Last updated September 22, 2026
This is an interim document written in plain language by the team that runs the app. It has not been reviewed or certified by an attorney. It describes what the app does today and will be replaced when a reviewed version exists.
Team Panda is a private operations app for one team: tasks, vehicle pre-checks, fleet, stock, sales, contracts, customers and a money view. There is no public sign-up. An admin creates each seat, and only signed-in, active seats can see any data.
Your seat: name, email address, role and the permissions your admin gave you. Your password is handled by our authentication provider; the app never sees or stores it in readable form.
The records the team enters: tasks, pre-check answers, vehicles, stock items and adjustments, sales, contracts and payment schedules, customer contact details, and feature requests. Records are tagged to a company, and a seat only sees the companies it belongs to. An admin can link companies that operate together; seats of linked companies can then view (not change) each other’s stock, sales, contracts, customers and knowledge documents.
Connecting QuickBooks is optional and only a seat with the Money connect permission can do it. We request one scope, com.intuit.quickbooks.accounting.
What we read: the company name, open invoices and open bills, the open credits against them (credit memos, customer payments not yet applied, vendor credits) — for each: number, customer or vendor name, dates, total, open balance, currency — and the Profit & Loss report. We keep a cached copy so the Money page can show it, and only seats with the Money permission who belong to the linked company — or to a company an admin has linked to it — can see it. Figures from different QuickBooks companies are never added together.
What we send: only when a seat with the Money connect permission taps Send, the app creates that one record in the linked QuickBooks company — a customer, a sales receipt or invoice for a sale, an invoice for a contract payment, a bill (and the vendor it names), or — for a paper check a seat photographed, matched to a deposit and reviewed — one customer payment per customer the check pays, applied to that customer’s open invoices. The same permission, acting through the team MCP as that seat, can also create one invoice in the QuickBooks company linked to a named team company (never another company’s books). It sends the names, contact details, dates, line descriptions and amounts already entered in the app or supplied on that call. Nothing is sent automatically, and we keep a log of what was sent, by whom, and QuickBooks’ answer.
Check photos: a photographed check (and its stub) is stored in a private bucket that only members of that company can open, through short-lived links, and is kept with the record for the audit trail. It is never public and never sent anywhere except, when reading is enabled, to the model service that reads the fields for you to correct.
What we never do: change or delete anything in QuickBooks, take or process a payment, request card / payment-processing scopes, or move money. The customer payment above is an accounting record of a check you already deposited — not a charge.
The QuickBooks access and refresh tokens are stored server-side only and are never sent to the browser. Disconnect on the Money page erases the stored tokens and hides that company’s cached data. You can also remove the app’s access from inside your Intuit account at any time.
When a QuickBooks request fails, we log Intuit’s transaction id (intuit_tid), the HTTP status and Intuit’s error message so the problem can be traced. Tokens and financial figures are not written to those logs.
The app is hosted on Vercel, and its database and sign-in run on Supabase. QuickBooks data comes from Intuit when a company is connected. The booking page embeds Calendly. If an admin turns on the optional AI assistant, the question you type and the context it needs are sent to OpenRouter to get an answer, and team documents an admin attaches are read from Google Drive. If an admin connects Bouncie vehicle trackers, the app reads each tracked vehicle’s last known position, odometer, fuel and battery level, check-engine codes and trip summaries (start, end, distance, speed and driving-event counts — not the route itself) from Bouncie and shows them only to seats who can see that vehicle. The app never sends anything to Bouncie.
We do not sell data, show ads, or share data with anyone for marketing.
Records are hidden (archived) rather than erased so the team keeps its history, and ledgers such as stock adjustments are append-only. Removing a seat turns the sign-in off; it does not erase the history that seat created. There is no self-serve erase yet: to have your data corrected or removed, ask your team admin.
The app sets the cookies needed to keep you signed in. It sets no advertising or tracking cookies.
Ask your team admin, who is the person that gave you your sign-in. When this page changes, the date at the top changes with it. Using the app is also covered by the Terms of Use.