themassis.com
Privacy Policy
themassis (themassis.com) provides Shopify payout reconciliation into QuickBooks Online, with an optional bank feed through Plaid. This policy describes what we collect, why, who we share it with, how long we keep it, how we secure it, and how you can have it deleted. Operational detail lives in the Information Security Policy and Data Retention and Disposal Policy.
Questions: [email protected]. Incidents: [email protected]. Support: [email protected].
1. Who we are
Controller / operator: themassis, themassis.com. We process your information to run the product you signed up for. We are not a bank, not Plaid, not Shopify, and not Intuit. Those parties have their own notices.
2. What we collect
- Account data — email, name, role (merchant or accountant), password hash, store domain, session identifiers.
- Shopify payout data — settlements and split components (gross, fees, refunds, shipping, tax, adjustments) used to draft journal entries.
- QuickBooks Online connection tokens — OAuth access and refresh tokens, stored encrypted at rest, used to read the chart of accounts and post journals an accountant approves.
- Optional Plaid bank feed — if you connect a bank, we store an encrypted Plaid access token and item id, plus transactions for the deposit account you selected, solely to match Shopify payouts. We never collect or store your bank username, password, PIN, or MFA codes.
- Workpapers — draft and posted journal lines, mappings, exception tasks, and an audit log of who approved or posted.
- Billing — plan and Stripe identifiers. Card numbers stay with Stripe.
- Technical logs — IP address, user agent, and auth events, used to secure the service.
3. How we use it
Data is used to authenticate you, connect the services you authorize, prepare balanced journal entries, surface exceptions for accountant review, match deposits when a bank feed is enabled, bill for the product, provide support, and secure the service.
We do not use your books, payouts, or Plaid End User Data to train unrelated models, to advertise to you, or to build a data product for anyone else. We do not sell personal information, nonpublic personal information, or End User Data.
4. Sharing
We share data only with the services you connect and processors who host the product under contract: Shopify, Intuit QuickBooks Online, Plaid (if you opt in), Stripe, and cloud/email infrastructure. We disclose information if required by law, to prevent fraud or a security incident, or in a sale of the business under confidentiality. We do not share End User Data with data brokers or other merchants.
5. Security
- TLS 1.2+ in transit; OAuth and Plaid tokens encrypted at rest.
- Role-based access: merchants cannot post; accountants review and post; tenants are isolated.
- HttpOnly sessions, scrypt password hashes, CSRF protection, login rate limits.
- Bank credentials never stored. Plaid items are removed and tokens deleted within 24 hours of disconnect.
- A Security Breach involving Plaid data is notified to Plaid within 12 hours at [email protected], and to affected customers without unreasonable delay.
Full program: Information Security Policy.
6. Retention and disposal
| Data | Kept | Then |
|---|---|---|
| Bank login credentials | Never stored | — |
| Plaid / Shopify / QBO tokens | While connected | Revoked and deleted within 24 hours of disconnect |
| Plaid transactions used to match deposits | Until match, max 90 days after match (12 months if unmatched) | Secure delete; backups expire within 90 days |
| Payouts, journals, mappings | Account lifetime, then 7 years for books/tax unless you ask us to erase sooner | Secure delete (QuickBooks copies stay in your QBO company) |
| Posting audit log | 7 years | Secure delete |
| Account profile | Account lifetime | Deleted within 30 days of a verified erasure request |
The only reasons to keep data past this schedule are the closed list in the retention policy (legal requirement, dispute, security investigation, or your written request to preserve).
7. Your rights and how to delete
Subject to applicable law, you may request access, correction, deletion, a copy of your data, and to opt out of sale or sharing. themassis does not sell or share personal information for cross-context behavioral advertising. Send a verified request to [email protected]. We confirm or explain any legally required keep within 30 days.
8. Other
Production systems are hosted in the United States. The product is for businesses and their accountants, not children under 16. Essential cookies run the session. Material changes will be posted here with a new effective date.
9. Contact
themassis · themassis.com
[email protected] · [email protected] · [email protected]