Who is responsible
Christian Cheese operates CIA for its authorized team and business collaborators. This policy covers CIA at cia.christiancheese.com, including its public pages, team workspace, and connected features. For privacy questions, corrections, access, or deletion requests, contact mike@christiancheese.co.
Information we collect
- Accounts and access: names, email addresses, roles, account status, display preferences, password hashes, session records, and invitation or recovery records. CIA stores password hashes rather than readable passwords.
- Business activity: missions, assignments, inventory products and locations, counts and commitments, opportunities, business contacts, manual financial records, source references, notes, and the reasons and history associated with changes.
- QuickBooks, when authorized: the selected company’s identity, authorization credentials, and cash-basis profit-and-loss report figures, dates, and account/category labels. The current connector reads company information and reports; it does not import an entire bank feed or every QuickBooks transaction.
- Voice inventory, when used: microphone audio or typed dictation, the transcript, relevant product catalog context, and a proposed stock change. Microphone recording starts only when you choose to record and grant browser permission. CIA does not request device GPS location; inventory locations are business labels entered by the team.
- Technical information: hosting and security logs may include IP address, browser information, requested paths, timestamps, response status, and error or security events.
Do not enter bank passwords, payment-card details, government identification numbers, health information, or unrelated sensitive personal information into notes or dictation. CIA does not need your BancFirst password; the bank connection is managed through QuickBooks and the bank.
How we use information and who can see it
We use information to provide team access, maintain business operations and records, prepare authorized financial reports, interpret requested inventory dictation, resolve errors, support users, and maintain security and accountability.
Team members can see records allowed by their organization and permissions. Financial access is controlled by the owner. Only the owner can manage CIA’s QuickBooks connection. Private case notes are scoped to their individual owner. Public policy pages and the fictional public preview do not provide access to private business records.
CIA does not sell personal information or use business records for targeted advertising. It has no integrated third-party advertising or user-analytics service.
Service providers and external services
- Railway: hosts CIA and its PostgreSQL database and processes technical information needed to run and protect the service.
- Intuit / QuickBooks: handles QuickBooks authorization and supplies the company reports you authorize CIA to retrieve. Your QuickBooks subscription, its bank connection, and Intuit’s own processing are governed by Intuit’s terms and privacy information.
- OpenAI: when voice inventory is used, audio is sent for transcription and the transcript plus relevant product catalog context are sent for interpretation. CIA does not currently send its QuickBooks report cache to this voice feature. Provider processing and retention follow the applicable API terms and OpenAI data controls; this policy does not promise zero provider retention.
- Google Fonts: pages load fonts from Google’s font services, which receive technical request information such as IP address and browser details. Browser caching may reduce repeat requests.
Authorized technical operators may access information as needed to maintain the service, troubleshoot a user-requested issue, or perform an authorized recovery. Information may also be disclosed when required by law or reasonably necessary to protect people, rights, or service security. Processing locations depend on the providers and their configured services; CIA does not promise that all information stays in a particular state or country.
Cookies and browser storage
CIA uses essential session cookies to keep you signed in and a short-lived cookie during QuickBooks authorization. Session cookies are HttpOnly, Secure in production, and SameSite protected. Display preferences may be stored in your account or browser. CIA does not set advertising cookies. Blocking essential cookies can prevent sign-in or authorization from working.
Retention, disconnecting, and deletion
Business records and audit history are retained for ongoing operations, accountability, and applicable recordkeeping needs. There is currently no automatic deletion date for all CIA business data. Expiration of a session or recovery link does not mean the underlying business records are deleted.
CIA processes voice audio transiently and does not save audio files in its application database. A transcript confirmed with a stock change is retained in the business change history. OpenAI’s handling of submitted audio and text is separate from CIA’s own storage.
The owner can disconnect QuickBooks in CIA to stop CIA’s access and remove its saved authorization credentials and current report cache. Disconnecting does not automatically delete manual CIA records, security or audit history, records in QuickBooks, or provider backups. To revoke the app’s authorization with Intuit as well, remove its access in QuickBooks.
You may request access, correction, an export, or deletion by emailing mike@christiancheese.co. We will verify your identity and authority, review the request, and respond in accordance with applicable requirements. Some business, audit, security, or legal records may need to be retained; we will explain relevant limits. Backups and provider-held copies follow their applicable retention and deletion processes. CIA does not currently provide a self-service account deletion button.
Security and your choices
CIA uses HTTPS, hashed passwords, access controls, and encrypted QuickBooks credentials. No internet service can guarantee absolute security. Keep your password and one-time links private, sign out on shared devices, and contact us promptly about suspected unauthorized access. You may use manual inventory entry instead of voice and ask the owner to change or suspend your access.
CIA is intended for authorized business users and is not directed to children. If you believe a child’s information was submitted inappropriately, contact us.
Policy updates
We may update this policy as CIA’s features or processing change. The updated policy and effective date will be published here. Material changes will also be communicated through an appropriate team or account communication channel.