Privacy Policy
Effective Date: May 17, 2026 · Last Updated: May 17, 2026
1. Who We Are
CFO in a Box is operated by Anne Napolitano Consulting, Inc. ("ANC," "we," "our," or "us"), a financial advisory firm located at 25 Melville Park Rd, Suite 201, Melville, NY 11747. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the CFO in a Box web application (the "Service").
Questions? Contact us at hello@cfoinabox.com.
2. Information We Collect
Information You Provide Directly
- Account information: name, email address, password
- Business profile: business name, entity type, industry, state, revenue range, and related details you enter during onboarding or profile setup
- Financial data: P&L statements, balance sheets, cash flow statements, or CSV files you upload to the Service
- Chat content: messages you send to the AI advisory chat
Information Collected Automatically
- Usage data: pages visited, features used, time spent, error logs
- Device/browser info: IP address, browser type, operating system
- Authentication tokens: session tokens managed via Supabase Auth
Information from Third-Party Integrations
If you connect your QuickBooks Online account, we receive:
- Your QBO company ID (realm ID), company name, and OAuth access/refresh tokens
- Financial data you authorize us to retrieve: Profit & Loss reports, balance sheet, transaction data
- We do not receive your Intuit login credentials; the connection is managed via Intuit's OAuth 2.0 flow
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Generate AI-powered financial analysis and advisory responses
- Sync and display your financial data from connected QuickBooks accounts
- Personalize your experience based on your business profile and industry
- Process subscription payments via Stripe
- Send transactional emails (account confirmation, password reset, billing receipts)
- Detect and prevent fraud, abuse, or security incidents
- Comply with legal obligations
We do not sell your personal information or financial data to third parties.
4. How We Share Your Information
We share information only in the following circumstances:
| Recipient | Purpose |
|---|---|
| Anthropic | AI model API — your chat messages and financial data excerpts are sent to generate advisory responses. |
| Supabase | Database and file storage hosting. Data is stored in Supabase's managed Postgres infrastructure. |
| Stripe | Payment processing. We share your email and billing info to manage subscriptions. |
| Intuit | OAuth token exchange for QuickBooks Online connectivity. |
| Vercel | Application hosting and serverless function execution. |
We require all service providers to maintain appropriate security standards and to use your data only to perform services on our behalf. We may also disclose your information if required by law, court order, or to protect the rights and safety of ANC, our users, or the public.
5. Data Retention
- Account data is retained for the life of your account and deleted within 90 days of account closure upon request.
- Financial uploads are stored in Supabase Storage and can be deleted by you at any time from the Service.
- QBO tokens are stored encrypted and invalidated immediately upon disconnecting your QuickBooks account.
- Chat history is retained to support conversation continuity and can be cleared by you from the Service.
6. QuickBooks Online Data
When you connect QuickBooks Online:
- We request only the scopes necessary to provide the Service (financial reporting data)
- OAuth access tokens and refresh tokens are stored encrypted in our database
- We do not store raw Intuit credentials
- You can disconnect your QuickBooks account at any time from Account Settings — Data Sources; this immediately revokes our access and deletes stored tokens
- Data retrieved from QBO is used solely to power your CFO in a Box experience and is not shared with other users or used to train AI models
7. Data Security
We implement commercially reasonable technical and organizational measures to protect your information, including:
- Supabase Row Level Security (RLS) on all database tables — users can only access their own data
- Encrypted storage of OAuth tokens (AES-256)
- HTTPS/TLS for all data in transit
- Environment-variable management for all secrets; no hardcoded credentials in application code
- Regular review of access controls
No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but are committed to protecting your data.
8. Your Rights and Choices
Depending on your location, you may have rights to:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete your account and associated data
- Export your data in a portable format
- Withdraw consent for optional data processing
To exercise any of these rights, contact us at hello@cfoinabox.com. We will respond within 30 days.
9. Cookies and Tracking
We use session cookies to maintain your authenticated state (managed by Supabase Auth). We do not use third-party advertising or tracking cookies. You can control cookies through your browser settings; disabling session cookies will prevent you from logging in.
10. Children's Privacy
The Service is intended for business owners and is not directed at individuals under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with information, contact us at hello@cfoinabox.com and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page and, for material changes, notify you via email or an in-app notice. Continued use of the Service after changes constitutes acceptance of the updated policy.