MoJo Privacy Policy

Effective date October 14, 2026

MoJo Growth Advisors, LLC (MoJo, we, us) provides MoJo Practice Management and its MoJo Bookkeeping Gateway integration for authorized staff working on assigned client engagements. This policy describes information handled through that internal service. It does not replace a client engagement agreement or Intuit’s or Google’s separate privacy notices.

Information we handle

We receive information you provide when requesting access, assigning work, reviewing transactions, recording decisions, or requesting support. This may include staff names and work email addresses, client and company references, task details, review notes, approvals, and supporting business evidence.

When an authorized person connects a QuickBooks Online company, we may obtain company information, account names and identifiers, transaction identifiers, dates, amounts, descriptions, payees, categories, and reports needed for the enabled workflow. Accounting records may contain personal information about customers, vendors, employees, or other people. Access is limited to the assigned company and the approved purpose.

We also handle connection credentials, access and refresh tokens, authorization records, and operational and security records needed to maintain access and investigate errors. Tokens are confidential service credentials. Provider sign-in takes place with Intuit or Google; the service does not ask you to provide your QuickBooks or Google account password.

How we use information

We use information to provide authorized bookkeeping and practice management workflows, retrieve relevant accounting evidence, support staff review, record approvals and outcomes, maintain client assignments, protect the service, and resolve support issues. We may also retain information needed to meet applicable legal obligations or document an engagement.

MoJo intends to offer AI-assisted transaction coding recommendations, anomaly detection, financial-statement analysis, and review summaries. Where an AI-assisted feature is enabled for an authorized engagement under an approved provider arrangement, the information used may include the relevant accounting transactions, financial statements, and supporting evidence needed for that purpose. These features support staff review. Their outputs are drafts or recommendations; a responsible human must review the source evidence and approve the proposed accounting effect before any accounting change is made. Approval of these intended uses does not by itself authorize an AI provider to receive client information or authorize an accounting change.

Connecting a company gives the service the permissions stated by Intuit on its consent screen. That consent is not an instruction to make every change technically permitted by the connection. Accounting changes require the enabled workflow and the applicable client authorization and review. The initial production connection will have accounting writes disabled. A separately approved pilot may change the category of one supported existing Purchase only after review of its exact accounting effect. Connection permission alone cannot enable that action.

People and providers with access

Authorized MoJo personnel may access information needed for their assigned responsibilities. Google Cloud hosts the protected accounting service and its protected storage in us-central1, Iowa, United States. Intuit supplies the QuickBooks connection. If approved for publication, Cloudflare Pages will serve only public informational and legal pages; those pages do not receive QuickBooks credentials, authorization callbacks or client accounting records. Providers process information under their applicable terms and privacy notices. We may disclose information when required by law, to protect rights and security, or as directed by an authorized client representative.

Our policy is not to sell client information or use connected accounting information for advertising. We do not permit use of client accounting information to train a general-purpose artificial intelligence model without separate, explicit authorization and an approved provider arrangement. Any AI-assisted processing must be approved for its purpose, provider, and client access before it is used. These restrictions govern MoJo’s use of the information; they do not describe every independent activity of Intuit or Google.

Security and account responsibilities

We use access controls, encrypted connections, protected credential storage, client assignments, and approval and audit records appropriate to the enabled service. Staff must use their own authorized accounts and keep authentication factors private. We review access when responsibilities change and investigate suspected unauthorized use.

No service can guarantee absolute security. If we identify a security incident involving personal information, we will assess it and provide notifications required by applicable law and the relevant engagement terms. Contact us promptly if you believe an account or connection has been misused.

Retention and disconnection

We retain information only for the service purpose, applicable engagement requirements, legitimate security and audit needs, or legal obligations. OAuth authorization state is valid for five minutes. We review temporary connection evidence for retention eligibility after 30 days and safe audit records after 90 days. These are review targets, not promises of automatic deletion or maximum retention periods. We preserve unresolved operations, consumed-action markers, required engagement records and legal holds. There is no automatic deletion process in the initial pilot.

An authorized representative may request that a company be disconnected. We will verify the request and confirm when further service access has been stopped. Removing a connection does not reverse or delete transactions already saved in QuickBooks. Review and audit information already held by MoJo may remain subject to retention obligations. A disconnection request does not by itself confirm that retained records have been erased.

You may request deletion of eligible information. We may retain information necessary for legal obligations, security, disputes, or engagement records, and explain any applicable limitation. The initial pilot does not promise an independent backup or a tested restore service. Any backup and return arrangements required by an engagement must be established before that engagement uses the service; we will disclose their retention and restricted access when enabled.

Requests and choices

For access, correction, deletion, disconnection, or privacy questions, contact russ@companyvitals.com. We verify identity and authority before acting, including the client’s authority over its company data. Available rights depend on applicable law and our role in the engagement. Where we process information on a client’s behalf, we may refer the request to that client or act under its instructions.

Only supply information needed for the assigned work. Do not enter passwords, authentication codes, or unrelated sensitive personal information in task notes or support messages. The service is intended for authorized business users and is not directed to children.

Hosting and authentication

The protected accounting service and its configured Google Cloud storage are in us-central1, Iowa, United States. Public informational pages, if published using Cloudflare Pages, may be delivered through Cloudflare’s global network. Connected accounting records and credentials remain on the protected Google Cloud service. We will review any material change in hosting location or provider and apply safeguards required for relevant transfers.

Authentication and hosting providers may use cookies or similar technologies necessary for sign-in and service operation under their own notices. This policy does not authorize third-party advertising trackers in the service. Any material change in provider or data use will be reviewed before implementation.

Changes and contact

We will make the adopted policy available to authorized users and clients and communicate material changes as required. Operator: MoJo Growth Advisors, LLC. Privacy and support: russ@companyvitals.com. Business address: 1344 S 500 W, Mapleton, UT 84664-4531.