Effective September 15, 2026
InvoiceApp is operated by Pinnstone, LLC d/b/a Highmark Systems ("Highmark," "we," "us," or "our"). InvoiceApp is an internal business application that connects Highmark's Relay operations platform with Highmark's QuickBooks Online company to prepare and reconcile accounting records, including draft invoices.
This Privacy Policy explains the information InvoiceApp accesses, how that information is used, and the choices available to authorized users.
1. Scope
This Policy applies to InvoiceApp and its connection to QuickBooks Online. It does not replace the privacy policies or terms of Intuit, QuickBooks, Relay's other providers, or websites and services outside InvoiceApp.
InvoiceApp is intended for authorized Highmark personnel. It is not offered as a consumer service and is not intended for children.
2. Information InvoiceApp Accesses
InvoiceApp may access the following information when an authorized user connects a QuickBooks Online company:
- QuickBooks company information: company name, company identifier, accounting settings, and connection status.
- Customer and accounting-reference information: customer records and the products, services, accounts, tax codes, terms, or other references needed to prepare accurate invoices.
- Transaction information: draft and issued invoices, invoice lines, dates, amounts, balances, status, and related transaction identifiers required to create or reconcile invoices.
- Relay operational information: client names, approved time records, service dates, project or task references, invoice descriptions, rates, and amounts selected for transfer to QuickBooks.
- Authorization information: OAuth access and refresh tokens, granted scopes, QuickBooks company identifier, and token-expiration information. InvoiceApp does not receive or store an authorized user's Intuit password.
- Technical and audit information: timestamps, request and response status, Intuit transaction or diagnostic identifiers, application errors, connection events, and security logs. Logs are designed to avoid storing OAuth secrets or unnecessary accounting content.
InvoiceApp is not designed to collect protected health information, payment-card data, banking credentials, consumer credit information, or Intuit account passwords. Authorized users must not enter protected health information or payment-card data into InvoiceApp or into invoice descriptions transferred through it.
3. How Information Is Used
We use information accessed through InvoiceApp only to:
- connect and maintain the authorized QuickBooks Online integration;
- identify the correct QuickBooks company, customer, service item, and accounting references;
- create, read, update, and reconcile draft invoices and their status;
- prevent duplicate invoices and preserve links between Relay time records and QuickBooks transactions;
- troubleshoot errors, provide support, maintain audit records, and protect the integration from unauthorized access; and
- comply with applicable accounting, tax, legal, and record-retention obligations.
InvoiceApp does not use QuickBooks data for advertising, marketing profiles, data brokerage, unrelated analytics, or artificial-intelligence model training. Data from one connected company is not shared with or used to benefit another customer or company.
4. How Information Is Shared
We do not sell or rent information accessed through InvoiceApp.
We may disclose information only in the following circumstances:
- Intuit and QuickBooks: as necessary to authenticate the connection and perform authorized QuickBooks API operations.
- Infrastructure and service providers: to providers that host, secure, monitor, or support InvoiceApp and Relay, subject to contractual and technical safeguards appropriate to their role.
- Legal and safety requirements: when reasonably necessary to comply with law, legal process, or valid governmental requests; protect rights, safety, and security; investigate fraud or abuse; or enforce applicable terms.
- Business transactions: in connection with a merger, reorganization, financing, sale of assets, or similar transaction, subject to applicable confidentiality and privacy obligations.
5. Data Security
InvoiceApp is designed to use encrypted network connections, encrypt OAuth credentials at rest, restrict access to authorized Highmark personnel, validate OAuth state to reduce cross-site request-forgery risk, and retain audit records of material connection and invoice actions.
No system can guarantee absolute security. If we identify a security incident affecting information governed by this Policy, we will investigate and provide notices as required by applicable law and contractual obligations.
6. Data Retention and Deletion
OAuth credentials and connection metadata are retained while the QuickBooks connection remains active. When an authorized user disconnects InvoiceApp, InvoiceApp will revoke the connection when supported and delete stored OAuth credentials from the active application database.
Accounting records, invoice identifiers, audit events, and synchronization records may be retained after disconnection when reasonably necessary for financial recordkeeping, security, dispute resolution, legal compliance, or prevention of duplicate transactions. Information retained in QuickBooks remains governed by the QuickBooks account holder's settings and Intuit's policies.
Authorized users may request access, correction, export, or deletion of information maintained by InvoiceApp by contacting us. Some information may be retained where required by law or legitimate accounting and security needs.
7. User Choices and Control
An authorized user can choose whether to connect a QuickBooks Online company and can disconnect that company from InvoiceApp. Disconnecting stops new API access after the active authorization is revoked or expires, subject to technical processing time.
Changes made directly in QuickBooks Online may remain in QuickBooks after InvoiceApp is disconnected. Users should use QuickBooks controls or contact Intuit regarding records maintained solely by Intuit.
8. United States Processing
InvoiceApp is operated in the United States. Information may be processed and stored in the United States by Highmark and its service providers, subject to applicable law and contractual safeguards.
9. Changes to This Policy
We may update this Policy when InvoiceApp's functionality, providers, or legal obligations change. The revised Policy will state a new effective date. Material changes will be communicated to authorized users through an appropriate business or application channel.
10. Contact Us
Questions, privacy requests, or security concerns relating to InvoiceApp may be sent to: