Privacy Policy

1. Who we are and what this policy covers

Sangoku Labs LLC ("Sangoku Labs", "we", "us") is a Georgia, USA company. We build and operate custom automation systems for business clients. One of those systems is bookkeeping automation: with the client's authorization, it connects the client's own bank and card accounts to the client's own QuickBooks Online company, so transactions are categorized, reviewed by the client's people, and recorded in the client's books.

This policy covers two situations:

• Visitors to sangokulabs.com. What the website itself collects, which is very little.
• Client business data. Data belonging to a client that we process while operating a system on that client's behalf.

When we process client data we act on the client's instructions. The client owns that data and the accounts it lives in; we are an operator working inside them.

2. Data we process for clients

Depending on the system we operate, we may process:

• Bank and card transaction data retrieved through Plaid with the client's authorization: dates, amounts, descriptions, merchant names, and the account each transaction belongs to.
• Accounting data read from and written to the client's QuickBooks Online company through Intuit's API with the client's authorization: the chart of accounts, vendors, customers, existing transactions, and the entries we record.
• Review and approval records: which transactions were flagged, who approved or changed them, when, and any notes left in the review workflow.
• Contact details of the client's team: names, work email addresses, and roles, so the right people receive the right reviews and reports.

Two things we never receive or store:

• The client's bank login credentials. Plaid handles bank authentication directly with the client's bank. We receive only an access token limited to the accounts the client chose to share, and the client can revoke it at any time.
• The client's QuickBooks Online password. Our access to a client's QuickBooks company is granted by the client through an accountant or team invitation, and the client can remove it at any time.

3. How we use it

We use client data only to deliver the service the client engaged us for: categorizing and recording the client's own transactions, flagging anything that needs a human decision, and reporting to the client and its accountant.

We do not use client data for advertising. We do not build profiles from it. We do not sell or rent it. We do not use it to train AI models. Where an automated step suggests a category for a transaction, that suggestion is reviewed by the client's people before anything is recorded, and the data behind it stays inside that client's workflow.

4. Where it lives and who else touches it

Client data is held and processed on these platforms, each acting as a subprocessor for the role described:

• Plaid Inc. Bank and card connectivity.
• Intuit Inc. QuickBooks Online, the client's accounting system.
• n8n (n8n Cloud). Workflow automation, where the steps run.
• ClickUp. The review and approval workflow.
• Google Workspace. Documents, spreadsheets, and email.

Data stays within accounts the client owns or accounts we operate for that client. We do not combine one client's data with another's, and nothing is shared across clients.

5. Security

• Data is encrypted in transit and at rest on the platforms listed above.
• Access is limited to the client and to Sangoku Labs personnel who need it to operate the client's system.
• Operator accounts use multi-factor authentication.
• Connection credentials and tokens are stored only in the automation platform's encrypted credential store, never in documents, spreadsheets, or chat.

No system is perfectly secure. If we learn of a security incident affecting a client's data, we tell that client promptly and work with them on the response.

6. Retention

We keep client data for the duration of the engagement and for as long as the client's books require it. On request, or at the end of the engagement, we delete the data we hold or return it to the client, subject to the client's own retention obligations. Records that live in the client's own accounts, such as the entries in its QuickBooks company, stay with the client because they are the client's.

7. Client and individual rights

A client can ask us at any time to access, correct, or delete the data we process for it, and can withdraw an authorization we rely on:

• Plaid: revoke our access from Plaid Portal or from the bank's own connected-apps settings.
• QuickBooks Online: remove our accountant or team user from the company's user management.

If you are an individual whose information appears in a client's records, for example a vendor or an employee, please contact that client first, since it controls those records. We help clients respond to such requests. You can also email us at contact@sangokulabs.com.

8. Website visitors

sangokulabs.com is a static website. It sets no cookies and runs no analytics. Our hosting provider keeps standard server logs (IP address, page requested, browser type, and time) for security and operations, for a limited period. The site stores one flag in your browser's session storage so its intro animation plays only once per visit; that flag never leaves your browser.

The site has one form, the audit request. If you use it, we receive what you type: your name, email address, company if you give one, what you would like automated, and any tools you tick. The form also records the page it was sent from, the time, your browser type, and a one-way hash of your IP address that we keep only to block abuse; we do not store the address itself. Submissions are emailed to our mailbox and recorded in a spreadsheet in our Google Workspace, both readable only by Sangoku Labs personnel. We use them to reply to you and for nothing else, keep them as long as the conversation needs, and delete them on request. We do not sell visitor data.

9. Children

Our website and services are directed to businesses and are not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have, email us and we will delete it.

10. Changes to this policy

We may update this policy as our services change. The effective date at the top of the page changes when we do, and material changes to how we handle client data are communicated to affected clients directly.

Questions or requests: contact@sangokulabs.com. Sangoku Labs LLC, Georgia, USA.