Privacy policy

Evil Genius MindWorks LLC (“Evil Genius,” “we,” “us”) operates the invoicing application at invoicing.evilgenius.io (the “App”). The App is an internal tool. Its only users are the owners and authorized staff of Evil Genius MindWorks LLC, who sign in with a Microsoft work account on an allowlist. There is no public sign-up.

What the App does

The App turns the weekly timecard export from our customers’ vendor portals into invoice lines, tracks purchase order balances, and, when connected, reads from and (in a later phase) creates invoices in our QuickBooks Online company. It exists so that nothing is retyped between the timecard export and the invoice.

Information the App stores

• Sign-in details. The name and email address returned by Microsoft Entra ID for the signed-in user, held in a signed session cookie for up to 12 hours. We do not store passwords.
• Timecard data. Rows from the exports we upload: consultant name, assignment and project names, week dates, hours, rates, approval status, approver and project owner names, and any notes the consultant wrote. These describe work performed by our own staff and subcontractors for our customers.
• Customer and contract data. Customer names, purchase order numbers, rate schedules, change request documents (PDFs) and invoice records.
• QuickBooks Online data. When the App is connected to our QuickBooks company it reads the company name, customers and their billing contact details, service items with prices and costs, invoices and payments. In a later phase it will create invoices. The App keeps a copy of item and customer records and stores the Intuit OAuth tokens encrypted (AES-256-GCM) so it can refresh access without asking again.
• Activity records. Who imported, locked, assembled or changed a record, and when.

How we use it

Only to run our own billing: preparing and reconciling invoices, tracking purchase order balances, forecasting when a purchase order runs out, and keeping our books in QuickBooks accurate. We do not use the data for advertising, profiling or any purpose unrelated to billing, and we do not sell it.

Who else handles it

The App runs on service providers that process data on our behalf under their own terms:

• Vercel (hosting of the App, United States)
• Railway (the PostgreSQL database, United States, encrypted at rest with daily backups)
• Cloudflare R2 (private storage for uploaded PDF documents, served through short-lived signed links)
• Intuit (QuickBooks Online, connected through OAuth 2.0 with the accounting scope; see Intuit’s own privacy policy)
• Microsoft (Entra ID sign-in)
• Anthropic (optional). The purchase orders and change request forms our customers send us are PDFs we receive directly from those customers, outside QuickBooks. When one is uploaded, its text may be sent to the Claude API to read the rate lines out of it, and the result is shown for review before anything is saved. No QuickBooks Online data, and no personal data beyond the names printed on that document, is ever sent to Anthropic.

We do not share data with anyone else except as the law requires.

QuickBooks connection and disconnection

An owner connects the App to QuickBooks from the App’s Settings page by signing in to Intuit. The connection can be ended at any time from the same page, or from the Intuit side. On disconnect the App deletes its stored tokens. Cached item and customer records can be removed on request.

Security

Every connection uses HTTPS. Access requires a Microsoft work account on our allowlist. Secrets and tokens are encrypted at rest and never written to logs. Uploaded documents are private and served only to signed-in users through signed links that expire in minutes.

Retention

Timecard, purchase order and invoice records are business records and are kept for as long as our accounting and tax obligations require, which is at least seven years. Session cookies expire within 12 hours. QuickBooks tokens are deleted on disconnect.

Your rights

If you are a consultant whose hours appear in the App and you want to know what we hold or have something corrected, write to info@evilgenius.io. We will answer within 30 days.

Changes

If this policy changes, the date at the top changes with it. Material changes are told to the people who use the App.

Contact

Evil Genius MindWorks LLC, info@evilgenius.io.