1. Who we are and what this policy covers
RF Marketing and Associates, LLC ("RF Marketing," "we," "us," or "our") is a digital marketing agency located at 785 East 200 South, Suite 14, Lehi, Utah 84043. We operate the website rfads.com (the "Site"), our client reporting and portal tools, and our integrations with third-party platforms, including the QuickBooks® Online integration described in Section 4 (together, the "Services").
This Privacy Policy explains what information we collect, how we use it, how we protect it, how long we keep it, and the choices you have. It applies to visitors of the Site, to our clients and their authorized users, and to anyone who connects a QuickBooks Online company to our Services.
If you do not agree with this policy, please do not use the Site or connect any third-party account to our Services.
2. Information we collect
Information you give us
- Contact and inquiry details. When you submit a form on the Site or email us, we collect your name, company, email address, phone number, industry, and the message you send.
- Account and client information. If you become a client, we collect the business details needed to deliver services: business name, addresses, billing contacts, website and advertising account identifiers, and the credentials or access you choose to share with us so we can manage campaigns on your behalf.
Information collected automatically
- Usage and device data. IP address, browser type, device type, pages viewed, referring URL, and approximate location derived from your IP address. This is collected through standard server logs, Cloudflare, and analytics tools such as Google Analytics 4 and Google Tag Manager.
- Cookies and similar technologies. See Section 8.
Information from connected third-party platforms
When you authorize a connection between our Services and a third-party platform (for example Google Ads, Google Analytics, a call-tracking provider, a CRM, or QuickBooks Online), we receive the data that platform makes available through its authorized API, limited to the permissions you grant. QuickBooks data is described in detail in Section 4.
3. How we use information
We use the information we collect to:
- respond to inquiries and provide proposals, audits, and quotes;
- deliver, operate, maintain, and improve the Services, including campaign management, call tracking, landing pages, CRM automation, and performance reporting;
- reconcile advertising spend and results against invoices, payments, and revenue so our reports reflect real business outcomes;
- bill for our services and maintain accounting records;
- secure the Services, detect fraud or abuse, and enforce our Terms of Service;
- communicate with you about your account, service updates, and legal notices; and
- comply with applicable law.
We do not sell personal information, and we do not use information obtained from connected platforms (including QuickBooks Online) to build advertising profiles, to train machine-learning models, or for any purpose other than providing the Services to the account owner who authorized the connection.
4. QuickBooks Online data: how we access, use, and protect it
4.1 How the connection works
Our Services can connect to QuickBooks Online through Intuit's official QuickBooks Online API using OAuth 2.0. You, as the QuickBooks company administrator, decide whether to connect. During authorization you are redirected to Intuit, you sign in to Intuit directly, and you approve the specific permissions requested. We never see, ask for, or store your Intuit username or password. Intuit issues us access and refresh tokens that represent only the permission you granted.
4.2 What QuickBooks data we access
We request only the scope needed for the features you use. Depending on those features, this may include:
| Data type | Why we use it |
|---|---|
| Company information (company name, address, fiscal settings) | To identify the connected company and format reports correctly. |
| Customers and jobs | To match leads and signed clients from your CRM and call tracking to revenue, so we can report cost per signed case or booked job. |
| Invoices, sales receipts, payments, and estimates | To calculate return on ad spend and revenue attribution, and to reconcile our own invoices to you. |
| Items, products, and services | To categorize revenue by service line in reports. |
| Vendors, bills, and expenses (if authorized) | To include advertising and software costs in profitability reporting. |
| Reports (profit & loss, sales by customer) | To produce consolidated performance dashboards. |
We do not access payroll data, bank account or routing numbers, full credit card numbers, Social Security numbers, or tax identification numbers through the QuickBooks integration. If a feature requires write access (for example, creating an invoice or customer record on your behalf), we will ask for that permission separately and describe it before you approve it.
4.3 How we use QuickBooks data
- Reporting and attribution. Combining revenue with advertising, call-tracking, and CRM data so you can see which marketing dollars produced real revenue.
- Reconciliation and billing. Matching our invoices to your payment records and verifying spend.
- Client portal display. Showing you your own figures inside dashboards and reports we build for you.
QuickBooks data is used only for the QuickBooks company that authorized it. It is never combined across clients, disclosed to other clients, sold, rented, or used for advertising, benchmarking against third parties, or model training.
4.4 How we protect QuickBooks data
- OAuth 2.0 only. Access is granted through Intuit's authorization flow. We never store Intuit login credentials.
- Token security. OAuth access and refresh tokens are stored encrypted at rest using industry-standard encryption (AES-256) on infrastructure operated by Cloudflare, Inc., and are never written to logs, browser storage, or client-side code. Our Intuit client ID and client secret are stored as protected environment secrets, not in source code.
- Encryption in transit. All data moves over TLS 1.2 or higher between you, our Services, and Intuit.
- Least privilege. We request the narrowest API scope that supports the features you use, and access within our team is restricted to personnel who need it to deliver your services, each with individual accounts and multi-factor authentication.
- Monitoring. API access is logged and reviewed; unusual activity triggers review and, where appropriate, token revocation.
- Data minimization. Where possible we query QuickBooks on demand rather than copying your ledger. Where data is cached for reporting, it is limited to the fields in the table above.
- Incident response. If we become aware of a security incident affecting your QuickBooks data, we will notify you without undue delay and, where required, notify Intuit and regulators.
4.5 Retention and deletion of QuickBooks data
- OAuth tokens are retained only while the connection is active.
- Cached QuickBooks data used for reporting is retained while you are an active client and for up to 30 days after disconnection or termination, then deleted. Aggregated figures that no longer identify individual QuickBooks records (for example, a monthly revenue total in a historical report) may be retained as part of your service history.
- You may request earlier deletion at any time by emailing info@rfmarketing.org. We will confirm deletion within 30 days.
4.6 Disconnecting QuickBooks
You can revoke our access at any time, with immediate effect, in either of two ways:
- In QuickBooks Online, go to Apps → My Apps and disconnect RF Marketing; or
- Email info@rfmarketing.org or use the disconnect option in your client portal.
When you disconnect, we revoke and delete the tokens and stop all API access. Cached data is deleted on the schedule in Section 4.5. Disconnecting does not delete anything inside your QuickBooks company.
4.7 Intuit's role
Intuit Inc. operates QuickBooks Online and is an independent controller of the data you keep there. Intuit's own terms and privacy policy govern your use of QuickBooks. RF Marketing is not affiliated with, endorsed by, or acting on behalf of Intuit. QuickBooks and Intuit are trademarks of Intuit Inc., used under Intuit's developer and trademark guidelines.
5. How we share information
We share information only in the following circumstances:
- Service providers that process data on our behalf under written obligations of confidentiality and security, limited to what they need to perform their function. Our current categories of providers are: hosting and security (Cloudflare), email and document storage (Google Workspace), analytics and tag management (Google), advertising platforms you authorize (Google Ads), call tracking (CallRail or CallTrackingMetrics), CRM and workflow tools (monday.com, Zapier, Calendly, Filevine), and reporting connectors (Looker Studio, Windsor.ai).
- Platforms you connect. When you authorize a connection, data flows between that platform and our Services as needed to provide the feature you enabled.
- Legal requirements. When required by law, subpoena, or legal process, or to protect the rights, property, or safety of RF Marketing, our clients, or others.
- Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy.
- With your direction or consent.
We do not share QuickBooks data with advertising platforms, data brokers, or any third party for that party's own purposes.
6. Data security
We protect all information with administrative, technical, and physical safeguards appropriate to its sensitivity, including encryption in transit (TLS 1.2+) and at rest, multi-factor authentication on internal accounts, role-based access, logging, and hosting on Cloudflare's global edge network with DDoS protection and a web application firewall. No method of transmission or storage is completely secure; if you believe your account or data has been compromised, contact us immediately at info@rfmarketing.org.
7. Data retention
- Inquiries and leads: up to 24 months from your last contact with us, unless you become a client.
- Client records: for the duration of the engagement and for 7 years afterward to satisfy accounting, tax, and legal obligations.
- Connected platform data, including QuickBooks data: as described in Section 4.5.
- Server and security logs: up to 12 months.
You may ask us to delete information sooner; see Section 9.
8. Cookies and analytics
The Site uses cookies and similar technologies for essential operation (security, load balancing), analytics (Google Analytics 4, loaded through Google Tag Manager), and, where you have been referred by one of our advertisements, conversion measurement (Google Ads). You can control cookies through your browser settings, and you can opt out of Google Analytics with the Google Analytics opt-out add-on. The Site does not respond to "Do Not Track" signals but does honor Global Privacy Control signals where required by law.
9. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to restrict or object to certain processing, and to opt out of the sale or sharing of personal information or targeted advertising. We do not sell personal information. Residents of Utah (Utah Consumer Privacy Act), California (CCPA/CPRA), and other U.S. states with consumer privacy laws, and residents of the EEA and UK (GDPR), may exercise these rights by emailing info@rfmarketing.org with the subject line "Privacy Request." We will verify your identity and respond within the time required by law. You will not be discriminated against for exercising your rights.
If you are a user of one of our clients (for example, a customer of a law firm or home-service company we work with), we process your information on that client's behalf. Please direct requests to that business; we will assist them in responding.
10. Children
The Site and Services are intended for businesses and are not directed to children under 13 (or under 16 where applicable). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
11. International transfers
We are located in the United States and process information here. If you access the Services from outside the U.S., you understand your information will be transferred to and processed in the U.S., where privacy laws may differ from your home jurisdiction.
12. Changes to this policy
We may update this policy from time to time. Material changes will be announced on the Site and, for clients and connected QuickBooks users, by email at least 14 days before they take effect. The "Last updated" date at the top shows the current version.
13. Contact us
Questions, requests, or concerns about privacy, including anything related to QuickBooks data:
RF Marketing and Associates, LLC
785 East 200 South, Suite 14, Lehi, Utah 84043
Email: info@rfmarketing.org