PARTMASH(TM) PRIVACY POLICY

The EFI Store · Horsepower Connections LLC

Last updated: August 23, 2026 | Effective Date: ______________

This Privacy Policy explains how Horsepower Connections LLC, an Arizona limited liability company doing business as The EFI Store ("Company," "we," "us"), collects, uses, and shares information in connection with PartMash (the "Service").

1. Information We Collect

Account information: name, business name, email address, and login credentials you provide when you register.

Payment information: billing details processed by our third-party payment processor. We do not store full payment card numbers.

Connected Account credentials and tokens: when you connect QuickBooks Online, Shopify, or a supplier API, we store the access and refresh tokens issued by that provider. We do not receive or store your password for those services.

Subscriber Data: product records, part numbers, descriptions, prices, costs, inventory levels, catalog structure, and related accounting records retrieved from your Connected Accounts on your instruction, or uploaded by you as files.

Usage and technical data: log data, device and browser type, IP address, pages viewed, features used, and timestamps.

Cookies and similar technologies: used to keep you signed in, remember preferences, and measure and improve the Service.

2. How We Use Information

We use the information we collect to:

• provide, operate, maintain, and secure the Service;
• retrieve, compare, and reconcile product and pricing data across your Connected Accounts;
• generate reports and proposed changes for your review;
• apply changes to your Connected Accounts when and as you direct;
• process Subscriptions, billing, and renewals, and communicate about your account;
• provide customer support and respond to your requests;
• monitor usage, prevent fraud and abuse, and enforce our terms;
• improve and develop the Service; and
• comply with legal obligations and protect our legal rights.

3. What We Do NOT Do

• We do not sell your personal information or your business data.
• We do not use one customer's data to serve another customer. Your cost, pricing, and catalog data is not pooled, aggregated across customers, or used to benchmark other subscribers.
• We do not use your accounting data for advertising or marketing.
• We do not use your data to train machine learning models offered to other parties.

4. Legal Bases for Processing

Where required by law (for example, for users in the European Economic Area or the United Kingdom), we process personal information on the bases of contract performance, legitimate interests, consent, and compliance with legal obligations.

5. Intuit QuickBooks Online Data

This section governs data accessed through your QuickBooks Online connection.

What we access. With your authorization, the Service reads product and service items, item pricing and cost, item categories, and related catalog records from your QuickBooks Online company. Where you direct, the Service may also write changes to those records — for example creating, renaming, repricing, or deactivating an item.

Why we access it. Solely to provide the Service to you: to compare your catalog against your supplier data, to present differences for your review, and to apply changes you approve.

We access only what the Service needs. We request the narrowest QuickBooks scopes required to perform these functions.

We do not:

• sell, rent, or trade QuickBooks data;
• use QuickBooks data for advertising, marketing, or profiling;
• disclose QuickBooks data to any third party except the service providers listed in Section 6, and only as needed to operate the Service;
• combine one customer's QuickBooks data with another customer's data.

Disconnection. You may disconnect QuickBooks at any time, from within the Service or from within Intuit's own app management page. On disconnection we immediately cease all further access and revoke the stored tokens.

Deletion on disconnection. Following disconnection or account termination, we delete Subscriber Data derived from your QuickBooks company from our live systems within thirty (30) days, except where retention is required by law or for legitimate accounting, tax, or dispute-resolution purposes.

Backups. Residual copies may persist in encrypted backups until they age out of our backup rotation. Backups are retained no longer than thirty (30) days. Because a backup taken shortly before deletion still contains your data, all copies — live and backup — are removed within sixty (60) days of disconnection or termination.

Change history while your account is active. The Service keeps a record of every change it makes to your Connected Accounts — the prior value, the new value, and when — so that changes can be reviewed and reverted. These records are retained for twelve (12) months and then automatically purged.

Token security. OAuth access and refresh tokens are stored encrypted at rest and are used only to perform the functions described above.

6. How We Share Information

We do not sell your information. We share it only as follows:

Service providers: hosting, database, payment processing, error monitoring, and analytics vendors who process data on our behalf under contractual confidentiality and security obligations, and who may not use it for their own purposes.

Connected Account providers: we transmit data to Intuit, Shopify, or a supplier system only to perform actions you have directed.

Legal: where required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Company, our customers, or the public.

Business transfer: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to apply to the transferred information.

7. Data Security

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect information, including encryption of credentials and tokens at rest, encryption in transit, access controls, and logical separation of each customer's data.

8. Data Retention

We retain Account information for as long as your account is active and thereafter as needed for legal, accounting, and dispute-resolution purposes.

We retain Subscriber Data for as long as needed to provide the Service, and delete it after disconnection or termination as described in Section 5.

9. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict processing, and to withdraw consent. California residents may have rights under the CCPA/CPRA, including the right to know, delete, correct, and to not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law.

To exercise any right, contact us using Section 13. We may need to verify your identity before acting.

10. International Transfers

The Service is operated in the United States. If you access it from outside the United States, you understand your information will be processed in the United States, which may have different data protection laws than your jurisdiction.

11. Children

The Service is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 18.

12. Changes to this Policy

We may update this Policy. Material changes will be notified by email or in-product notice before taking effect. The "Last updated" date above reflects the most recent revision.

13. Contact

Horsepower Connections LLC d/b/a The EFI Store

55 Lake Havasu Avenue F392, Lake Havasu City, AZ 86403

horsepowerconnection@gmail.com