Privacy Policy

This Privacy Policy explains how Clasto (“Clasto,” “we,” “us,” or “our”) collects, uses, protects, and shares information in connection with the Clasto enterprise resource planning (ERP) platform for importers and distributors (the “Service”). It applies to the Clasto application at app.clasto.io and this website.

1. Information we collect

We collect information you provide directly, information generated as you use the Service, and information from third-party systems you choose to connect.

• Account and contact information — such as your name, work email, company name, and role, provided when your organization is set up or when you request a demo.
• Business records you enter — the operational data you manage in Clasto, including containers, purchase orders, supplier invoices, inventory, sales, payments, and related documents.
• Usage and device information — standard log data such as IP address, browser type, and pages accessed, used to operate and secure the Service.
• Connected-system data — information we retrieve on your behalf from services you explicitly connect, such as the QuickBooks Online bank-feed integration described below.

2. Cookies and similar technologies

This website uses cookies and similar technologies. They fall into three groups:

• Essential — required for the site to work, such as the security token that protects our forms and the cookie that remembers your cookie choices (kept for six months). These are always active.
• Analytics — help us understand how visitors use the site, such as which pages are visited and where visitors come from, using Google Analytics. See the consent rules below.
• Advertising — used to measure our marketing campaigns and to show Clasto ads to people who have visited this site, through Google Ads, Meta (Facebook and Instagram), and LinkedIn. See the consent rules below.

How we ask depends on where you are:

• European Economic Area, United Kingdom, Switzerland — analytics and advertising cookies are set only after you accept them in the banner shown on your first visit. Nothing is loaded before you choose. We determine this from your browser’s time zone, and we apply this stricter rule whenever we cannot tell.
• Everywhere else, including the United States — these cookies are set when you arrive, and a notice tells you so with a one-click way to turn them off.
• Global Privacy Control — if your browser sends a GPC signal we treat it as an opt-out and set no analytics or advertising cookies, wherever you are, unless you then accept them yourself.

Either way you can change or withdraw your choice at any time using the “Cookie preferences” link in the footer of this site, and you can also delete cookies in your browser settings. The Clasto application at app.clasto.io uses only cookies necessary to operate the Service, such as keeping you signed in.

3. QuickBooks Online bank-feed integration

Clasto offers an optional integration with QuickBooks Online, provided by Intuit Inc., that lets you bring your bank and credit-card transactions into Clasto. This section describes exactly what that integration does.

• You authorize the connection. The integration is enabled only when a user at your company connects it using Intuit’s OAuth 2.0 authorization flow. We request the Accounting scope only.
• It is read-only. Clasto uses the connection solely to download data from QuickBooks Online. We retrieve bank and credit-card transactions (expenses and purchases, deposits, and transfers) and the list of your bank and credit-card accounts.
• We never write to QuickBooks. Clasto does not create, edit, or delete any data in your QuickBooks Online company. The flow of information is one-way, from QuickBooks into Clasto.
• Clasto is your system of record. QuickBooks Online is used only as a source to pull bank transactions in; your operational records live in Clasto.
• Tokens are protected. The OAuth access and refresh tokens that authorize the connection are encrypted at rest, are never written to application logs, and are never exposed to your web browser.
• You can disconnect at any time. Disconnecting QuickBooks from within Clasto clears the stored tokens, after which Clasto can no longer access your QuickBooks Online data.

Your use of QuickBooks Online is also governed by Intuit’s own terms and privacy policy. Information retrieved through this integration is handled in accordance with this Privacy Policy.

4. How we use information

• To provide, maintain, and improve the Service and its features.
• To display your bank and credit-card transactions within Clasto so you can review, match, and categorize them.
• To authenticate users, secure accounts, and prevent fraud or abuse.
• To communicate with you about your account, support requests, and service updates.
• To market Clasto — measuring our campaigns and showing Clasto ads to people who have visited this website, on the consent basis described in the Cookies section above.
• To comply with legal obligations.

We do not sell your personal information, and we do not use data retrieved from QuickBooks Online for advertising.

5. How we share information

We share information only as needed to operate the Service:

• Service providers (subprocessors) — such as our cloud hosting provider (Microsoft Azure) and Intuit for the QuickBooks connection, who process data on our behalf under contractual protections.
• Within your organization — with authorized users of your company’s Clasto tenant.
• Legal and safety — where required by law, or to protect the rights, property, or safety of Clasto, our customers, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

We do not sell personal information to third parties.

6. Data security

We use technical and organizational measures designed to protect your information, including encryption in transit (HTTPS) and encryption at rest. Sensitive credentials, including QuickBooks OAuth access and refresh tokens, are encrypted at rest using industry-standard cryptography (AES via ASP.NET Data Protection), are never written to logs, and are never exposed to the browser. No method of transmission or storage is completely secure, but we work to protect your information using appropriate safeguards.

7. Data retention

We retain information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When you disconnect QuickBooks Online, the stored authorization tokens are cleared. You may request deletion of your data as described below, subject to legal and operational retention requirements.

8. Multi-tenant isolation

Clasto is a multi-tenant platform. Each customer’s data is isolated per company, and one customer’s data is never visible to another customer. Access is restricted to authorized users within the same tenant.

9. Your rights and choices

• Disconnect integrations — you can disconnect QuickBooks Online at any time from within Clasto, which clears the stored tokens.
• Access and correction — you may request access to, or correction of, the personal information we hold about you.
• Deletion — you may request deletion of your personal information, subject to applicable legal and operational retention obligations.
• Cookie choices — you can change or withdraw your cookie consent at any time via the “Cookie preferences” link in the footer of this site.

To exercise these rights, contact us using the details below. Depending on your location, you may have additional rights under applicable data-protection laws.

10. Hosting and international transfers

The Service is hosted on Microsoft Azure. Your information may be processed in the countries where our infrastructure and service providers operate. Where required, we use appropriate safeguards for international transfers.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice.

12. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at privacy@clasto.io.