Privacy Policy

This Privacy Policy explains what information Tivexi Ops (the "Software"), operated by Tivexi ("we", "us"), collects, how it is used, and how it is protected.

1. Information we collect

• Account information: your name, work email address and role.
• Security information: a hashed password, an encrypted authenticator secret and hashed backup codes. We never store your password in readable form.
• Activity records: sign-ins, IP address, browser and device type, approvals, setting changes and postings, kept in an audit log.
• Business data from connected services: products, inventory, purchase orders and shipments from ShipHero; accounts, vendors, customers, bills and invoices from QuickBooks Online; and customer and vendor contact details entered in the Software.

2. How we use information

• To sign you in securely and protect accounts, including alerts about sign-ins from new devices.
• To calculate inventory costs and prepare and post accounting records to QuickBooks Online.
• To send password resets, alerts, digests, invoices and quotes by email through Google Workspace.
• To keep an audit trail of who did what, for accounting controls and security.

We do not sell personal information or use it for advertising.

3. Sharing

Information is shared only with the services the Software needs to work:

• Intuit (QuickBooks Online), ShipHero and Google Workspace, to read and write business records and send email.
• Render, which hosts the Software and its database.
• Our error-tracking provider, which receives technical error details with customer and financial data removed.

We may also disclose information if required by law.

4. QuickBooks data

Data accessed through Intuit's APIs is used only to provide the Software's accounting features for Tivexi. Connection tokens are encrypted at rest. An administrator can disconnect QuickBooks at any time, which revokes the Software's access.

5. Security

• All traffic is encrypted in transit (HTTPS).
• Two-factor authentication is required for every account, and sessions end after 30 minutes of inactivity.
• API tokens and authenticator secrets are encrypted at rest; the database is backed up and access is restricted to the hosting provider's private network.

6. Retention

Accounting records and the audit log are kept permanently as part of Tivexi's financial records. Account information is deleted when an administrator removes the account; audit log entries referring to it are kept.

7. Your choices

You can update your theme and alert preferences in your profile. To correct or remove your account information, contact a Tivexi administrator.

8. Changes

We may update this policy. The date at the top shows the latest version.

9. Contact

Questions about privacy: contact your Tivexi administrator.