Novum Partners
Privacy Policy
Effective 18 September 2026
This policy explains what Novum Insights collects, why, and who can see it. The application is operated by Novum Partners of San Antonio, Texas (“Novum”, “we”) for organisations it serves under a written engagement. It is not a consumer product and is not offered to the public.
1. What we collect
Account information. When you sign in with Google, we receive your email address, your display name, and whether Google has verified the address. We use the address to check the organisation’s access list and to record who did what. We do not receive your Google password and we request no other Google data.
Financial records from QuickBooks Online. When a person with the appropriate role connects the organisation’s QuickBooks company, we read the general ledger, chart of accounts, classes, customers and vendors, and standard reports such as the balance sheet, profit and loss, and transaction lists. The connection is read only. We store a frozen copy of each report we pull, with the date and parameters of the request, so that every published figure can be traced to the data that produced it.
Grant documents from Box. When the organisation shares a folder with Novum’s service account, we read the grant register spreadsheet and the award letters and policies in that folder. The service account has view access to that folder only.
Configuration you enter. The organisation’s name and fiscal year, the list of restricted and board-designated cash accounts confirmed in writing, approved grant register rows, and the names, roles, and email addresses of the people invited to use the application.
Activity records. An audit log of sign-ins, approvals, issued packages, connection changes, and settings changes, with the acting user’s email and a timestamp. Standard server logs record request errors. Values from financial records are never written to logs.
Cookies. A signed session cookie identifying your login, a cookie recording which client you are viewing if you have access to more than one, and short-lived cookies that protect the sign-in and QuickBooks connection flows from forgery. We set no advertising or analytics cookies.
2. How we use it
We use the data above solely to operate the application and to deliver the advisory services in Novum’s engagement with the organisation: computing restricted grant balances, the board financial panel, the revenue availability bridge, deadlines, exceptions, and recommendations drawn from named published practices; controlling who may see what; and answering the question of who published a figure and when.
We do not sell personal information or financial data. We do not use it for advertising, and we do not share it with data brokers. We do not use it to train machine-learning models.
3. Google user data
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use the email address and name from Google sign-in only to authenticate you and attribute your actions inside the application. We do not transfer this data to anyone except as needed to provide the application, to comply with law, or as part of a merger or acquisition with notice to you, and we never use it for advertising.
4. Intuit and QuickBooks data
Access to QuickBooks Online is granted by the organisation through Intuit’s authorisation flow using the accounting scope only. The tokens Intuit issues are stored encrypted and are used only to read the connected company. The organisation can disconnect at any time from the application’s Settings page or from Intuit’s connected-apps page, after which no further data is read. Data already stored is retained under section 7.
5. Who can see it
Within the organisation. Access is role based. Board members see issued packages only. Program staff see only the grants assigned to them. Finance staff see the full ledger view for their organisation. No one sees another organisation’s data.
Within Novum. Named Novum staff assigned to the engagement, and Novum administrators, for the purpose of delivering the service and issuing packages.
Service providers. We host the application on Vercel and the database on Neon, both in the United States, under their standard security terms. Google provides sign-in. Intuit and Box provide the data connections at the organisation’s direction. Each acts only on our instructions or the organisation’s.
Legal requirements. We may disclose data where required by law, subpoena, or court order, and will notify the organisation where permitted.
6. How we protect it
Data is encrypted in transit and at rest. Connection tokens are additionally encrypted at the application layer. Access requires Google sign-in and a place on the access list. Every read from QuickBooks and Box is read only by design, and the application holds no write permission to either system. Actions that publish a figure are logged with the acting user and time.
7. How long we keep it
Frozen report copies and issued packages are kept for the life of the engagement and for as long afterwards as the organisation needs them to support audits and funder reporting, because a board figure must remain reproducible. Account records are kept while you have access and in the audit log thereafter. On written request from the organisation after an engagement ends, we delete its data, except where retention is required by law or by the organisation’s own audit obligations.
8. Your choices
You can ask what personal information we hold about you, ask us to correct it, or ask us to remove your access, by writing to the address below. The organisation can disconnect QuickBooks or Box at any time. Because the application is provided to organisations rather than to individuals, some requests are routed to the organisation that invited you.
9. Children
The application is for professional use by adults and is not directed to children under 13.
10. Changes to this policy
We may update this policy by posting a new version at this address with a new effective date. Material changes are notified to the organisation’s primary contact.
11. Contact
Novum Partners, San Antonio, Texas. Email brad@novumsp.com.