Legal
Privacy Policy
DrillFi ("we," "us," or "our") provides budget-to-actual reporting and anomaly detection for QuickBooks Online. This policy covers this website and the DrillFi application. It explains what information we collect, how we use it, who we share it with, and the choices you have.
1. Information We Collect
Website visitors.
- Basic technical information that any web server receives, such as IP address, browser type, and pages requested. Our hosting provider records this in server logs.
- Website analytics from Google Analytics, described in the Cookies section below. Analytics cookies are used only if you accept them.
Early-access requests. If you submit the early-access form, we collect the details you enter: name, work email, firm or company, the option you are interested in, the number of QuickBooks files you work in, and any message you add. The form is processed by Formspree and delivered to us by email.
Account information. If you create an account or are invited to one, we store your name, email address, the company your account belongs to, the fiscal-year start month you choose, when you accepted our Terms and Privacy Policy, your last sign-in time, and your password. Passwords are stored only as a salted hash, never in readable form. If you ask to reset your password, we keep a one-way hash of the reset link's token until it expires or is used.
Sign-up and password-reset protection. To keep these pages from being abused, we use your IP address (held briefly in memory, not stored with your account) to limit repeated requests, and we use Cloudflare Turnstile to confirm that you are a person. Turnstile receives information about your browser and connection to make that decision.
QuickBooks Online data. If your company connects QuickBooks Online, DrillFi retrieves the data needed to build your reports through Intuit's API, using the access you authorize. This includes:
- Your chart of accounts, and company name and book-close date settings
- General ledger and transaction detail, including dates, amounts, memos, document numbers, and vendor, customer, class, and location names
- Invoices, bills, payments, bill payments, deposits, sales receipts, credit memos, and refunds, used for drill-down, payment-timing, and item-sales reports
- Item lists and item quantities sold
- Balance sheet data
Information you configure in DrillFi. Budgets and reforecasts you import, your P&L structure, account mappings, KPI definitions, and alert settings.
2. What We Don't Do
- We do not sell or rent your personal information or your QuickBooks data.
- We do not use your information for advertising, and we do not use advertising networks or tracking pixels.
- We do not use your QuickBooks data for any purpose other than providing DrillFi's reports and features to the company that connected it.
- We do not write to your QuickBooks file. DrillFi reads data; it does not create, edit, or delete anything in QuickBooks.
- The DrillFi application does not currently collect payment card or bank account information. The one-time Financial Check Up is paid through a payment link we email you after you request it; that payment is made on the payment provider's own page, outside the DrillFi application, and we do not receive your card details.
3. How We Use Information
- To provide, maintain, and support the DrillFi application, including syncing your QuickBooks data and generating budget-to-actual reports, drill-downs, KPIs, and anomaly flags
- To respond to early-access requests and follow up about access
- To create and manage accounts and invitations
- To send service emails, such as password-reset links and notices that your password was changed
- To keep the service secure, diagnose problems, and improve it
- To understand, in aggregate, how visitors use this website (if you accept analytics)
4. Who We Share Information With
We share information only with the service providers we use to run DrillFi, and only as needed to provide the service:
- Render — cloud hosting for the website and application. See Render's privacy policy.
- Supabase — database hosting, where account information, configuration, and synced QuickBooks data are stored. See Supabase's privacy policy.
- Intuit — when you connect QuickBooks Online, DrillFi exchanges data with Intuit's API. See Intuit's privacy statement.
- Cloudflare — network and security provider for drillfi.com. Traffic to the website and application passes through Cloudflare, and Cloudflare Turnstile protects the sign-up and password-reset forms. See Cloudflare's privacy policy.
- Google Workspace — email delivery for account messages (such as password-reset links) and our support inbox. See Google's privacy policy.
- Formspree — processes early-access form submissions and forwards them to us. See Formspree's privacy policy.
- Google Analytics — website analytics, used on the public pages only and never inside the logged-in application. See Google's privacy policy.
We may also disclose information if required by law or to protect our rights, or in connection with a sale or transfer of the business. Within a company's DrillFi account, information is visible to the users that company authorizes and, where an accounting firm manages the company, to that firm's authorized users.
5. Cookies and Similar Technologies
- Session cookie (application only) — after you sign in to the DrillFi application, a signed session cookie keeps you logged in. It is strictly necessary for the application to work. It stays valid for up to 12 hours, so closing your browser does not sign you out, and it is invalidated when you sign out or after 12 hours, whichever comes first.
- Analytics cookies (public pages, only if you accept) — if you choose "Accept analytics" in the cookie banner, Google Analytics sets cookies (named
_gaand_ga_followed by an identifier) to measure pages visited, session duration, and approximate location. This data is not used for advertising. - Your choice — we remember your cookie choice in your browser's local storage so we don't ask on every visit. You can change your choice at any time with the "Cookie settings" link in the footer of any public page. Choosing "Decline" also removes analytics cookies already set on your device.
Until you accept, Google Analytics runs with analytics storage switched off: it does not set analytics cookies. Google's servers still receive the technical information that any web request includes (such as your IP address and browser type); Google states that Google Analytics 4 does not log or store IP addresses. We do not use advertising or behavioral tracking cookies of any kind.
6. Data Security
Data is encrypted in transit using HTTPS. Our database provider states that stored customer data is encrypted at rest. Access to the application requires an account (created at sign-up or by invitation), and each account can see only the company data it is authorized to see. QuickBooks connection credentials are encrypted in our database (AES-256-GCM), with the encryption key kept separately from the database, and are used only by the application to communicate with Intuit's API. Signing out, or resetting your password, ends your sessions on all of your devices. No system is completely immune to risk, but we follow reasonable practices to protect your information.
7. Data Retention
- QuickBooks connection credentials — kept while your connection is active and permanently deleted when the connection is removed.
- Synced QuickBooks data and configuration — kept while your company's DrillFi account is active so reports and comparisons keep working. Disconnecting QuickBooks stops new syncs and revokes DrillFi's access, but reports already synced stay available until you cancel or ask us to delete them, so reconnecting picks up where you left off. Upon cancellation, we delete this data within 30 days. You can ask us to delete it sooner.
- Account information — kept while your account is active and deleted with your company's data.
- Password-reset tokens — stored only as a one-way hash; they expire after a short period (60 minutes by default), and expired ones are periodically deleted.
- Early-access requests — kept until you ask us to delete them.
- Server logs — retained by our hosting provider for a limited period for security and debugging.
8. Your Rights and Choices
You can:
- Ask for a copy of the personal information we hold about you
- Ask us to correct or delete it
- Change your analytics choice at any time using "Cookie settings" in the footer
- Revoke DrillFi's access to your QuickBooks company at any time from the connected-apps section of your Intuit account, or ask us to disconnect it
To make a request, email us at hello@drillfi.com.
9. California Residents (CCPA)
If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and to correct it. We do not sell personal information and do not share it for cross-context behavioral advertising. To exercise these rights, contact us at hello@drillfi.com.
10. Children
DrillFi is a business tool intended for adults. It is not directed to children under 18, and we do not knowingly collect their information.
11. Changes to This Policy
We may update this policy from time to time. When we do, we will update the date at the top of this page. Continued use of DrillFi after changes means you accept the updated policy.
Questions? Email us at hello@drillfi.com.