Data controller: FW Global Consulting LLC, 2008 The Regal Tower, Business Bay, Dubai, United Arab Emirates.
01 · Who we are and what this covers
FW Global Consulting ("we", "us", "FW Global", "the firm") provides accounting, bookkeeping, tax, and advisory services. This policy explains how the FWG Books Review application ("the App") handles data when you (a client of the firm, or a QuickBooks Online company you administer) connect your QuickBooks Online account so that we can review your books as part of our engagement.
The App is an internal tool used only by our own authorized staff. It is not a consumer product and is not offered to the public.
02 · What data the App accesses
When you authorize the connection, the App accesses your QuickBooks Online data on a read-only basis using Intuit's Accounting API (scope com.intuit.quickbooks.accounting). This includes financial information such as your chart of accounts, trial balance, balance sheet, profit and loss, aged receivables and payables, transaction lists, reconciliation (cleared) status, and company preferences.
The App cannot create, modify, or delete anything in your QuickBooks account. It only reads.
To maintain the connection, the App also stores the OAuth refresh token issued by Intuit (see Security below). It does not store your Intuit login credentials — we never see them.
03 · How we use the data
We use your QuickBooks data solely to perform the review engagement you have engaged us for — checking periodic closing, data-entry accuracy, reconciliations, and related financial-review procedures, and producing an internal review workpaper.
We do not sell your data, do not use it for advertising or profiling, and do not use it to train machine-learning or AI models. It is not shared with other clients or with any third party except the service providers listed in Section 06, who process it only on our behalf.
04 · Who can see the data
Access is restricted to authorized delivery (accounting) staff of FW Global who are working on your engagement. Access is enforced technically through role-based access controls and database row-level security; other staff and any external users cannot access your review data.
05 · How we store and protect the data
- Encryption in transit: all communication uses HTTPS/TLS.
- Encryption at rest: our database encrypts data at rest (AES-256). The Intuit refresh token is additionally encrypted at the application layer (AES-256-GCM) with a key held separately from the database, and is isolated so that only our secure server processes can access it.
- Access controls: staff authenticate through Microsoft 365 / Entra single sign-on with multi-factor authentication; authorization is enforced by row-level security on every record.
- Auditing: access and changes to connection and review records are logged.
- Location: review results and metadata are stored in the European Union (Frankfurt, Germany). Review workpapers are stored in our Microsoft 365 environment.
Please note: Intuit's QuickBooks Online API is operated from the United States, so your data transits United States infrastructure while it is being retrieved from QuickBooks. Only the resulting review outputs and metadata are then stored as described above.
06 · Service providers (subprocessors)
We use the following providers to operate the App; each processes data only to provide their service to us:
| Provider | Purpose | Region |
|---|---|---|
| Intuit | QuickBooks Online API (source of the data) | United States |
| Vercel | Application hosting | EU (Frankfurt) |
| Supabase | Database, authentication, storage | EU (Frankfurt) |
| Cloudflare | Security / traffic protection | Global edge |
| Microsoft 365 | Document storage, staff sign-in | European Union |
| Sentry | Error monitoring | EU |
07 · How long we keep it
We retain review workpapers and results for the period required by our engagement terms and applicable professional, tax, and statutory record-retention obligations — seven (7) years from the close of the engagement, in line with UAE professional and tax-record retention norms. The stored Intuit refresh token is kept only while the connection is active and is deleted when you or we disconnect.
08 · Disconnecting and deletion
You may withdraw the App's access at any time — by asking us to disconnect, or from within your QuickBooks account (Apps → Connected apps). On disconnection we revoke the token with Intuit and delete it from our systems, after which the App can no longer access your books. You may also request deletion of the review data we hold, subject to our record-retention obligations.
09 · Your rights
Depending on your location, you may have rights under the UAE Personal Data Protection Law (PDPL), the UK/EU GDPR, and other applicable laws — including the rights to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at privacy@fwglobal.ae. Note that the data concerned is primarily your business's financial data rather than personal data.
10 · International transfers
Where data is transferred across borders (including transit through the United States via Intuit's API, and processing in the EU), we rely on appropriate safeguards consistent with applicable data-protection law.
11 · Changes to this policy
We may update this policy from time to time. The current version and its effective date are always available at this URL. Material changes will be communicated through our normal client channels.
12 · Contact
FW Global Consulting LLC
2008 The Regal Tower
Business Bay, Dubai, UAE
privacy@fwglobal.ae · +971-58-664-88-55