Privacy Policy

Effective date: October 5, 2026

Last reviewed: October 5, 2026

This Privacy Policy explains how DSD MGMT, LLC ("we," "us," or "our") collects, uses, stores, shares, and protects information in connection with our internal accounting integrations with QuickBooks Online and Plaid (together, the "Integrations"). It applies to this website (https://www.dsdenergy.us/) and to the Integrations described below.

1. About the Integrations and who this policy is for

The Integrations are private, internal software integrations built and operated solely for our own business. They connect to our own QuickBooks Online ("QuickBooks") company files through Intuit's API, and to our own business bank and credit-card accounts through Plaid, in order to support our internal accounting and financial operations. The Integrations are not a public, multi-tenant product offered, sold, or distributed to outside customers or the general public.

Because the Integrations operate only against QuickBooks company files and financial accounts that we own and administer, the individuals whose information may be processed are primarily our own personnel and authorized users, together with the customers, vendors, and other parties that already appear in our accounting records and account statements.

2. Information we collect

a. QuickBooks / Intuit company data (accessed via the Intuit API). When the Integrations are connected to one of our QuickBooks company files, they access accounting and financial data from that company file through Intuit's API. Depending on the operation, this may include:

• Company profile and settings information;
• Chart of accounts and general-ledger data;
• Transactions, journal entries, invoices, bills, payments, and credits;
• Customer records and vendor records (which may include names, business names, contact details, addresses, and related identifiers);
• Reports and other financial and accounting information available through the QuickBooks API.

Intuit is the source of this company data. We access it only from QuickBooks company files that we own and are authorized to administer.

b. Authentication credentials and OAuth tokens. To connect to Intuit's API, the Integrations use the OAuth 2.0 authorization framework. We store and process the OAuth access tokens, refresh tokens, realm (company) identifiers, and related connection metadata that Intuit issues. These tokens allow the Integrations to make authorized API calls on our behalf.

c. Personal data of authorized users. We may process limited personal information about the personnel who set up, authorize, or operate the Integrations — for example, names and email addresses — for administration, access control, and support purposes.

d. Website information. Our website may collect standard technical information (such as IP address and browser type) through routine web-server logging. See Section 8 (Cookies and analytics).

e. Bank and credit-card account data (accessed via Plaid). When we connect our own business bank and credit-card accounts through Plaid Technologies, Inc., the Integrations access account transactions, balances, and periodic statements for those accounts. We connect only accounts that we own and are authorized to administer, and each connection is authorized by us through Plaid Link. Plaid access tokens are stored in Azure Key Vault. We do not use Plaid to initiate payments or transfers.

We do not intentionally collect special categories of sensitive personal data through the Integrations, and we do not use the Integrations to collect information from the general public.

3. How we use information

We use the information described above only for legitimate internal business purposes, including to:

• Operate the connections between our QuickBooks company files, our bank and credit-card accounts, and our internal systems;
• Perform internal financial operations, accounting, bookkeeping, reporting, reconciliation, and analysis;
• Consolidate and review data across our QuickBooks company files;
• Match vendor bills to bank and card payments, prepare credit-card journal entries, and reconcile bank and card accounts;
• Maintain, secure, troubleshoot, and improve the Integrations;
• Comply with applicable legal, tax, audit, and recordkeeping obligations.

We do not use QuickBooks company data or bank and card account data for advertising, and we do not sell it. We do not use the data to build profiles of, or to market to, third parties.

4. How we share information — and what we do not do

We do not sell your information, and we do not share it for others' independent marketing.

We share information only in the limited circumstances below:

• Hosting and infrastructure sub-processor — Microsoft Azure. We host and process data using Microsoft Azure cloud services, including Azure SQL Database (data storage), Azure Blob Storage (file/object storage), and Azure Key Vault (secure storage of secrets, OAuth tokens, and Plaid access tokens). Microsoft acts as our hosting sub-processor and processes the data on our behalf, subject to its own security and privacy commitments.
• Plaid Technologies, Inc. Provides the connection to our financial institutions; subject to Plaid's End User Privacy Policy (https://plaid.com/legal/#end-user-privacy-policy).
• Cloudflare, Inc. Hosts our internal web portal and its database; data encrypted at rest.
• Egnyte, Inc. Stores our accounting documents and statements; data encrypted at rest.
• Intuit. Intuit is the source of the QuickBooks company data and the provider of the API used by the Integrations. Our access to and use of QuickBooks data is subject to Intuit's own terms and privacy practices.
• Professional advisors. We may share information with our accountants, auditors, and legal advisors as reasonably necessary for the internal business purposes described in this policy.
• Legal and compliance. We may disclose information where required by law, regulation, legal process, or governmental request, or to protect our rights, property, or safety, or those of others.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to appropriate confidentiality protections.

5. Data storage and security

We take reasonable measures to protect information against unauthorized access, disclosure, alteration, and destruction. Our practices include:

• Encryption in transit. Connections to Intuit's and Plaid's APIs and to our cloud services use industry-standard encryption (TLS/HTTPS).
• Encryption at rest. Data stored in Microsoft Azure services is encrypted at rest using Azure's platform encryption; data stored with Cloudflare and Egnyte is encrypted at rest by those providers.
• Secret and token protection. OAuth tokens, Plaid access tokens, and other secrets are stored in Azure Key Vault rather than in application source code or general-purpose storage.
• Access controls. Access to the Integrations, their data, and its stored credentials is restricted to authorized personnel on a need-to-know basis and is protected by authentication controls.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We describe our practices honestly and do not claim any specific third-party security certification that we have not obtained.

6. Data retention and disposal

Retention schedule.

• Financial records (transactions, statements, bills, journal entries, and supporting documents) are kept 7 years after the end of the tax year they relate to, to meet tax, audit, and recordkeeping obligations, and are then deleted.
• OAuth and Plaid access tokens are kept only while a connection is in use, and are revoked and deleted within 30 days after an account is closed or no longer needed.
• Authorized-user records are kept while the person has access, plus 1 year.
• Website server logs are kept no longer than 90 days.

Disposal. Data past its retention period is deleted from our Microsoft Azure, Cloudflare, and Egnyte storage, including soft-deleted copies once their 30-day recovery window ends. Revoking a connection in QuickBooks / Intuit or through Plaid stops all further access.

Disconnecting the QuickBooks and Plaid connections. Because the Integrations are administered by us, we can disconnect any QuickBooks company file or Plaid-connected account and revoke its authorization at any time. Disconnection can be performed from within the QuickBooks / Intuit account settings (by removing the app's authorization) or through Plaid, and/or from our side by revoking the stored OAuth or Plaid access tokens. When a connection is disconnected, the Integrations can no longer access that company file's or account's data.

Deletion requests. To request deletion of data processed by the Integrations, contact us using the information in Section 9. Upon a valid request, and subject to our legal and recordkeeping obligations, we will delete the relevant stored data (including stored OAuth and Plaid access tokens) within a reasonable period.

Review. This policy and the retention schedule are reviewed at least annually and whenever a new integration is added. The "Last reviewed" date above is updated at each review.

7. Your rights and choices

Depending on your relationship to us and applicable law, you may have rights to request access to, correction of, or deletion of personal information we hold about you, and to object to or restrict certain processing. To exercise any such right, contact us using the details in Section 9. We will respond consistent with applicable law. We will not discriminate against you for exercising these rights.

8. Cookies and analytics

This website may use a limited number of strictly necessary cookies and standard web-server logs required to operate and secure the site. The Integrations themselves are internal, back-end integrations and are not public-facing web applications that serve marketing cookies or third-party advertising trackers to the general public. If we adopt analytics or non-essential cookies in the future, we will update this policy and, where required, provide appropriate notice or choices.

9. How to contact us

For privacy questions, requests, or to exercise your rights, contact:

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" above and post the updated policy at this URL. Material changes may be communicated through additional notice where appropriate. Your continued use of, or connection to, the Integrations after an update takes effect constitutes acceptance of the revised policy.

11. Governing law

This Privacy Policy and any dispute arising out of or relating to it are governed by the laws of the State of Texas, USA, without regard to its conflict-of-laws principles.