1. Overview

Hojjati CPA, APC ("Firm," "we," "us," or "our") operates the Luca Agentic Bookkeeper application ("Luca") as an internal tool to provide bookkeeping and accounting services to our clients. This Privacy Policy explains how we collect, use, store, and protect information in connection with your use of Luca.

By using Luca, you consent to the data practices described in this policy.

2. Information We Collect

2.1 QuickBooks Online Financial Data

With your authorization, Luca accesses your QuickBooks Online company file through Intuit's official API. This includes: transaction records, chart of accounts, vendor and customer information, bank and credit card account data, payroll information (if applicable), and financial reports.

2.2 Application Usage Data

We collect information about how you interact with Luca, including: transaction approval and review decisions, account categorization preferences, login timestamps, and error logs for troubleshooting purposes.

2.3 Client Brain Data

Luca stores client-specific configuration data ("brain files") that includes business rules, vendor categorization preferences, loan schedules, and other bookkeeping context. This data is created and maintained by the Firm on your behalf.

3. How We Use Your Information

We use your information solely to: (a) provide automated bookkeeping categorization and review services; (b) detect and flag anomalous transactions for professional review; (c) apply client-specific accounting rules and preferences; (d) maintain audit logs of all bookkeeping decisions; (e) improve the accuracy of the Luca system over time; and (f) fulfill our obligations under our engagement agreement with you.

We do not sell, rent, or share your financial data with any third party for marketing, advertising, or any purpose other than providing the services described in this policy.

4. Data Storage and Security

Your financial data is processed and stored on systems controlled by the Firm. We implement the following security measures: OAuth 2.0 authentication for all QuickBooks Online access, encrypted token storage, access controls limiting data access to authorized Firm personnel only, and audit logging of all data access and modification events.

QuickBooks Online data is accessed through Intuit's official API and is subject to Intuit's security infrastructure and policies. OAuth access tokens are stored locally and refreshed automatically. You may revoke Luca's access to your QuickBooks Online account at any time through your Intuit account settings.

5. Data Retention

We retain your financial data and bookkeeping records for the period required by applicable professional standards and tax regulations, generally a minimum of seven (7) years. Audit logs and categorization records are retained for the same period. You may request deletion of your data subject to our legal and professional obligations.

6. Third-Party Services

Luca uses the following third-party services to operate:

Intuit QuickBooks Online API — for accessing and updating your financial data. Intuit's privacy policy governs their handling of your data at intuit.com/privacy.

Anthropic Claude API — for AI-powered transaction categorization and anomaly detection. Transaction data including vendor names, amounts, and dates is transmitted to Anthropic's API for analysis. Anthropic's privacy policy governs their handling of this data. No personally identifiable information beyond what appears in your transaction records is transmitted.

We do not use any other third-party services that receive your financial data.

7. Your Rights

You have the right to: (a) access the financial data and brain file records we maintain about your business; (b) request correction of inaccurate data; (c) request deletion of your data, subject to our legal retention obligations; (d) revoke Luca's access to your QuickBooks Online account at any time; and (e) receive a copy of your data in a portable format upon request.

To exercise any of these rights, please contact us at https://hojjaticpa.com.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Luca application. Continued use of Luca after such notice constitutes acceptance of the updated policy.