Privacy Policy

Last updated August 27, 2026

Samson Advisory (“we”, “us”, or “our”) respects your privacy. This Privacy Policy explains what information we collect, why we collect it, how we protect it, and the limited circumstances under which we would ever share it. It applies to two distinct experiences: our marketing website at samsonadvisory.com (the “Site”) and the Awali Technology application we operate for our engaged clients (the “Application”).

1. Information We Collect on the Website

Our website is intentionally lightweight. When you submit a contact form, a customer support request, an access request, or a whistleblower report, we collect only the information you provide in that form — typically your name, email address, phone number (if you supply one), your company or role, and the message you’ve written.

We also receive standard technical information that any website receives: your IP address, browser type, referring page, and pages viewed. We use Google Analytics to understand aggregate site traffic (e.g., which pages are most useful). Analytics data is not used to identify individual visitors or combined with any information you submit through our forms.

How we use website information. Information you submit through a website form is used solely to respond to and follow up on the request you made. We do not sell it, rent it, or add it to marketing lists. We do not use it to profile you for advertising. We do not share it with third parties for their marketing.

2. Information We Collect in the Awali Application

The Awali Application is provided to clients under a Master Services Agreement and one or more Statements of Work. In the course of a client engagement, the Application collects information in three categories, each tied to a specific operational purpose:

• User account information — name, work email address, role, and authentication credentials for the individuals your organization designates to use the platform. This is used to create and administer user accounts and to control access.
• Subject matter expert identification — names, roles, functional areas, and points of contact for the people inside your organization who own or operate the processes we are mapping. This is used to route interviews, questions, and process reviews to the right people.
• Process mapping content — the descriptions, artifacts, workflows, screenshots, exports, and supporting materials that document how work gets done at your organization. This is used to build the operational map, workshop process changes, and design the automations that are the deliverable of the engagement.

We collect only what is necessary to deliver the scope described in the Statement of Work. We do not collect information from the Application for any purpose outside that engagement.

3. QuickBooks Online Data (Intuit)

The Awali Application connects to a client’s QuickBooks Online (“QBO”) company on a project-by-project basis only. A connection is established solely for an active, contracted engagement, and everything we do through it is governed by the applicable Statement of Work or Project Plan. We do not connect to a QBO company that has not been expressly authorized by the client that owns it.

Awali functions as an integration bridge. Many of the business applications our clients already rely on do not communicate with QuickBooks Online directly; Awali sits between them and moves accounting data in both directions on the client’s behalf. This means Awali both reads records from and writes records to the client’s QBO company — in every case only as the client has configured and authorized, and only to accomplish the work described in the Statement of Work or Project Plan.

Use of the QuickBooks Online integration is also governed by the QuickBooks Online Integration End User License Agreement, which is licensed in conjunction with the client’s Master Services Agreement.

How the connection is authorized

All connections are made through Intuit’s official OAuth 2.0 authorization flow. An authorized administrator of the client’s QuickBooks Online account must explicitly grant access, and the scope of that access is limited to what the engagement requires. Samson Advisory never asks for, receives, or stores QuickBooks Online usernames, passwords, or any other Intuit login credentials. The OAuth access and refresh tokens issued to us are stored encrypted, are never transmitted to any third party, and are used only by the Awali Application to service that specific engagement.

What we read, what we write, and why

Reading. Through an authorized connection, Awali may read accounting records from the client’s QBO company — for example the chart of accounts, customers and vendors, items, invoices, bills, payments, journal entries, and standard financial reports — limited to the permissions the client grants and to the data the integration actually requires.

Writing. Because Awali acts as a bridge, it also creates and updates records in the client’s QBO company on the client’s behalf — for example invoices, bills, payments, customers, vendors, items, and journal entries — built from data originating in the other applications the client has connected. Every write is performed according to the field mappings, sync rules, and approval steps the client configures. Awali does not create, modify, or delete records outside the scope the client has configured and the Statement of Work or Project Plan describes, and it does not act on a client’s QBO company on its own initiative or for its own purposes.

QuickBooks Online data is used exclusively to:

• Operate the integrations the client has configured — synchronizing records between QuickBooks Online and the other applications the client has authorized;
• Perform the analysis, process mapping, reconciliation, reporting, or automation work described in the Statement of Work or Project Plan;
• Produce the deliverables the client has engaged us to produce; and
• Monitor, support, and troubleshoot the connection and the syncs running across it.

We do not access, extract, write, or retain QuickBooks Online data for any purpose outside the authorized engagement.

Moving data between QuickBooks Online and client-authorized systems

Delivering an integration necessarily means data moves in two directions: QBO data may be transmitted out to another application, and data from that application may be written into the client’s QBO company. Both directions operate under the same rule:

• QuickBooks Online data is transmitted only to the systems the client has expressly designated as endpoints of that integration.
• Data is written into QuickBooks Online only from the systems the client has expressly designated as sources for that integration.

In both directions, Samson Advisory acts solely as the client’s agent, at the client’s direction and on the client’s own behalf. The applications on either end of an integration are chosen and authorized by the client, not by us. We do not transmit QuickBooks Online data to any system the client has not designated, and we do not disclose it to any party for that party’s own purposes. Where an integration endpoint is operated by a vendor rather than by the client, that vendor receives the data as the client’s counterparty under the client’s own agreement with it — we do not grant any such vendor rights to the data, and we receive no consideration of any kind for the transfer.

What we never do with QuickBooks Online data

• We never sell, rent, license, trade, or otherwise monetize QBO data, in any form, to anyone.
• We never disclose it to any third party for that party’s own purposes. The only transfers we make are the client-directed integration transfers described immediately above, and the two further exceptions set out in Section 6 — vetted service providers acting under our instruction and bound by written confidentiality and data-protection obligations at least as strict as those in this Policy, and disclosures required by law. In the case of a legally compelled disclosure, we will notify the affected client to the extent legally permitted so the client can respond.
• We never use it for advertising, marketing, lead generation, credit decisioning, benchmarking, or resale in any form, aggregated, anonymized, or otherwise.
• We never use it to train general-purpose or third-party artificial intelligence or machine-learning models.
• We never commingle one client’s QBO data with another client’s data, and we never use one client’s data to serve another client.
• We never make it available to any Samson Advisory employee or contractor who is not an authorized member of that specific project team.

How QuickBooks Online data is secured

• Encrypted database. All QBO data and all OAuth tokens are stored in an encrypted database, encrypted at rest using industry-standard AES-256 encryption.
• Encrypted in transit. All traffic between Awali and Intuit’s APIs, between Awali and the client’s other connected applications, and between Awali and its users, is protected with TLS 1.2 or higher.
• Multi-factor authentication is required. Every account with access to QBO data — including all Samson Advisory personnel and all administrative accounts — must authenticate using multi-factor authentication.
• Authorized project team members only. Access is granted through role-based access controls and restricted to the named Samson Advisory team members assigned to that specific engagement, on a least-privilege, need-to-know basis.
• Every write is audited. Each record Awali creates or updates in a client’s QBO company is logged with the originating record, the acting user or automation, and a timestamp, so the client can trace any change back to its source.
• Read access is logged. Access to client accounting data is logged and monitored.
• Access ends when the project does. Team-member access is reviewed periodically and is revoked promptly on project completion or personnel change.

Client control, disconnecting, retention, and deletion

The client controls which integrations run, which records they touch, and in which direction. A client may pause an integration or revoke our access entirely at any time and without notice to us — either from within the Awali Application or directly in QuickBooks Online under Settings → Manage Apps → Disconnect. Revoking the connection immediately invalidates our OAuth tokens and stops all further reading from and writing to the QBO company. Records already written into the client’s QuickBooks Online company remain there, in the client’s possession and under the client’s control.

QuickBooks Online data is retained only for the term of the engagement and any period expressly required by the Statement of Work. On completion of the engagement, or on the client’s written request at any time, we will delete or return the QBO data we hold and will complete deletion within 30 days of the request, except where retention is required by law or by the applicable Statement of Work.

Incidents and compliance

If we become aware of a security incident affecting a client’s QuickBooks Online data, we will notify the affected client without undue delay and will notify Intuit where required. Our use of the Intuit developer platform is governed by, and we comply with, the Intuit Developer Terms of Service, the Intuit Platform Agreement, and Intuit’s API usage and security requirements. Questions specific to our QuickBooks Online integration may be directed to the contact in Section 12.

4. Protected Health Information (PHI)

When we are engaged by a HIPAA-regulated client (a “Covered Entity” or an existing Business Associate) and the engagement requires access to Protected Health Information, that access is governed by a signed Business Associate Agreement (“BAA”) between Samson Advisory and the client.

In every such engagement:

• PHI is used only for the specific purposes stated in the applicable Statement of Work.
• Access is limited to Samson Advisory personnel who have a documented need to perform the engagement, and each person is trained on HIPAA obligations.
• PHI is not commingled with data from any other client or used for any Samson Advisory internal purpose.
• The terms of the BAA control in the event of any conflict with this Privacy Policy.

If you believe an incident involving PHI has occurred, contact us immediately using the details in Section 12.

5. How We Store and Secure Data

All data we collect — whether from the website or the Awali Application — is stored in an encrypted-at-rest format. Data in transit between your browser or device and our systems is protected by industry-standard TLS encryption.

Additional safeguards we apply include:

• Role-based access controls, so users and staff can see only the records their role requires.
• Multi-factor authentication for administrative access.
• Logging and monitoring of access to client data.
• Regular backups, with backups encrypted using the same standards as production data.
• Physical and network security controls provided by our vetted cloud infrastructure providers.

No security program can promise perfect security, but we design ours to meet the expectations of the regulated industries and clients we serve.

6. No Third-Party Sharing Without Client Authorization

We do not sell, rent, license, or otherwise disclose client data to any third party for any purpose — ever — unless the client has specifically and expressly authorized that disclosure. This is the single most important commitment in this Policy.

The limited exceptions are:

• Service providers we rely on to operate the platform (for example, our cloud hosting provider or transactional email provider). These providers act only under our instructions, are bound by written confidentiality and data-protection obligations at least as strict as the ones in this Policy, and are permitted to access data only to the extent required to provide their service. Where a HIPAA client’s data is involved, they are also bound by a downstream BAA.
• Client-directed integrations. Where a client has engaged us to move data between systems on the client’s behalf, we transmit that data to the endpoints the client has expressly designated, and only to those endpoints. This is done at the client’s instruction and for the client’s own purposes; we receive no consideration for it and grant no recipient any rights in the data. See Section 3 for how this works with QuickBooks Online.
• When required by law, such as a valid subpoena or court order. In such a case, we will notify the affected client to the extent legally permitted so the client can seek a protective order or otherwise respond.

Beyond those narrowly defined situations — each of which is either at your direction or compelled by law — your data stays with us and with you.

7. Cookies and Analytics

The Site uses a small number of cookies to remember display preferences and to enable Google Analytics. You can disable cookies in your browser settings; the Site will continue to function. We do not use advertising cookies, cross-site tracking, or third-party marketing pixels.

8. Data Retention

We retain website contact submissions for as long as reasonably needed to complete follow-up and any resulting business relationship, and then in accordance with our records-retention schedule.

Application data is retained for the term of the engagement and, unless the underlying Statement of Work requires otherwise, is deleted or returned to the client on request after the engagement ends. HIPAA-covered records are retained and disposed of in accordance with the applicable BAA and applicable law.

9. Your Rights

Depending on where you live, you may have the right to request access to, correction of, or deletion of personal information we hold about you. To exercise these rights, contact us at the address in Section 12. We will respond within the time frames required by applicable law.

For information that Samson Advisory processes on behalf of a client (for example, information inside the Awali Application about the client’s own employees or patients), please direct your request to the client. We will support the client in responding as required by the applicable agreement.

10. Children’s Privacy

Neither the Site nor the Application is directed to children under the age of 13, and we do not knowingly collect information from children under 13. If you believe a child has provided information to us, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Material changes affecting the Awali Application will be communicated to affected clients through the notice provisions of their agreement. Continued use of the Site or the Application after a change indicates acceptance of the updated Policy.

12. Contact Us

Questions about this Policy, or requests concerning your information, should be directed to:

Samson Advisory
Attn: Privacy
2301 W Anderson Ln #102-126
Austin, TX 78757
United States
Phone: 512-635-2718
Email: robert@samsonadvisory.com