Last updated: April 27, 2026
Digital Inventory Group LLC ("FifthFirm", "we", "us") operates the FifthFirm platform at fifthfirm.com. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service.
When you connect QuickBooks Online, we receive access to financial data including chart of accounts, transactions, invoices, bills, customers, vendors, and financial reports. We access only the data scopes you explicitly authorize during the OAuth connection flow.
When you connect your QuickBooks Online account, FifthFirm requests the following OAuth 2.0 scopes:
com.intuit.quickbooks.accounting — Read and write access to accounting data including chart of accounts, transactions, customers, vendors, items, and reportsopenid, profile, email — Basic identity verification for single sign-onYou may revoke FifthFirm's access at any time through your QuickBooks Online account at Apps > Manage Apps, or by contacting us at privacy@fifthfirm.com.
AI Model Training: Your data is not used to train AI models. AI-powered features use pre-trained models applied to your data at runtime only.
We do not sell, rent, or share your personal or financial data for cross-context behavioral advertising. We may share data:
We implement industry-standard security measures to protect your data, including:
GLBA Safeguards Rule.Because we process nonpublic personal financial information on behalf of accounting firms, we maintain a written information security program designed to align with the FTC Standards for Safeguarding Customer Information (“Safeguards Rule,” 16 CFR Part 314). The program designates a Qualified Individual responsible for security, requires a written risk assessment, multi-factor authentication, encryption, service-provider oversight, and a written incident response plan, and is reviewed at least annually.
No system is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using commercially reasonable measures.
We retain your data according to the following schedule:
| Data Type | Retention Period |
|---|---|
| Account profile information | Duration of account + 30 days |
| QuickBooks Online cached data | Duration of active integration + 30 days post-disconnect |
| Financial transaction records | 7 years (IRS record retention) |
| Audit logs | 7 years |
| Support correspondence | 3 years |
| Usage analytics (aggregated) | Indefinite (de-identified) |
| AI model training data | Not applicable — your data is not used to train AI models |
After the retention period, data is permanently deleted or irreversibly anonymized.
Depending on your jurisdiction, you may have the right to:
To exercise these rights, contact us at privacy@fifthfirm.com. We will respond within 30 days (or as required by your jurisdiction).
If you are a California resident, you have the right to: (i) know what personal information we collect, use, and disclose; (ii) request deletion of your personal information; (iii) opt out of the sale or sharing of personal information; and (iv) not be discriminated against for exercising these rights. We do not sell or share your personal information as defined by the CCPA/CPRA. To exercise your rights, contact privacy@fifthfirm.com. We will respond within 45 days.
You may submit a request to know, delete, correct, or opt out by emailing privacy@fifthfirm.com with the subject line "Privacy Rights Request" and the specific right you wish to exercise. We will acknowledge receipt and respond within 45 days of receiving a verifiable request, with one additional 45-day extension permitted where reasonably necessary. We will inform you in writing if an extension is required.
You may designate an authorized agent to submit a request on your behalf. We may require the authorized agent to provide proof of your written authorization and may contact you directly to verify the agent's authority. To protect your information, we verify the identity of every requester by matching the information in the request against the personal information we hold (for example, the email address and organization associated with your account). For sensitive or deletion requests, we may request additional verification before fulfilling the request. We will not fulfill a request we cannot reasonably verify.
The financial account and transaction data we process is considered sensitive personal information (SPI) under the CPRA. We collect and use SPI solely to provide and secure the Service you requested. We do not sell or share SPI, we do not use SPI for cross-context behavioral advertising, and we do not use SPI to infer characteristics about you. Because our use of SPI is limited to providing the Service, the CPRA right to limit the use of SPI does not impose additional restrictions on our processing.
Residents of states with consumer privacy laws (VCDPA, CPA, CTDPA, and others) have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising and profiling. To exercise any right, email privacy@fifthfirm.com with your state of residence. We will respond within the timeframe required by your state's law.
We do not sell or share personal information for cross-context behavioral advertising. No opt-out mechanism is required because no such activity occurs, but you may contact us at any time to confirm. A persistent "Your Privacy Choices" link in the footer of every page leads to this section so you can review and exercise your privacy rights at any time.
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following disclosures apply. Our hosting infrastructure is located primarily in Germany (within the EU), so EU/UK personal data may be processed in connection with the Service.
We process personal data under the following lawful bases: (i) performance of a contract — to provide the Service you or your organization have requested and to administer your account; and (ii) legitimate interests — to secure, maintain, and improve the Service, prevent fraud, and communicate with you, where those interests are not overridden by your rights and freedoms. Where we rely on consent (for example, optional communications), you may withdraw it at any time.
Subject to applicable law, you have the right to: access your personal data; request rectification of inaccurate data; request erasure ("right to be forgotten"); receive your data in a portable, machine-readable format; object to processing based on legitimate interests; and request restriction of processing. To exercise any of these rights, contact privacy@fifthfirm.com.
Where personal data is transferred outside the EEA or the UK to a country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, for UK transfers, the UK International Data Transfer Addendum, as appropriate safeguards. These transfer mechanisms are described further in our Data Processing Agreement (DPA). Contact legal@fifthfirm.com to obtain a copy.
You have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office) if you believe our processing of your personal data infringes applicable law. We would, however, appreciate the opportunity to address your concerns first — please contact us at privacy@fifthfirm.com.
EU/UK representative to be appointed if Article 27 applies. If a representative is required and appointed, their contact details will be published in this Policy.
In the event of a security breach involving your personal information, we will notify affected users without unreasonable delay and no later than as required by applicable law (typically 30–72 days depending on jurisdiction). Notification will include: (a) a description of the breach; (b) the types of data involved; (c) steps we are taking to address the breach; and (d) steps you can take to protect yourself. We will also notify relevant regulatory authorities as required by law.
When you connect your QuickBooks Online account to FifthFirm:
QuickBooks, QuickBooks Online, and Intuit are trademarks of Intuit Inc. FifthFirm is not affiliated with, endorsed by, or sponsored by Intuit Inc.
When your organization uses FifthFirm to process client financial data, Digital Inventory Group LLC acts as a data processor on your behalf. You remain the data controller. A Data Processing Agreement (DPA) is available upon request and governs our processing of personal data on your behalf. Contact legal@fifthfirm.com to obtain a copy.
The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Service at least 30 days before they take effect. Continued use after changes constitutes acceptance.
For privacy-related inquiries:
Digital Inventory Group LLC
Email: privacy@fifthfirm.com