Privacy policy
Last updated 28 October 2026
Steward is an internal accounting tool. It is operated by one group of companies in Dubai (the “operating group”) for its own two entities, and is used only by staff and advisers the operating group invites. It is not offered to the public. This policy explains what data Steward reads from QuickBooks Online, why, and how it is kept.
Data we access from QuickBooks
When an authorised accountant or administrator connects a QuickBooks Online company, Steward reads that company’s accounting data:
- the chart of accounts, classes, tax codes and items;
- customers and vendors (names and the contact details held in QuickBooks);
- invoices, bills, payments, expenses, journal entries and other transactions;
- budgets and reports (for example trial balance, profit and loss, balance sheet).
Steward also holds the bank statements, receipts and supplier invoices that staff upload, and the name and email address of each signed-in user.
Why we use it
- To prepare bookkeeping drafts (invoices, bills, expenses, payments) for the accountant to review.
- To match bank statement lines to ledger entries.
- To produce reports and board packs for the accountant and the finance board.
Nothing is written to QuickBooks unless the accountant explicitly approves it in Steward.
Where it is stored
- The application is hosted on Vercel.
- The database is a managed Postgres database in the Frankfurt (EU) region.
- Uploaded and generated files are kept in private storage, not publicly accessible.
- QuickBooks OAuth tokens are encrypted at rest and are never shown to users or sent to the browser.
- All traffic is encrypted in transit (HTTPS).
Who can see it
Access is limited to users the operating group has invited, signed in with their Google work account. Each user has a role (administrator, accountant, viewer or board) that limits what they can see and do.
Sharing
We do not sell, rent or share QuickBooks data with third parties, and we do not use it for advertising or marketing. Data is processed only by the service providers needed to run Steward (hosting, database and file storage), under their standard terms, and only to provide the service.
Audit logging
Every change made in Steward is recorded in an audit log: who made it, what changed, when, and the values before and after. Sign-ins are logged too.
Retention and deletion
- When QuickBooks is disconnected (from Steward or from inside QuickBooks), Steward’s access is revoked and it stops reading from and writing to that company. Disconnecting from Steward also deletes the stored OAuth tokens straight away.
- Accounting records already copied into Steward are kept as part of the operating group’s books for as long as it needs them for accounting and legal purposes, and are deleted when the operating group requests it.
- A user may ask for their account to be deactivated and their personal data to be removed, subject to keeping the audit log intact.
Contact
Questions or requests about this policy: finance@burninglightsevents.com.