file, this permits access to accounting records, including:
- Chart of accounts, journal entries, and the general ledger
- Customers, vendors, and employees named on transactions
- Invoices, bills, payments, deposits, transfers, and expenses
- Financial reports, including trial balance, balance sheet, and profit and loss
- Documents attached to transactions
The Application accesses only company files that have been explicitly authorized. It does not access banking credentials, and it cannot read the “For Review” bank feed queue, because Intuit does not expose that data to any third-party application.
What we do with it
Accounting data is used exclusively to deliver professional services the client has engaged the Firm to perform — bookkeeping, period-end close, reconciliation review, financial reporting, and tax preparation.
We do not sell client data, share it with advertisers, use it for marketing, or use it to build products or datasets offered to anyone else.
Third-party processing — please read this section
The Application uses Anthropic’s Claude to analyze accounting data. When the Firm asks the Application to perform work on a company file, the relevant accounting records are transmitted to Anthropic’s API for processing and returned to the Firm.
This means client accounting data is disclosed to Anthropic as a service provider. Anthropic processes this data under its commercial terms and does not use business API data to train its models. Clients who prefer their data not be processed this way should tell us, and we will perform that engagement without the Application.
No other third party receives client accounting data through the Application.
Where data is stored
- Authorization tokens (the credentials that permit access to a connected company file) are stored on Firm-controlled hardware, in files readable only by the Firm’s operating system account, and are never transmitted to any party other than Intuit.
- Accounting data is not warehoused. It is retrieved from QuickBooks Online as needed for the work at hand. Working files produced during an engagement — reconciliation workpapers, exception reports, trial balances — are retained with the Firm’s other engagement records under our normal professional retention practices.
- The Application does not operate a public server, and no client data is hosted on a public website or made accessible over the internet.
Client control
A client may revoke the Application’s access at any time, without contacting us, from within QuickBooks Online under Integrations → Manage integrations, by disconnecting “Whetzel CPA Internal.” Access ends immediately upon disconnection.
Clients may also ask us to disconnect on their behalf, or ask what data the Application has accessed for their file. We will answer.
Professional confidentiality
The Firm is a CPA practice and is bound by professional standards governing the confidentiality of client information, including the AICPA Code of Professional Conduct, and, for tax engagements, Internal Revenue Code § 7216 and § 6713. Nothing in this policy reduces those obligations. Where those standards require client consent before disclosing information to a third-party service provider, we obtain it.
Security
Access to the Application is limited to authorized Firm personnel. Authorization tokens are stored with restrictive file permissions on encrypted, Firm-controlled hardware. Tokens rotate regularly and expire if unused. Connections to Intuit and to Anthropic use TLS.
No system is perfectly secure. If we become aware of a breach affecting client accounting data, we will notify affected clients promptly and as required by applicable law.
Changes
If we change how the Application handles data, we will update this page and revise the date above.
Contact
Questions about this policy, or about what the Application has accessed for your company file:
Whetzel & Co Timothy Whetzel, CPA 3502 Britton Burrow Way Richmond, TX 77406 timwhetzel@cdvcpa.com