How we handle your data
This policy explains what data Spyderworks handles, what we do with it, where it's kept, and how to have it deleted. It covers this website and the connections we build and run for the businesses we work with. Those connections link a business's own system (its ERP) with QuickBooks Online, Microsoft 365 email, AI assistants such as Microsoft 365 Copilot, and WhatsApp Business.
Who we are
Spyderworks LLC, 30 Hillside Blvd, Lakewood, NJ 08701. You can reach us at charlie@spyderworks.co.
This website
- We don't use cookies, analytics or tracking, and there are no forms.
- The page fonts load from Google Fonts, so Google receives your browser's IP address when you visit.
- Our web host, GitHub Pages, may keep standard server logs (IP address, time, page). See GitHub's privacy statement.
Where a business's data is kept
- Everything the connections bring in is stored in the business's own system.
- That system runs on Google Cloud in the United States, either in a project Spyderworks runs for that business, or in the business's own Google Cloud account.
- Each business has its own system. We never mix one business's data with another's.
QuickBooks Online (the Spyderworks Bridge)
A business connects the bridge by signing in on Intuit's own page and approving the connection. We never see the Intuit password. Once connected, the bridge only does the following.
| What | Why |
|---|---|
| Reads company settings: company name, closing date, numbering and sales-tax settings | To post entries the way your books are set up, and never into a closed period |
| Reads lists: chart of accounts, classes and locations, tax codes and rates, payment terms, customers and vendors (names, contact details, addresses), products and services | To match each record once, so entries land on the right accounts and names |
| Reads payments and bill payments, and the balance of invoices and bills the bridge sent | To show "paid" in your own system |
| Writes invoices, credit memos and supplier bills made in your own system | So nothing is typed twice |
| Writes a new customer, vendor or product | Only after a person in your business approves the match |
- What it never touches: bank feeds, bank connections, payroll, or your QuickBooks login.
- The connection service. A small Spyderworks service handles the QuickBooks sign-in and Intuit's change notices.
- It stores your QuickBooks company ID and its connection keys, encrypted. It stores no business records: records pass through it and aren't kept.
- The keys are deleted when you disconnect.
- Its logs hold record IDs only, and are kept 30 days.
- If your system can't take a change notice straight away, the notice is held for up to 7 days, then deleted.
Microsoft 365 email
This connection is set up in the business's own Microsoft account. It acts only for people who sign in with their own Microsoft login, and it uses only the permissions they grant (delegated, not company-wide).
- Reads the signed-in person's name and email address, to know who they are.
- Reads incoming mail in the business's shared order inbox, to turn requests into draft quotes and orders in the business's own system.
- Writes draft replies into the person's own Outlook Drafts folder. Nothing is sent automatically: a person reads the draft and sends it.
- Never touches calendars, OneDrive or SharePoint files, Teams, or contacts.
AI assistants (Microsoft 365 Copilot and others)
- If a business uses an AI assistant, such as Microsoft 365 Copilot under its own licence, or Claude, the assistant can read and act in the business's own system through a connection each person signs in to.
- Each person sees only what their own login allows.
- The assistant maker's own terms cover the assistant itself.
WhatsApp Business
- If a business turns this on, messages sent to its WhatsApp Business number are read to turn requests into drafts in its own system.
- Replies are drafts until a person sends them.
- Meta's own terms and privacy policy cover WhatsApp itself.
AI
- Reading requests. Spyderworks' reader uses Anthropic's commercial API (Claude) to read incoming requests: WhatsApp messages, and email as a backup.
- A request goes to Anthropic only to be read.
- Anthropic doesn't use it to train its models.
- People decide. Quotes, orders and replies the AI prepares stay drafts until a person approves them. The QuickBooks bridge is plain software: it doesn't use AI to decide what gets posted.
- Your consent. We only switch on an AI connection to a business's system with that business's written consent, and the business can switch it off at any time.
- Our own work. Spyderworks also uses AI tools such as Claude while building and supporting a business's setup.
What we use data for, and what we never do
- We use a business's data only to run the connections it asked for.
- We never sell it, use it for advertising, or build profiles from it.
- We never share one business's data with another business.
Who can see it
- The people in the business it gives access to.
- Spyderworks staff working on that business's setup, only as needed to run and fix it.
- The companies that provide the services named above, Google Cloud for hosting among them, and any integration service we use for a business (for example Make.com, or a WhatsApp Business partner), under their own terms.
We don't disclose it to anyone else unless the law requires it, for example a valid court order.
Intuit, Microsoft and Meta
Spyderworks is an independent developer. Each of these companies decides on its own how it handles personal information; we don't process data on their behalf. Their own privacy statements cover your use of QuickBooks, Microsoft 365 and WhatsApp.
Disconnecting and deleting
- A business can disconnect any connection at any time. QuickBooks can be disconnected from its own system or from the Apps area in QuickBooks Online. Microsoft can be disconnected from the business's Microsoft admin settings.
- When a connection is disconnected, it stops straight away and its keys are deleted.
- Data already in the business's own system stays there, because that system is the business's.
- If you ask, we delete any copies Spyderworks holds, such as support files, within 30 days, unless the law requires us to keep them.
Security
- Data moves over encrypted connections (HTTPS), and connection keys are stored encrypted.
- Access is limited to named people.
- If a breach affects a business's data, we tell that business, and Intuit or Microsoft where their services are involved, promptly.
Your rights
Depending on where you live (for example California), you may have the right to see, correct or delete personal information about you. Ask us at charlie@spyderworks.co. Each business controls the data in its own system, and we help it answer these requests.
Children
Our services are for businesses. We don't knowingly collect data about children.
Changes
We post any change here with a new date. Before a change that affects how we handle a business's data, we tell the businesses we work with.