Privacy Policy

When an Admin on your account adds a METRC user API key, Harvst uses it to read, for the licences you choose to sync:

• your facilities (licences) and their locations, which Harvst shows as rooms
• harvests, including strain, drying location and weights
• packages, including label, product, category, strain, quantity and lab testing status
• plants in the vegetative and flowering phases, grouped by room and strain
• outgoing transfers, including manifest number, date, recipient business and its licence number, package, quantity and invoice reference

When an Admin connects QuickBooks, Intuit asks them to approve access to your company’s accounting data. Harvst then reads:

• your company name and QuickBooks company ID, to confirm which company is connected
• invoices in the date range being synced, from which Harvst keeps the customer name, item, invoice date, quantity, rate and amount
• the Accounts Receivable Aging report, as an amount owed per customer
• your bank account names, types and balances
• the Sales by Item report, as units sold and revenue per item
• the Profit and Loss and Balance Sheet reports, from which Harvst keeps production cost totals by category

Harvst does not read bank account numbers, payroll, or card details. It reads balances by account name only.

Harvst never writes to METRC or QuickBooks. That holds in the code, and does not depend on what permissions a key happens to have: the part of Harvst that talks to QuickBooks refuses to send anything other than a read request, and the part that talks to production METRC does the same.

The only requests Harvst sends to Intuit that are not reads are the ones QuickBooks’ own sign-in requires: exchanging the approval you give for an access token, renewing that token, and giving it back when you disconnect.

• Your account: your name, email address, password (stored hashed, never in readable form), your role (Admin, Operator or Viewer) and the account you belong to. If you turn on two-factor authentication or passkeys, we store what is needed to check them.
• Your company’s account: its name, time zone and a primary contact email.
• Invitations: when an Admin invites someone, we store the invitee’s email address and role, and send them an email with a link to join.
• Sign-in sessions: while you are signed in we keep a session record that includes your IP address and browser user agent.
• Feedback: if you send feedback from inside the app, we store your note, the page you were on, and a snapshot of what that page showed. Passwords, keys and tokens are stripped from the snapshot before it is saved. Only the Harvst team reads it.
• Waitlist: if you join the waitlist on our home page, we store your email address and use it only to tell you when Harvst opens.

Harvst does not use advertising or analytics trackers. Its cookies keep you signed in, protect forms from forgery, and remember whether you prefer light or dark mode and an open or closed sidebar.

Everything Harvst collects is kept in its own database, and every record is tied to the account it belongs to. People in one account can’t see another account’s data.

Your METRC key and QuickBooks tokens are encrypted before they are saved, one set per account, and the app never sends them to your browser.

Harvst runs on Laravel Cloud, which runs on Amazon Web Services. We also use an email delivery provider to send sign-in and invitation emails, and a web font provider to serve the typeface these pages use, which sees your IP address when your browser loads it. These providers process data only on our behalf.

We keep your data while your account is active, and delete it when you ask or when the account is closed.

We use your data to run your dashboard: to sync from METRC and QuickBooks, work out your numbers and show them to the people in your account. We use your email address to sign you in, reset your password and send you invitations. We read feedback to fix and improve Harvst.

We don’t sell your data. We don’t share it with anyone for their own use, and the providers above only process it to run Harvst for us. We don’t use it to advertise to you.

An Admin can disconnect QuickBooks at any time from Settings → Integrations → Disconnect. Harvst stops syncing from QuickBooks straight away.

You can also remove Harvst from your company’s connected apps inside QuickBooks Online. The next time Harvst tries to sync, Intuit refuses it, and Harvst shows the connection as failing under Settings → Integrations.

Disconnecting stops new data from coming in. Figures Harvst already synced stay, and the financial tiles on the dashboard and TV board show them as stale until you connect again. To have them deleted, email us as described below.

• Your own sign-in: Delete account in Settings → Profile removes your sign-in only: your name, email and password. It doesn’t close your company’s account or delete its data.
• Closing your account and deleting its data: to close the account, or to have everything Harvst holds for it removed, including what it read from METRC and QuickBooks and your stored keys, email [email protected] from an Admin’s address. We’ll confirm when it’s done.
• The waitlist: email us and we’ll remove your address.

Deleting data from Harvst does not touch your records in METRC or QuickBooks.

Questions about this policy or your data go to [email protected].

If we change this policy, we’ll update the date at the top. If a change affects how we use data we already hold, we’ll email account Admins first.