Legal

Privacy Policy

Last updated: 2026-01-01. If you have questions about this policy, please contact support.

What this product is

Cutovr (the “Service”) is a workflow tool that helps law-firm operators move financial data from legacy legal accounting and case-management systems into Clio Accounting. Where a firm chooses QuickBooks Online instead, the Service can also prepare and post supported accounting data to the firm's connected QuickBooks Online company via Intuit's official OAuth 2.0 API.

What we collect

• Account data — firm name, your work email, and a hashed password used to sign you in.
• Uploaded migration files — the legacy-system reports, ledgers, balances, and supporting files you upload. Files are encrypted at rest with AES-256 immediately after upload; the unencrypted copy is removed.
• QuickBooks Online OAuth tokens — for QuickBooks Online migrations only, the access and refresh tokens Intuit issues when you click “Connect to QuickBooks.” Tokens are encrypted at rest and used only to call Intuit's API on your behalf to read the chart of accounts and create JournalEntry records you initiate.
• Operational metadata — job IDs, file SHA-256 hashes, import counts, error messages, and a per-firm audit log of in-app actions (sign-in, upload, connect, import, reverse, etc.).

What we do not do

• We do not sell your data, your firm's data, or your clients' data.
• We do not share your accounting data with advertisers or analytics brokers.
• We do not use your uploaded ledgers to train machine-learning models.
• Where QuickBooks Online is selected, we do not access your QuickBooks company beyond what is needed to fulfill the import you trigger (read accounts, create JournalEntry records, look up customers/vendors).

How we secure data

• Uploaded files are encrypted at rest with AES-256.
• QuickBooks OAuth tokens, where used, are encrypted at rest with the same scheme.
• Sessions are HTTP-only and (in production) HTTPS-only cookies. CSRF protection is enforced on every state-changing request.
• The application validates required production environment variables on startup and fails fast if any are missing or malformed.

Retention

Encrypted source files, encrypted output files, and OAuth tokens where used are kept while the corresponding migration job exists in your firm workspace, and are deleted when you delete the job or your workspace. We retain the operational audit log so you can investigate prior imports and reversals.

Your rights

You can delete any individual job from the Service at any time, which deletes its encrypted files and revokes stored QuickBooks tokens where applicable. You can also disconnect a QuickBooks company directly from inside QuickBooks Online → Apps. To delete your firm workspace entirely, contact support.

Sub-processors

The Service runs on Render (hosting), may use Intuit's QuickBooks Online API when QuickBooks Online is selected as the destination, and may use a transactional email provider for support correspondence. No other sub-processor receives uploaded migration files or QuickBooks tokens.

Contact

For privacy questions or data-deletion requests, email privacy@cutovr.com or see the support page.