Privacy policy

1. Who handles your information

Vision P2P supports procurement operations through TELAHIM & Associates Ltd in Rwanda. The client organisation determines staff access and the purposes of its procurement records. TELAHIM’s role, legal contact details and processing arrangements with the client must be confirmed in the final policy and service agreement.

2. Information processed

The service processes staff names, email addresses or phone numbers, departments, assigned roles, approval authority and access-review records; requisition lines, purposes, work sites, equipment or job references; decisions, timestamps, collection details and signatures; and uploaded supplier quotes.

When QuickBooks is connected, it also processes the company identifier, suppliers, items and stock levels, accounts, tax codes, classes, locations, currencies, exchange rates, budgets and related transaction references or status. Server-held OAuth tokens allow the authorised connection without storing your Intuit password.

3. Why information is used

Information is used to authenticate staff, apply permissions and approval limits, operate purchase and store workflows, synchronise authorised QuickBooks records, reconcile postings, produce reports and preserve an audit trail. The client and operator must confirm the applicable lawful grounds for this processing under relevant privacy law; no blanket consent is assumed by this draft.

4. Service providers and sharing

Lovable Cloud provides hosting, authentication and protected record storage. Intuit receives authorised QuickBooks requests and transaction data. Google or Microsoft handles sign-in when chosen. If phone sign-in is enabled, the configured SMS provider processes the phone number and code delivery. Authorised staff can see records permitted by their roles.

The operator must confirm its provider list, hosting locations, international transfers and any required safeguards before finalising this policy. This draft does not claim that records are hosted in Rwanda or that SMS delivery is already configured.

5. Security and device storage

Access is restricted by staff permissions, with authenticator verification for privileged roles. Quotes are held in private storage with time-limited authorised downloads. QuickBooks credentials remain server-side. Sessions and user-specific offline request drafts use device storage; shared-device sign-out clears app-managed drafts and inactive sessions are signed out after five minutes. Downloaded files must be protected separately by the user.

Operational logs may capture error and request information for troubleshooting. No security measure eliminates all risk.

6. Retention and disconnection

Disconnecting QuickBooks removes the app’s active tokens and company connection; it does not delete requisitions, audit history, imported reference lists or transactions already in QuickBooks. Record retention periods, backup handling and deletion procedures must be confirmed by the operator and client according to contractual and legal requirements. No fixed retention period is promised by this draft.

7. Your requests and concerns

To request access, correction or deletion, or raise a privacy concern, contact your organisation’s administrator and existing TELAHIM representative. Requests are subject to identity verification and applicable record-retention requirements. The final policy must provide a direct privacy contact and the appropriate complaint process under applicable Rwanda data protection law.

8. Finalisation and updates

This is a review draft, not confirmation of regulatory compliance. The operator must approve its factual details and notify users of material changes before the final policy takes effect.