Ledgerpost privacy policy
Last updated: October 2026
Who operates Ledgerpost
Ledgerpost is a Shopify app that records a store's Shopify sales, payments, refunds and payouts in the store's own QuickBooks® Online company. It is operated by Libanto Inc. ("Libanto") and served from app.getledgerpost.com. Questions about this policy: privacy@getledgerpost.com.
In this policy, "merchant" means the Shopify store that installs Ledgerpost, and "customer" means a person who bought from that store.
Libanto's role
For the customer data described below, the merchant decides why and how it is used, and Ledgerpost processes it on the merchant's behalf, only to provide the app to that merchant. Libanto accesses a merchant's data only to operate and maintain the app, to answer the merchant's own support request, or when the law requires it.
What the app reads and stores
The app reads only what it needs to write accounting records. Its Shopify queries do not request customer phone numbers, order notes or payment card details. Shopify's webhook notices can carry more fields than the app asks for, including masked card details; the app discards them and keeps only the event's identifiers and processing details. From QuickBooks it stores the complete reference records it reads (accounts, items, customers, tax codes, terms, payment methods), which can include a QuickBooks customer's phone number or notes where the company recorded them, and it reads existing QuickBooks transactions that resemble a record it is about to write, including records created outside the app, to avoid creating a duplicate.
| Source | Data | Why |
|---|---|---|
| Shopify: the store | Shop domain, store name, store contact email, time zone, currency, Shopify plan name | Identify the store, date and price records correctly, send the store's notifications |
| Shopify: orders | Order number and dates, line items, quantities and prices, discounts, shipping, taxes, tips and duties, payment gateway and amounts, payment status and terms, refunds (including refund notes), returns, B2B company and location | Create the matching invoice, sales receipt, payment, credit memo or refund receipt in QuickBooks |
| Shopify: customers | Name, email address, billing and shipping addresses, customer tags, tax-exempt flag | Find or create the matching QuickBooks customer and fill the invoice's customer fields; apply the merchant's posting rules |
| Shopify: products | Product and variant titles, SKUs, prices | Match or create QuickBooks items |
| Shopify: payouts | Shopify Payments payout amounts, dates, fees and the transactions in each payout | Record the bank deposit and fees in QuickBooks |
| Shopify: staff | The name, email address and owner/collaborator status of the staff member using the app, from Shopify's session | Decide what each person may do in the app and record who made each change |
| QuickBooks Online | Company id and settings (home currency, sales tax, class and location tracking, closing date); the company's accounts, items, customers (names, emails, addresses), tax codes, terms and payment methods; the records the app wrote | Map Shopify data to the right QuickBooks accounts and records, avoid duplicates, and check that each record was written correctly |
| QuickBooks Online | Access and refresh tokens for the connection | Write to the company the merchant connected; encrypted with a key specific to the store |
| The merchant | Mappings, posting rules, decisions on held orders (including any reason typed), notification recipient email addresses | Operate the app as the merchant configured it |
| The merchant, on request | A settings file the merchant downloads (Settings, Backup): mappings, posting rules and notification preferences, with no customer data and no credentials | Kept by the merchant, not by Libanto, to restore settings after a reinstall |
| The app | A posting ledger (which QuickBooks record came from which Shopify event), the Activity record of what posted and why, an exception list, an audit log of who changed what | Prevent duplicate records, explain what did not post and why, and show an audit trail |
| The merchant, when asking for help | The help question as typed, who asked, and the diagnostic context the app attaches (the store, the QuickBooks company, the plan, the last step that worked) | Answer the request; deleted 12 months after it was asked |
| The merchant, when inviting a bookkeeper (where the bookkeeper review is available) | The invited bookkeeper's name and email address, the invitation, the review sessions and what was handed off | Let the bookkeeper review cases; a revoked bookkeeper's name and email are redacted after 30 days, review sessions are deleted seven days after they expire, expired or revoked invitations are deleted after 12 months together with their hand-offs, a resolved hand-off still present after 400 days loses its content and names, and the record of a bookkeeper's commands stays for the life of the installation |
The app writes customer names, email addresses and addresses into the merchant's QuickBooks company as part of the records it creates there. Those records then belong to the merchant's QuickBooks company and are governed by the terms and privacy statement of Intuit®.
What Libanto does not do
- Libanto does not sell or rent personal data, and does not use it for advertising.
- The app and its public pages use no advertising or analytics trackers.
- Libanto does not use customer data for any purpose other than providing the app to the merchant who installed it.
- Application logs and error reports are written without customer names, email addresses, addresses or access tokens.
Service providers (subprocessors)
| Provider | Purpose | Data involved |
|---|---|---|
| Shopify (Shopify Inc.) | The platform the app runs in; billing for the app | The data listed above, read through Shopify's API |
| Intuit Inc. (QuickBooks Online) | The merchant's accounting system the app writes to | The records the app creates, including customer names, emails and addresses |
| Google Cloud Platform (Google LLC) | Runs the app's servers and its database (Cloud SQL) with their backups, in the United States (us-central1) | All data the app stores |
| Twilio SendGrid (Twilio Inc.) | Sends the app's notification emails, from alerts@getledgerpost.com, to the recipients the merchant chose; open and click tracking are turned off | Recipient email addresses; email contents carry the store's name, posting statuses, counts, Shopify order numbers, dates and plan details and, in the weekly summary, totals by currency and the names of the store's staff or bookkeeper who made decisions; never a customer's name, email address or address. SendGrid also delivers the notice of a help request (its reference and answer time) to Libanto's support inbox, and an invited bookkeeper's personal review link |
Each provider's handling of data is governed by its own privacy policy.
How long data is kept
While the app is installed, a daily clean-up deletes records once they reach the ages below, in batches; a backlog continues on the following days.
| Data | While the app is installed | After the app is uninstalled |
|---|---|---|
| Shopify login sessions | Managed by Shopify's library | Deleted when the store's data is erased |
| QuickBooks connection tokens | Kept while connected | The app attempts to revoke the connection at Intuit before erasure; the locally stored tokens are deleted with the store's data |
| The posting ledger (which QuickBooks record came from which Shopify event), order, customer and product records, mappings and settings | Kept while installed, because the ledger is what prevents duplicate records in QuickBooks; a customer's personal data in them is erased when Shopify forwards that customer's deletion request | Deleted with the store's data |
| Activity (the record of what posted and why), decided exceptions, received webhooks and finished background jobs | Deleted 12 months after they were written or decided; an uninstall or permission-change notice that is still unresolved is kept until it is resolved | Deleted with the store's data |
| Audit log (Settings, Activity) | Deleted after 24 months | Deleted with the store's data |
| Usage counters (orders posted per month, QuickBooks calls per day) | Deleted after 13 months | Deleted with the store's data |
| Notification emails the app sent, failed to send or suppressed | Deleted after 90 days (one still being sent is kept until it is settled) | Deleted with the store's data |
| Finished dry runs and backfill requests | Deleted 12 months after they were created, except the store's latest go-live and any correction that can still be resumed; unfinished work is kept | Deleted with the store's data |
| Support session records | Deleted 24 months after the session | Deleted with the store's data |
| Customer privacy requests and data exports | Deleted 30 days after the request is completed | Deleted with the store's data |
| All of the store's data | — | Uninstalling suspends the store. Shopify normally sends its shop data deletion request 48 hours after uninstall; the app then checks the installation, asks Intuit to revoke the QuickBooks connection, and erases the store's data; a missing or unclear confirmation from Shopify can delay the erasure. If no deletion request arrives, the app starts the erasure itself once Shopify's records confirm an uninstall at least 30 days old |
| Backups | Daily database backups kept for 30 days, and a continuous recovery log kept for 7 days | Deleted data leaves backups as they expire |
Reinstalling before the erasure has started lifts the suspension and keeps the store's history, settings and QuickBooks connection. Once the erasure has started, a reinstall is a new installation with no history. Settings can be kept by the merchant: Settings, Backup, Export settings downloads a file the merchant holds, and Import settings on a new installation restores the mappings, posting rules and notification preferences. QuickBooks accounts and items are reused only in the company they came from.
Customer privacy requests
Shopify forwards customers' privacy requests to the app:
- Data request: the app collects the customer's stored record, the customer mappings (including the identifier of the matched QuickBooks customer), the customer's stored orders and the identifiers of further orders of theirs found through dry runs into a file the store owner can download from the app (Settings, Privacy requests) and pass on to the customer, within 30 days. For anything else the app may hold about that customer (a help question that mentions them, for example), the store owner writes to privacy@getledgerpost.com and Libanto completes the answer within the same 30 days.
- Deletion request: the app erases the customer's name, email address and addresses, and the free text of the records linked to that customer or their orders (including help requests linked to one of their cases), within 30 days, and keeps a marker so later updates from Shopify are stored without them. A general help question that mentions the customer without being linked to their case is not matched automatically; it is deleted with the 12-month retention of help requests, or earlier on request to privacy@getledgerpost.com. Amounts, dates and record identifiers are kept so the store's accounting history stays consistent.
- The app does not change the merchant's QuickBooks company when a customer asks for deletion. Records already written to QuickBooks are the merchant's to manage in QuickBooks.
Depending on where they live, people may also have the right to access, correct, export or delete their personal data. Requests can be sent to privacy@getledgerpost.com; Libanto answers within 30 days.
Security
- Data travels over encrypted connections (TLS 1.2 or higher).
- QuickBooks and Shopify access tokens are encrypted at rest with AES-256-GCM under a key specific to each store; the database and its backups are encrypted at rest by Google Cloud.
- Test and production data are kept in separate databases.
- Access to production is restricted to Libanto's operator and is logged.
- Support staff can see a store's data only through a time-limited support session (4 hours by default) that is recorded and visible to the merchant in Settings, Activity, and that the merchant can revoke. Customer names and other free text in the accounting views stay masked in support sessions unless a specific exception needs them; support can read the help question the merchant wrote, including anything personal typed into it; each viewed field is logged.
- If Libanto becomes aware of a security incident affecting a merchant's data, it notifies the merchant at the store's contact email without undue delay, with what happened, what data was involved and what Libanto has done, and notifies the platforms involved as their terms require, Intuit within 24 hours of discovery. Security concerns can be reported to privacy@getledgerpost.com.
Merchant choices
- A merchant can pause posting, disconnect QuickBooks, or uninstall the app at any time.
- A merchant can choose to post all sales under one generic QuickBooks customer instead of creating a QuickBooks customer per Shopify customer. The invoices and receipts themselves still carry the order's billing email and addresses.
Changes
Libanto updates this page when what the app stores or how it is used changes, and changes the "Last updated" date above. A material change is announced by email to the store's contact address or inside the app at least 14 days before it takes effect.
Contact
Privacy questions and requests: privacy@getledgerpost.com. Support: support@getledgerpost.com. Libanto Inc.
Shopify is a trademark of Shopify Inc. Intuit® and QuickBooks® are trademarks of Intuit Inc., used to describe compatibility. Ledgerpost is not affiliated with, sponsored or approved by Intuit or Shopify.