Privacy Policy

Lightdrop, Inc. (“Lightdrop”, “we”, “us”) runs the website lightdrop.com and an internal application, Lightdrop HQ, at hq.lightdrop.com. This policy says what personal information we collect through them, how we use it, and the choices you have. It also describes how Lightdrop HQ connects to QuickBooks Online, a service of Intuit Inc., to read Lightdrop's own books.

Who this policy is for

• Visitors to lightdrop.com.
• Clients and their teams who open the password-protected pages, reports and dashboards we share on hq.lightdrop.com.
• Lightdrop's own team members who sign in to HQ.

The QuickBooks Online connection

Lightdrop HQ connects to one QuickBooks Online company: Lightdrop's own. It does not connect to, read or hold any other company's books. No QuickBooks data of one customer is ever shared with another, because there is only one.

What the connection is. HQ uses Intuit's OAuth 2.0 authorization with the accounting scope only. We do not request an Intuit ID or any sign-in information beyond that authorization.

What it reads. When Lightdrop's owner opens the QuickBooks page in HQ, HQ reads: the company's name and settings; bank and credit card account balances; open invoices, with the customer's name, invoice number, amounts and dates; open bills, with the vendor's name, amounts and dates; the profit and loss report by month for the current year; the current month's purchases and bills; and payments received in the last 30 days, with the customer's name, amount and payment method.

What it does with the data. HQ shows those figures on one page to Lightdrop's owner and to no one else. It never writes to the books: every request to QuickBooks is a read, and our automated checks fail if that changes. QuickBooks data is not used for advertising, not sold, not shared with clients or other companies, and not sent to any artificial intelligence service.

What it stores and for how long. A summary of the figures is cached for ten minutes, then expires; HQ keeps no history of the books. The connection itself (the access token, the refresh token and the company identifier) is stored encrypted with AES-256-GCM in our datastore until the connection ends. Nightly backups of that datastore are kept for up to one year and may include the encrypted connection and a cached summary that existed at the time of the backup.

Who can see it. Only Lightdrop's owner, signed in to HQ with a Google account on our allowlist. Other team members cannot open the page or any figure from it.

Ending the connection. The owner can disconnect at any time from the QuickBooks page in HQ, which revokes the authorization with Intuit and deletes the stored connection and the cached summary. The connection can also be removed from inside QuickBooks Online (Apps, then My apps); HQ then loses access and holds nothing usable.

Intuit's own handling of QuickBooks data is governed by Intuit's privacy statement, not by this policy.

The website, lightdrop.com

• Server logs and basic analytics: the pages you visit, your approximate location from your network address, and your browser and device type. We use Google Analytics and HubSpot for this. The site also loads the Google Ads tag and the Meta Pixel, which tell us whether our advertising led to a visit or an inquiry.
• Forms: when you contact us or ask for a call, we collect what you enter, usually your name, email address, company and message, and use it to reply. Form entries and newsletter sign-ups are stored in HubSpot, and the notification and reply emails are sent through Resend.
• Cookies: those set by Google Analytics, Google Ads, the Meta Pixel and HubSpot, which measure visits and advertising. The site sets no other cookies.

Pages we share with clients on hq.lightdrop.com

When we share a report, dashboard or page with a client, it is protected by a password. When you open one, we collect usage information, such as when it was opened, how it was viewed, and the browser and IP address used. A sign-in cookie keeps you signed in on that browser for 30 days. The password form uses Google reCAPTCHA to block automated guessing, and Google's privacy policy applies to that service. We place no advertising cookies.

Lightdrop's team

Team members sign in to HQ with Google. HQ stores the account's email address, name and profile picture, what each person may access, and the work they record in HQ.

Service providers

We use these companies to run our services, and each processes data only to provide its service to us: Vercel (hosting, United States); Upstash (datastore); Amazon Web Services (file storage and backups, United States); Neon (database); Google (sign-in, reCAPTCHA and Workspace email); Intuit (QuickBooks Online, as described above); Slack (team notifications); and AI services from Anthropic and OpenAI, used in our internal tools. QuickBooks data never goes to those AI services. The website also uses HubSpot (forms, contact records and analytics) and Resend (email delivery). Google and Meta receive the analytics and advertising data described in the website section above and handle it under their own privacy policies.

Your choices

To ask what we hold about you, to correct it or to delete it, email hello@lightdrop.com. We answer within 30 days. If you are in California, the European Economic Area or the United Kingdom, you may have further rights under the CCPA, the GDPR or the UK GDPR, and the same address handles those requests. We do not sell personal information.

Security

All traffic is encrypted with HTTPS. Team sign-in goes through Google with an allowlist. Secrets live in our hosting provider's encrypted environment, tokens for connected services are encrypted at rest, client page passwords are stored as hashes, and access to the books is limited to one person.

Children

Our services are for businesses and are not directed to children under 13. We do not knowingly collect information from them.

Changes

We post changes on this page with a new date. If a change affects how we handle QuickBooks data, we also update our application's record with Intuit.

Contact

Lightdrop, Inc.
1370 N St Andrews Pl, Los Angeles, CA 90028
hello@lightdrop.com