1271 Privacy Policy

1271 LLC · Version 1.1 · Effective date: 23 October 2026 · Last updated: 23 October 2026

This Privacy Policy explains how 1271 LLC ("1271," "we," "us") collects, uses, shares and protects information when you use the 1271 Business Advisory web application at app.twelveseventyone.com (the "Service"), and when you contact us for support. We built the Service for small US service businesses, and we wrote this policy to be read. Questions go to Marcus Roesler at marcus@twelveseventyone.com.

Contents

1. Who this policy covers, and our role
2. Information we collect
3. How we use information
4. QuickBooks data
5. Who receives information
6. How we protect information
7. Retention, disconnecting and deletion
8. Your choices and requests
9. Age and children
10. Where data is stored and processed
11. Changes to this policy
12. Contact

1. Who this policy covers, and our role

The Service is used by businesses (our "Customers") and by the people they invite. A Customer's account can include these roles:

• Client admins — business owners who control the account and who has access.
• Viewers — the Customer's staff.
• Advisors — outside accountants, bookkeepers or consultants the Customer invites.
• Client admins, viewers and advisors can see the company's full financial data, including payroll and pay amounts.
• Collaborators — people the Customer invites with limited access. Collaborators never see financial or pay data.
• Field team members (planned, not yet available) — people who would log their own hours and see no financial data.

Access is role-based: each person sees only what their role allows.

Two kinds of information, two roles for 1271

For personal information contained in the business records Customers connect or upload (for example, employee names, hours and pay rates, and the names and contact details of the Customer's own customers and vendors), we process information on the Customer's behalf and under its instructions. A Data Processing Addendum (the "DPA") setting out these terms is available upon request by emailing marcus@twelveseventyone.com.

We separately determine how to use account, billing, support and operational information needed to administer user relationships, operate and secure the Service, prevent misuse and meet our legal obligations.

In operating our integrations, 1271 does not process information on Intuit's behalf.

2. Information we collect

2.1 Account information

Your name, email address, company name, and the role assigned to you. Sign-in is handled by Auth0 (Okta) on its own sign-in page. The Service then keeps you signed in with a secure session cookie that expires after 8 hours. It also stores one display preference (whether the help guide is collapsed) in your browser and no personal information in browser storage.

2.2 Information from systems a Customer connects

With a Customer's authorization, our integrations read the following. They do not create, modify or delete records in those systems.

2.3 Information you enter

Forecasts, opening cash balances, reserve targets, notes, project details, files you upload (such as QuickBooks reports and QuickBooks Time timesheet exports, which can include employee names, hours worked by job, approval status, service items and any notes entered with the time), and historical "snapshots" (frozen versions of a forecast the Service keeps so you can look back at them).

2.4 Technical, security and support information

Application logs (size-limited and automatically rotated, oldest entries first), sign-in and security events, and the content of support requests you send us. We do not use advertising trackers.

2.5 Billing information (planned)

Paid subscriptions are not yet available. When they launch, payments will be processed by Stripe, which will receive your payment details directly; 1271 will not store full card numbers. We will update this policy before billing launches.

3. How we use information

We use Customer Data for one purpose: to provide financial forecasting, cash-flow planning, job costing, labor hours analysis and related decision-support tools to the Customer whose account the data belongs to. In practice that means we:

• build and update forecasts, cash-flow plans and job-cost reports for that Customer;
• show each user the information their role permits;
• provide support when you ask for it; and
• keep the Service secure, detect misuse and recover from failures.

We use account, billing and operational information to administer your account, bill for subscriptions when available, send service-related messages (such as security alerts and, once billing launches, renewal notices), and meet our legal obligations.

What we do not do:

• We never sell your information or use it for advertising.
• We never share one Customer's data with another Customer, and we do not combine or benchmark financial information across Customer companies.
• We do not use Customer Data to train AI models.
• We do not license de-identified customer financial data for other business purposes.
• Any feature that would send Customer Data to an AI provider will be described here, with the provider named in Section 5, before it launches.

4. QuickBooks data

Intuit requires us to make these commitments to QuickBooks users, and we make them:

• We use QuickBooks data only to provide the Service to the Customer who authorized the connection.
• We do not use QuickBooks data for general archiving or backup. The only copies outside the live Service are the encrypted disaster-recovery backups described in Section 6.
• When a Customer withdraws authorization, we stop reading immediately, and we delete imported QuickBooks data when the Customer asks us to (Section 7).
• If we discover a security incident, including a reasonably suspected one, affecting QuickBooks users' data, we notify Intuit within 24 hours of discovery.
• In operating the integration, 1271 does not process information on Intuit's behalf.

1271 reads information from your connected QuickBooks account to provide the Service. Our integration does not create, modify or delete your QuickBooks accounting records. The consent screen Intuit shows you describes read-and-write access because QuickBooks' accounting permission has no separate read-only option; the read-only restriction is enforced by our software.

5. Who receives information

5.1 Service providers that process data for us

These companies process data under our instructions and contracts that limit what they can do with it.

5.2 Payment processor (planned)

When billing launches, Stripe will process payments. Stripe acts for us in processing your payment, and also uses payment information for its own purposes, such as fraud prevention, under its own privacy policy.

5.3 Systems you connect

Intuit (QuickBooks Online) and, when available, Houzz (Houzz Pro) and Jobber are the sources of data you authorize us to read. They are not our processors. They hold your data under their own terms and privacy policies, and your authorization to us is governed by your agreement with each of them.

5.4 People a Customer invites

Client admins decide who can access their account. Each invited person sees the data their role allows and nothing more.

5.5 Legal requirements and protection of rights

We may disclose information where reasonably necessary to comply with a legal obligation or a valid legal request (such as a subpoena or court order), or to protect the safety, rights or property of 1271, our Customers or others, in each case only to the extent legally permitted and limited to what is necessary. Where legally permitted and reasonably practicable, we tell the affected Customer in advance. We document the basis for each disclosure. We do not reserve a general right to disclose financial information for convenience.

5.6 Business changes

If 1271 is involved in a merger, financing, acquisition, due-diligence process or sale of assets, we may disclose information to the extent necessary, under confidentiality obligations and subject to applicable law, any signed DPA and the restrictions of the systems you connect. We use company-level materials for diligence and disclose customer-level records only where legally and contractually permitted. Any successor must continue to protect the information as this policy and any signed DPA require; materially new uses would require lawful notice and any required consent.

6. How we protect information

No system is perfectly secure, but these are the safeguards in place:

• Traffic between your browser and the Service is encrypted in transit.
• Each Customer's data is separated from every other Customer's, enforced at the database level.
• Access inside an account is role-based.
• Access tokens for connected systems are encrypted with strong encryption, with the key kept separately from the database.
• Our logging is designed not to record credentials, access tokens or session identifiers, and logs are size-limited and rotated.
• Backups are encrypted and copied offsite nightly.
• Customer data is stored on encrypted-at-rest storage volumes.
• Only a limited number of 1271 staff can access production systems, only as needed to operate the Service, with multi-factor authentication.

If we discover a security incident affecting your data, we notify the affected Customer immediately where applicable law requires it and otherwise without undue delay, with updates as facts develop, and we notify Intuit within 24 hours of discovery where QuickBooks data is involved. Our internal procedures hold the specific standards behind these summaries.

7. Retention, disconnecting and deletion

7.1 While your account is active

We keep Customer Data for as long as the account is active, so that forecasts, history and snapshots remain available.

7.2 What happens when things change

In every case below, your data stays in the Service until a client admin asks us to delete it.

• A connection temporarily fails (for example, an expired token): we pause updates and ask you to reconnect. Imported data stays available. We do not treat a failed token as withdrawal of your consent.
• You disconnect a system or withdraw authorization: we stop reading from it immediately. Data already imported, and the snapshots built from it, stay available until you ask us to delete them.
• You cancel your subscription (once billing launches): your data is unaffected until the account closes at the end of the paid period.
• Your account closes: access ends, but we keep your data so you can export it or reactivate, until a client admin asks us to delete it.
• A client admin asks us to delete the company's data: we verify the request and then remove the data from active systems; we will confirm the timing when you ask.

7.3 Backups and retained records

Encrypted backups are kept for disaster recovery only and are retained for a limited period.

We keep narrow categories of records needed for billing, legal compliance, security and handling requests. These restricted records are never used to resume forecasts, and we do not keep your ledger because we need our own invoices.

8. Your choices and requests

• Access and correction. You can update your name and email address through your sign-in provider; contact us to correct anything else. Forecast inputs can be edited by users whose role allows it. Data imported from a connected system should be corrected in that system; the Service picks up the change the next time the data is read and the update is reviewed.
• Disconnecting. A client admin can disconnect any system at any time from account settings. See Section 7 for what happens next.
• Deleting a company's data. A client admin can request deletion of the company's data by emailing marcus@twelveseventyone.com (Section 7). We verify that the request comes from an authorized admin before acting; we will not delete a company's records on an unverified request.
• Email. We send service-related email (security notices and, once billing launches, renewal notices).

Requests from individuals

If your request concerns personal information controlled by one of our Customers (for example, you are an employee or a client of a business that uses 1271), contact that business. We will assist the Customer in responding as required by our agreement and applicable law. You do not need to become an account holder to make a request. If your request concerns information for which 1271 is responsible directly, or you need help identifying the appropriate process, contact us at marcus@twelveseventyone.com. We may reasonably verify identity and authority and will protect other people's information when responding.

State privacy laws such as Minnesota's Consumer Data Privacy Act and California's CCPA/CPRA give some individuals additional rights where those laws apply to a business. We review our obligations under those laws annually and whenever our data practices change. If either law applies to 1271, this section will list the rights available, how to submit a request, how we verify it, our response time, and how to appeal a decision.

9. Age and children

Account holders and invited users must have legal capacity to agree to our Terms and must be at least 18 years old. The Service is for businesses and is not directed to children under 13, and we do not knowingly collect personal information directly from children. Business records a Customer lawfully holds may incidentally include information about a minor (for example, a homeowner's household member named in a project note); we process such records only on the Customer's instructions. If you believe a child has provided information directly to us, contact us and we will delete it.

10. Where data is stored and processed

The Service and its database are hosted with DigitalOcean in New York, USA. Backups are stored with Backblaze B2 in its us-east region. Sign-in is hosted by Auth0 (Okta) in its US region. All three are in the United States. We serve US Customers only at this time.

11. Changes to this policy

We may update this policy. For material changes we email client admins at least 30 days before the change takes effect and post the updated policy with a new effective date; changes needed urgently for legal or security reasons may take effect sooner, with notice as soon as practicable. We will not use information we already hold for materially different purposes without telling you and obtaining any consent the law requires; continuing to use the Service is not treated as consent to such a change.

12. Contact

Privacy, support and security contact

Marcus Roesler, 1271 LLC

9760 Justen Trl N, St. Paul, MN 55115

651-336-4498

marcus@twelveseventyone.com