Privacy Policy
This Privacy Policy explains how Velmar Distribution (“Velmar,” “we,” “us,” or “our”) collects, uses, stores, and protects information within our customer relationship management platform (the “CRM”), including information we access through the QuickBooks Online integration.
Contents
01 Who operates the CRM
The CRM is operated by Velmar Distribution. We are the data controller responsible for the information described in this policy. If you have questions, contact us using the details at the bottom of this page.
Registered business address: 15 Parkville Ave, Brooklyn, NY 11230
02 What data we collect
When an authorized administrator connects QuickBooks Online, we read the following from the connected company:
Customer information
- QuickBooks customer ID, company name, and contact name
- Email address and phone number
- Billing and shipping addresses
- Customer notes (where available)
Invoice & sales information
- Invoice ID and number, invoice and due dates
- Line items (product/service name, description, quantity, unit price, amount)
- Total amount, taxes, balance due, and payment status
Connection information
- The QuickBooks company identifier (realm ID)
- OAuth access and refresh tokens used to maintain the connection
We only request the minimum QuickBooks permission scope required for this functionality (accounting data), and the sync is read-only — we never write to, modify, or create records in your QuickBooks account.
03 How the QuickBooks connection works
We connect to QuickBooks using Intuit’s official OAuth 2.0 process. You log in directly with Intuit and authorize the connection — we never see or store your QuickBooks username or password.
Intuit provides us with access and refresh tokens that let the CRM read your data on your behalf. These tokens are stored encrypted and are used only to keep the connection active. Access tokens refresh automatically so you do not need to log in again.
04 Why we use the data
We use QuickBooks data solely to provide the functionality you authorized — to display and organize your QuickBooks customers and invoices inside the CRM as customer and sales records. Specifically, to:
- Show customers and their invoices/sales in the CRM
- Keep payment status (paid, partial, overdue, voided) up to date
- Provide reporting and organization for your team
We use customer data only for the functionality authorized by the account owner. We do not use it for advertising, profiling, or any unrelated purpose.
05 Who can access the data
Access inside the CRM is restricted by role:
- Administrators can manage the QuickBooks connection and view synced data.
- Sales representatives can view sales and customers only according to the permissions set for them; they cannot access QuickBooks connection settings.
Only authorized Velmar personnel with a legitimate need may access the systems that store this data.
06 Selling & sharing
We do not sell your data. We do not rent or trade it. We do not share QuickBooks data with third parties except:
- With trusted infrastructure providers (such as our hosting provider) strictly to operate the CRM, under confidentiality obligations;
- With Intuit, as required to maintain the QuickBooks connection;
- Where required by law, regulation, or valid legal process.
07 Hosting & security
We take reasonable and appropriate measures to protect your data, including:
- Encryption of OAuth tokens at rest
- Encrypted connections (HTTPS/TLS) for data in transit
- Role-based access controls and authentication
- Activity logging and monitoring
The CRM and its data are hosted in the United States. No method of storage or transmission is 100% secure, but we work to protect your information using industry-standard practices.
08 Retention & deletion
We retain synced QuickBooks data for as long as your account is active and the data is needed to provide the service. Information already imported into the CRM is not automatically deleted simply because the QuickBooks connection is removed (see the next section).
You may request deletion of your imported QuickBooks data at any time. Following a verified request, we will delete the imported data and remove any stored access tokens within 30 days, except where we are required to retain certain records by law.
09 What happens after disconnecting QuickBooks
When an administrator disconnects QuickBooks from the CRM:
- We immediately stop syncing — no further data is read from QuickBooks;
- We attempt to revoke the access tokens with Intuit and remove the stored connection and tokens from the CRM;
- Data already imported into the CRM remains stored so your historical records stay intact, until you request its deletion as described above.
10 Your privacy rights
Depending on your location, you may have the right to access, correct, or delete your personal information, or to restrict or object to certain processing. To exercise any of these rights, contact us using the details below and we will respond as required by applicable law.
11 Updates to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be communicated where appropriate. Your continued use of the CRM after an update constitutes acceptance of the revised policy.
12 QuickBooks / Intuit disclaimer
QuickBooks and Intuit are trademarks of Intuit Inc. Velmar Distribution is an independent company and is not affiliated with, endorsed by, or sponsored by Intuit Inc. The QuickBooks integration is provided by Velmar Distribution, and Intuit is not responsible for this application or its data handling.