Privacy Policy

This Privacy Policy explains how Clasto (“Clasto,” “we,” “us,” or “our”) collects, uses, protects, and shares information in connection with the Clasto enterprise resource planning (ERP) platform for importers and distributors (the “Service”). It applies to the Clasto application at app.clasto.io and this website.

1. Information we collect

We collect information you provide directly, information generated as you use the Service, and information from third-party systems you choose to connect.

• Account and contact information — such as your name, work email, company name, and role, provided when your organization is set up or when you request a demo.
• Business records you enter — the operational data you manage in Clasto, including containers, purchase orders, supplier invoices, inventory, sales, payments, and related documents.
• Usage and device information — standard log data such as IP address, browser type, and pages accessed, used to operate and secure the Service.
• Connected-system data — information we retrieve on your behalf from services you explicitly connect, such as the QuickBooks Online bank-feed integration described below.

2. QuickBooks Online bank-feed integration

Clasto offers an optional integration with QuickBooks Online, provided by Intuit Inc., that lets you bring your bank and credit-card transactions into Clasto. This section describes exactly what that integration does.

• You authorize the connection. The integration is enabled only when a user at your company connects it using Intuit’s OAuth 2.0 authorization flow. We request the Accounting scope only.
• It is read-only. Clasto uses the connection solely to download data from QuickBooks Online. We retrieve bank and credit-card transactions (expenses and purchases, deposits, and transfers) and the list of your bank and credit-card accounts.
• We never write to QuickBooks. Clasto does not create, edit, or delete any data in your QuickBooks Online company. The flow of information is one-way, from QuickBooks into Clasto.
• Clasto is your system of record. QuickBooks Online is used only as a source to pull bank transactions in; your operational records live in Clasto.
• Tokens are protected. The OAuth access and refresh tokens that authorize the connection are encrypted at rest, are never written to application logs, and are never exposed to your web browser.
• You can disconnect at any time. Disconnecting QuickBooks from within Clasto clears the stored tokens, after which Clasto can no longer access your QuickBooks Online data.

Your use of QuickBooks Online is also governed by Intuit’s own terms and privacy policy. Information retrieved through this integration is handled in accordance with this Privacy Policy.

3. How we use information

• To provide, maintain, and improve the Service and its features.
• To display your bank and credit-card transactions within Clasto so you can review, match, and categorize them.
• To authenticate users, secure accounts, and prevent fraud or abuse.
• To communicate with you about your account, support requests, and service updates.
• To comply with legal obligations.

We do not sell your personal information, and we do not use data retrieved from QuickBooks Online for advertising.

4. How we share information

We share information only as needed to operate the Service:

• Service providers (subprocessors) — such as our cloud hosting provider (Microsoft Azure) and Intuit for the QuickBooks connection, who process data on our behalf under contractual protections.
• Within your organization — with authorized users of your company’s Clasto tenant.
• Legal and safety — where required by law, or to protect the rights, property, or safety of Clasto, our customers, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

We do not sell personal information to third parties.

5. Data security

We use technical and organizational measures designed to protect your information, including encryption in transit (HTTPS) and encryption at rest. Sensitive credentials, including QuickBooks OAuth access and refresh tokens, are encrypted at rest using industry-standard cryptography (AES via ASP.NET Data Protection), are never written to logs, and are never exposed to the browser. No method of transmission or storage is completely secure, but we work to protect your information using appropriate safeguards.

6. Data retention

We retain information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When you disconnect QuickBooks Online, the stored authorization tokens are cleared. You may request deletion of your data as described below, subject to legal and operational retention requirements.

7. Multi-tenant isolation

Clasto is a multi-tenant platform. Each customer’s data is isolated per company, and one customer’s data is never visible to another customer. Access is restricted to authorized users within the same tenant.

8. Your rights and choices

• Disconnect integrations — you can disconnect QuickBooks Online at any time from within Clasto, which clears the stored tokens.
• Access and correction — you may request access to, or correction of, the personal information we hold about you.
• Deletion — you may request deletion of your personal information, subject to applicable legal and operational retention obligations.

To exercise these rights, contact us using the details below. Depending on your location, you may have additional rights under applicable data-protection laws.

9. Hosting and international transfers

The Service is hosted on Microsoft Azure. Your information may be processed in the countries where our infrastructure and service providers operate. Where required, we use appropriate safeguards for international transfers.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice.

11. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at privacy@clasto.io.