Privacy Policy
This policy explains what our practice management software holds, where it lives, and who can reach it. It covers Tax Practice CRM, the desktop program our firm uses to run its own work — including the connection it makes to our QuickBooks Online company.
Last updated September 15, 2026
Who we are
White Magnolia Advisory is a certified public accounting firm in Lathrop, Missouri, United States. Drew O'Connor, CPA, is the firm's sole owner. If you have a question about anything on this page, write to whitemagnoliacpa@gmail.com and it will reach him directly.
Tax Practice CRM is a Windows desktop application. It is not a website and not a cloud service. Only our own staff use it. Clients of the firm never log into it and have no accounts in it. It is not sold or distributed to the general public, though a licensed copy may be provided to one other accounting firm.
What the software holds, and why
The software holds what an accounting firm normally keeps about the people and companies it works for: names, addresses, phone numbers, and email addresses; entity and filing details; documents; a record of work in progress; and charges, payments, and invoices.
All of it exists for one reason — to do the work a client has engaged us to do, and to keep an accurate record of it. We do not collect information for any other purpose.
Where the information lives
Everything is stored in a local database file on the firm's own computers. When the firm works from more than one machine, that file is synced between them using the firm's own Microsoft OneDrive account.
There is no vendor server behind this software. There is no hosted backend, no shared database, and no third party's infrastructure holding the data. The firm controls the computers and the OneDrive account the file sits in, and no one else has a copy.
How the sensitive fields are protected
Some fields deserve more than ordinary care: Social Security numbers, employer identification numbers, bank routing and account numbers, and passwords for client portals. Those are encrypted while stored, using AES-256-GCM. The encryption key is derived from a master password using PBKDF2-SHA256.
The master password is never written down anywhere in the software or the database. In practical terms: if someone obtained a copy of the database file on its own, those fields would be unreadable to them. That is the point of the design.
The QuickBooks Online connection
The software connects to QuickBooks Online so that billing does not have to be typed twice. The connection is made with OAuth 2.0 and requests one scope only: accounting (com.intuit.quickbooks.accounting).
Through that connection, the software can look up and create customer records, create invoices, send invoices through QuickBooks, and read back an invoice's outstanding balance. That is the full extent of it.
The connection is to the firm's own QuickBooks Online company. It does not connect to any client's QuickBooks, and it cannot see any client's books.
Access and refresh tokens for that connection are stored on the firm's own computer and protected by Windows DPAPI. They can be revoked at any time, either from inside the software or from the QuickBooks account itself.
Card and bank details are handled by Intuit, not by us
The software never sees, handles, transmits, or stores credit card numbers, debit card numbers, or bank login credentials. When a client pays an invoice, they pay on Intuit's own hosted payment page. Nothing about that payment method reaches this software or the firm's computers — we learn only whether the invoice was paid.
Email and text messages
Email to clients is sent through the firm's own Gmail account over SMTP. Text messages are sent through the firm's own business phone service, Quo. Neither service receives anything beyond the message being sent and the recipient's address or number.
What we never do
We do not sell information. We do not rent it. We do not share it for advertising, and we do not send it to any analytics or tracking service. The software contains no third-party trackers of any kind.
How long we keep records
Accounting firms keep records for years, and for good reason. A return filed today may need to be defended, amended, or referenced well into the future; depreciation schedules, basis records, and carryforwards depend on what happened in prior years; and professional and tax rules set their own minimum retention periods. We keep client records for at least seven years after the engagement, and longer where a tax position, a property basis, or a professional obligation requires it.
Asking what we hold, or asking us to fix it
If you are a client and you want to know what the firm holds about you, ask. Email whitemagnoliacpa@gmail.com and we will tell you, and provide copies where we are able. If something is wrong, tell us and we will correct it. Where a record must be retained for tax or professional reasons, we will say so plainly rather than quietly declining.
Questions
Write to whitemagnoliacpa@gmail.com. A real person reads it.
White Magnolia Advisory · PO Box 173, Lathrop, MO 64465 · This policy was last updated September 15, 2026.