Privacy Policy

Last updated: June 20, 2026

This Privacy Policy explains how Harrison Benjamin Ventures Inc. (“Harrison Benjamin,” “we,” “us,” or “our”) collects, uses, discloses, stores, and protects information in connection with the HBAI Platform (the “Service”) available at cc.harrisonbenjamin.ai. The Service is an approval-first AI operations platform that helps our business customers process inbound communications and prepare records in their connected business systems, where a human reviews and approves every outbound action before it takes effect.

We provide the Service to businesses (each, a “Customer”). If you interact with the Service as an employee or agent of a Customer, that Customer's own agreements and privacy practices may also apply to your information. For data we process on a Customer's behalf, the Customer is the controller of that data and we act as its processor.

1. Information We Collect

Account and identity information

When you sign in, we collect your email address and authentication identifiers needed to create and secure your account and to associate you with your Customer's tenant. We use passwordless (“magic link”) sign-in and do not store passwords.

Data from connected services

With your authorization, the Service connects to third-party business systems on your Customer's behalf and accesses only the data needed to deliver the Service:

QuickBooks Online (Intuit): after a QuickBooks account owner authorizes the connection, we access company data such as customers, items/products and services, pricing, and estimates, and we create or update records (for example, estimates) only after a human user has reviewed and approved the action within the Service. We also store the OAuth tokens and company realm identifier required to maintain the connection. See Section 8 — Intuit / QuickBooks Data for specifics.
Microsoft 365 / Microsoft Graph: with administrator consent, we access mailbox messages and attachments for the mailbox(es) the Customer designates, so the Service can read inbound requests and extract their contents. We store the connection credentials and tenant identifier required to maintain access.

Content you submit or that flows through the Service

The Service processes the content of inbound emails, attachments (including documents and images such as purchase orders), and the structured records derived from them. This content may include personal information and business information belonging to your Customer and its own customers.

Usage, log, and diagnostic data

We collect technical information such as IP address, browser/device information, timestamps, actions taken in the Service (including an append-only audit trail of approvals and changes), and error and performance diagnostics used to operate and secure the Service.

2. How We Use Information

Provide, operate, maintain, and secure the Service.
Read and classify inbound communications, extract their contents, and prepare draft records for human review.
Match content against your connected systems (for example, resolving line items against your QuickBooks catalog) and, only after explicit human approval, create or update records in those systems.
Maintain an audit trail of actions and approvals for accountability and troubleshooting.
Authenticate users, enforce tenant isolation, prevent abuse, and comply with legal obligations.
Communicate with you about the Service, including sign-in links.

We do not sell personal information, and we do not use Customer data or data accessed from connected services for advertising.

3. Automated and AI Processing

The Service uses AI language models to classify messages, extract information, and draft records. AI is used to prepare proposed actions only — the Service is approval-first, meaning no customer-facing or financial action (such as creating a QuickBooks estimate) occurs without explicit human review and approval. AI output may contain errors and is not a substitute for human judgment. Content is sent to our AI provider(s) solely to generate these results for your Customer and is not used by us to train models. See Section 6 for the providers we rely on.

We share information only as described here:

Within your tenant:with authorized users of your Customer's organization, subject to the Customer's access controls.
Connected services you authorize: we send approved records to QuickBooks Online and read from Microsoft 365 as you direct.
Service providers (sub-processors): vendors that host and operate the Service under contractual confidentiality and security obligations. See Section 6.
Legal and safety: when required by law, to enforce our agreements, or to protect the rights, property, or safety of Harrison Benjamin, our Customers, or others.
Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Data Storage and Security

We apply technical and organizational measures designed to protect information, including: tenant isolation enforced at the database layer (row-level security) and in application logic; encryption in transit; restriction of service credentials and third-party tokens to server-side environments only (never exposed to browsers); scoped access controls; and an append-only audit trail. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Data is hosted with reputable cloud providers (see Section 6), primarily in the United States.

6. Sub-processors and Third-Party Services

We rely on the following categories of providers to operate the Service. Each processes data only as needed to provide its function and under confidentiality and security obligations:

Cloud database, authentication, and storage hosting.
Web application and serverless function hosting.
Background worker and durable workflow execution hosting.
AI language model provider(s) for classification and extraction.
Intuit (QuickBooks Online) and Microsoft (Microsoft 365 / Graph) for the integrations you connect.
Error monitoring and transactional email delivery.

We will provide the current list of named sub-processors to Customers on request via frank@harrisonbenjamin.com.

7. Data Retention and Deletion

We retain information for as long as needed to provide the Service to your Customer, comply with legal obligations, resolve disputes, and enforce our agreements. When a Customer's account is terminated, or upon a valid deletion request, we will delete or de-identify the associated Customer data within a commercially reasonable period, except where retention is required by law or for legitimate business records.

To request access to, correction of, or deletion of your information, contact us at frank@harrisonbenjamin.com. If you interact with the Service through a Customer, we may direct your request to that Customer as the controller of the data.

8. Intuit / QuickBooks Data

Because the Service connects to QuickBooks Online, we want to be explicit about how we handle Intuit data:

What we access: after the QuickBooks account owner authorizes the connection, we access company information such as customers, items (products and services), pricing, and estimates, and we create or update estimates and related records.
Why:solely to match incoming requests to the correct customer and catalog items and to prepare and — after human approval — create the corresponding records in the Customer's QuickBooks company.
Approval-first: no record is written to QuickBooks without explicit human review and approval inside the Service.
How we store it:Intuit OAuth tokens and the company realm identifier are stored encrypted and restricted to server-side use; a local mirror of catalog data may be cached to perform matching. Tenant isolation prevents one Customer's QuickBooks data from being accessible to another.
Disconnection and deletion: a Customer may disconnect QuickBooks at any time, which revokes our access tokens. On disconnection or account termination, we delete the stored tokens and will delete the associated cached QuickBooks data on request.
No use for advertising or model training: we do not use Intuit data for advertising or to train AI models, and we do not sell it.

Our use of Intuit data is also governed by the Intuit Developer terms and applicable Intuit policies.

9. Cookies and Authentication

We use strictly necessary cookies and similar technologies to keep you signed in and to secure your session. We do not use advertising or cross-site tracking cookies.

10. Children's Privacy

The Service is a business tool not directed to children and is not intended for use by anyone under 18. We do not knowingly collect personal information from children.

11. International Users

The Service is operated from the United States and data is processed and stored there. If you access the Service from outside the United States, you understand your information will be transferred to and processed in the United States.

12. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Continued use of the Service after an update constitutes acceptance of the revised Policy.

13. Contact Us

Harrison Benjamin Ventures Inc. — for any privacy question or request, contact frank@harrisonbenjamin.com.