Privacy Policy

Last updated: September 2026

Submitt is an internal time- and expense-reporting application operated by ASAO Consulting ("we", "us"). It is used by our contractors and staff to submit weekly time and expenses and by our accounts-payable team to review, pay, and record them. This policy explains what information the application handles and how.

Information we collect

We collect only what is needed to run time and expense reporting: your name, email address, mailing address, and phone number; the projects you are assigned to; the hours, dates, and work descriptions you enter; expense details (date, vendor, amount, category, and notes); and receipt images or files you upload. Account credentials are stored only as a salted one-way hash — we never store your password in readable form.

How we use it

Information is used to record and review submissions, generate bills and invoices, reimburse expenses, produce internal analytics, and send you transactional email (invitations, password resets, and submission confirmations). We do not sell your information or use it for advertising.

QuickBooks Online

When an administrator connects the application to QuickBooks Online, we use Intuit's authorized OAuth process and store only the resulting access/refresh tokens (encrypted) and your company (realm) identifier, so we can create bills and attach receipts on your behalf. We request only the accounting scope needed for that purpose. Data shared with Intuit is governed by Intuit's own privacy policy. An administrator can disconnect at any time from the application's QuickBooks page, which revokes and deletes the stored tokens.

Service providers

We rely on a small number of processors to operate the application: a cloud host and managed database (application hosting and storage), an email provider (transactional email), optional object storage for receipt files, and — if enabled — an AI provider used solely to read an uploaded receipt image and pre-fill its expense fields. These providers process data only to provide their service to us.

Retention & security

Submissions, expenses, and receipts are retained for as long as needed for accounting, tax, and audit purposes, and are deleted on request subject to those obligations. We take reasonable measures to protect the information we hold: all traffic is encrypted in transit with HTTPS/TLS, data is encrypted at rest, and the QuickBooks access and refresh tokens are additionally encrypted at the application layer. Access is limited by role, multi-factor authentication is required for every account, passwords are stored only as a salted one-way hash, and connecting or disconnecting QuickBooks is restricted to administrators. No system is perfectly secure, but we work to keep your information safe.

Data breach notification

If we become aware of a security incident that affects your personal information, we will notify affected users and, where applicable, Intuit, without undue delay and consistent with applicable law.

Your choices

You may request access to, correction of, or deletion of your personal information, subject to our record-keeping and legal obligations. Contact us using the details below.

Contact

ASAO Consulting
PO Box 211, Myakka City, FL 34251
[email protected]