RECONCILIATION ENGINE — Privacy Policy

Effective date: July 19, 2026

Last updated: July 19, 2026

This Privacy Policy explains how RECONCILIATION ENGINE, operated under the NEVERMORE brand (“NEVERMORE,” “we,” “us,” or “our”), collects, uses, stores, discloses, retains, and deletes information.

RECONCILIATION ENGINE is currently a limited-access development and testing platform for financial reconciliation and financial truth reconstruction.

1. Scope

This Privacy Policy applies to information processed through:

• `https://reconciliation-engine.nevermore-tech.com`;
• connected QuickBooks Online companies;
• supported financial-source integrations;
• files and records submitted to the Service; and
• related support, security, and administrative communications.

It does not govern the independent privacy practices of Intuit, QuickBooks, banks, payment processors, payroll providers, ecommerce platforms, or other third parties.

2. Information We Collect

Depending on how the Service is used, we may collect the following categories of information.

2.1 Account and contact information

• name;
• business name;
• email address;
• user or administrator identifiers;
• role or authorization information; and
• communications sent to us.

2.2 QuickBooks Online connection information

When an authorized user connects QuickBooks Online, we may process:

• Intuit authorization identifiers;
• QuickBooks company or realm identifier;
• OAuth access and refresh tokens;
• token issuance and expiration metadata;
• connection, reconnection, and revocation status; and
• permissions or scopes authorized by the user.

We do not request or store the user’s Intuit password.

2.3 Accounting and financial information

Depending on authorized access and requested workflows, the Service may process:

• Chart of Accounts;
• General Ledger records;
• journal entries;
• invoices and customer payments;
• bills and vendor payments;
• bank and credit-card transactions;
• deposits, transfers, and reconciliations;
• accounts receivable and accounts payable;
• sales, refunds, taxes, tips, fees, and settlements;
• payroll-related accounting records;
• loans and liabilities;
• financial reports;
• customer and vendor records;
• attachments, receipts, statements, and supporting documents; and
• proposed corrections, classifications, reconciliations, and audit records.

Financial information may include personal information relating to owners, workers, customers, vendors, or other counterparties.

2.4 Uploaded and imported information

We may collect files and data an authorized user uploads or imports, including:

• bank statements;
• accounting exports;
• spreadsheets;
• receipts and invoices;
• tax and payroll documents;
• loan records;
• point-of-sale or ecommerce exports; and
• other source evidence used for reconciliation.

2.5 Technical and usage information

We may collect:

• IP address;
• browser and device information;
• timestamps;
• authentication and session events;
• pages or features used;
• integration requests and responses;
• error logs;
• security events;
• diagnostic records; and
• audit events showing who performed or approved an action.

We use this information to operate, secure, troubleshoot, and improve the Service.

3. How We Use Information

We use information to:

1. authenticate users and maintain authorized sessions;
2. connect and maintain authorized third-party integrations;
3. retrieve and organize requested accounting and financial records;
4. reconcile transactions and compare source systems;
5. identify possible discrepancies, omissions, duplicates, or misclassifications;
6. generate analyses, explanations, proposed corrections, reports, and audit records;
7. preserve source references and traceability for financial claims;
8. provide support and troubleshoot failures;
9. secure the Service and investigate suspected misuse;
10. comply with legal obligations and enforce our agreements; and
11. develop and test the Service using authorized data and controlled access.

We will not use connected QuickBooks data for unrelated advertising.

4. Artificial Intelligence and Automated Processing

The Service may use automated systems, including artificial intelligence, to:

• classify transactions;
• compare records;
• detect patterns or anomalies;
• extract information from documents;
• explain findings; and
• propose reconciliation or accounting actions.

Automated processing may produce incorrect or incomplete results. Material outputs should be reviewed against source records before use.

We do not represent automated output as a licensed professional opinion.

5. How We Disclose Information

We may disclose information only as described below.

5.1 Service providers

We may use hosting, database, security, monitoring, communications, document-processing, or artificial-intelligence service providers to operate the Service.

Service providers may process information only for contracted purposes and subject to appropriate confidentiality and data-protection obligations.

5.2 Connected platforms

We exchange information with Intuit and other connected services as necessary to establish authorization, retrieve permitted information, revoke access, or perform user-directed actions.

5.3 Authorized users and professionals

Information and reports may be shared with people the business authorizes, including owners, employees, bookkeepers, accountants, tax professionals, attorneys, or other advisers.

5.4 Legal and safety disclosures

We may disclose information when reasonably necessary to:

• comply with law, subpoena, court order, or lawful government request;
• protect users, the public, NEVERMORE, or third parties;
• investigate fraud, abuse, or security incidents; or
• establish, exercise, or defend legal rights.

5.5 Business transactions

If the Service or its assets are involved in a merger, financing, acquisition, reorganization, bankruptcy, or sale, information may be transferred subject to applicable law and continued protection.

6. No Sale of Personal or Connected Financial Data

We do not sell personal information or connected QuickBooks financial data.

We do not rent connected financial data to advertisers or use it for third-party behavioral advertising.

We will not disclose identifiable connected financial data for an unrelated third party’s independent commercial use without authorization or another lawful basis.

7. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Service, maintaining security and auditability, resolving disputes, and complying with law.

The current retention practices for the limited test platform are:

7.1 OAuth credentials

• Active OAuth tokens are retained only while the applicable connection remains authorized and operational.
• When a supported QuickBooks connection is disconnected, we initiate revocation of the access and refresh tokens.
• Revoked, expired, or replaced token values are removed from active credential storage as part of the connection-maintenance process.
• Limited token metadata may be retained in security or audit logs without retaining usable credentials.

7.2 Imported financial data

• Imported or synchronized financial records are retained while the authorized test workspace remains active and the data is needed for the requested reconciliation, verification, or audit purpose.
• An authorized user may request deletion of imported financial data.
• Following a verified deletion request, data designated for deletion will be removed from active systems within 30 days unless retention is required by law, needed to investigate fraud or security incidents, or necessary to preserve a specifically authorized audit record.

7.3 Logs and audit records

• Security, access, diagnostic, and action logs may be retained for up to 12 months unless a longer period is required for an investigation, legal obligation, or specifically authorized financial audit trail.
• Audit records intended to prove a user-approved financial action may be retained for the life of the associated workspace or for a longer period selected by the authorized business user.

7.4 Backups

• Data removed from active systems may remain in protected backups for up to 90 additional days before ordinary backup rotation deletes it.
• Backup data is not restored except for disaster recovery, security investigation, or legal necessity.
• If backup data is restored, applicable deletion requests will be reapplied where reasonably practicable.

7.5 Test-program termination

When a test workspace or the limited test program ends, we will delete or de-identify Customer Data that is no longer needed, subject to the periods and exceptions described above.

8. Data Deletion and Disconnection

An authorized user may request:

• disconnection of a connected QuickBooks company;
• revocation of integration access;
• deletion of imported financial records;
• deletion of account and contact information; or
• closure of a test workspace.

Requests may be submitted through the contact method published at:

https://reconciliation-engine.nevermore-tech.com

We may require reasonable verification that the requester is authorized to act for the relevant business.

Disconnecting QuickBooks stops future retrieval through the revoked connection. It does not automatically delete financial data previously imported into the Service. A separate deletion request may be required.

We may retain limited information when necessary to:

• comply with law;
• resolve disputes;
• prevent fraud or abuse;
• investigate security incidents;
• enforce agreements; or
• preserve an authorized audit trail.

Where retention is required, access will be restricted and the information will not be used for unrelated purposes.

9. Data Accuracy and Correction

Authorized users may request correction of inaccurate account or contact information.

Accounting information originating from QuickBooks or another connected source may need to be corrected in the source system. The Service may preserve the original source record and separately document a proposed or approved correction to maintain auditability.

10. Security

We use administrative, technical, and organizational safeguards designed to protect information according to its sensitivity.

Safeguards may include:

• encrypted network transport;
• restricted access to systems and credentials;
• OAuth-based authorization rather than collection of third-party passwords;
• separation of development and production credentials;
• logging and monitoring;
• access-control and approval mechanisms;
• protected credential storage;
• vulnerability and dependency maintenance; and
• backup and recovery controls.

No security measure can eliminate all risk. Users should protect their own devices, credentials, and authorized sessions and promptly report suspected unauthorized access.

11. Data Location and Cross-Border Processing

The Service is operated from the United States. Information may be processed in the United States or other locations where approved service providers operate.

Where required, we will use appropriate safeguards for cross-border processing.

12. Children’s Privacy

The Service is intended for business users and is not directed to children under 13.

We do not knowingly collect personal information directly from children under 13. If we learn that such information was collected without appropriate authorization, we will take reasonable steps to delete it.

13. U.S. State Privacy Rights

Depending on applicable law and the user’s state of residence, an individual may have rights to:

• know or access personal information;
• correct inaccurate personal information;
• request deletion;
• obtain a portable copy;
• limit certain uses of sensitive information;
• opt out of certain sales, sharing, or targeted advertising; or
• appeal a denied request.

RECONCILIATION ENGINE does not sell personal information or use connected financial data for third-party targeted advertising.

Rights requests may be submitted through the contact method published on the Service website. We may verify identity and authority before completing a request.

Because much of the information is processed on behalf of a business, some requests may need to be directed to that business as the party controlling the data.

14. Business Data and Authorized Users

The business that connects or submits financial data determines who is authorized to access it.

Users must not connect or disclose information without proper authority. The business is responsible for managing internal access and informing its personnel, customers, vendors, and other affected parties as required by law.

15. Third-Party Links and Services

The Service may contain links to third-party sites or rely on third-party integrations. Their privacy practices are governed by their own policies.

We encourage users to review the privacy terms of Intuit, QuickBooks, banks, payment processors, payroll providers, ecommerce platforms, and other services they authorize.

16. Changes to This Privacy Policy

We may update this Privacy Policy as the Service develops, our practices change, or legal requirements evolve.

The “Last updated” date identifies the current version. Material changes will be communicated through the Service website or another reasonable method before they take effect when required by law.

17. Contact and Privacy Requests

Privacy questions, access requests, deletion requests, security reports, or complaints may be submitted through the contact method published at:

https://reconciliation-engine.nevermore-tech.com

---

IMPORTANT IMPLEMENTATION NOTE: Before public deployment, replace this notice with confirmed business and privacy contact information. The Service’s actual retention, deletion, backup, OAuth revocation, access-control, and security behavior must conform to this published policy.