Kept AI, Inc., doing business as Kept Books (“Kept”, “we”, “us”), helps small businesses keep their books. This policy explains what we collect, why, how long we keep it, and the rights you have over it. If anything is unclear, email support@keptbooks.co.
What we collect
- Account info. Name, email, password (stored hashed with bcrypt, never plaintext).
- Business profile. Business name, entity type, EIN, industry, business address. EIN and address are encrypted at rest.
- Contact info. Phone (encrypted at rest).
- Financial data. Bank connections you authorize through Stripe Financial Connections, transactions synced from those connections, receipts you upload, invoices you create, and customers and vendors you add.
- Vendor PII (when collected). Vendor name, address, entity type, taxpayer ID (EIN or SSN), and ACH banking details. EIN/SSN and banking are encrypted at rest. Vendors supply this themselves through a secure single-use link that you send.
- Technical info. IP address, browser/device user agent, pages visited, and how you use the app (the pages you open, what you click, how long you stay on a page). Used for security, fraud prevention, and product analytics.
- Error and crash logs. When something fails (a server error, or the app breaking in your browser), we record the error message, the technical stack trace, the page it happened on, your browser/device type, and, when you are signed in, your account, so we can find and fix it. These are stored in our own systems and do not include your financial data. If we ever turn on a third-party error-monitoring service, we'll disclose it here.
- Audit log. Every meaningful action you take (sign-in, settings change, bank connect, export, etc.) is recorded with a timestamp and your IP for accountability.
Why we collect it
- To run the bookkeeping product you signed up for.
- To prepare your year-end tax documents (1099-NEC for the vendors you pay over $600).
- To prevent fraud, abuse, and unauthorized access.
- To send you product, support, and account emails (and the marketing emails you opt into).
In GDPR terms, we process your data to provide the service you signed up for (performance of our contract), to meet legal and tax obligations, to keep the service secure and prevent fraud (our legitimate interests), and, for marketing email, with your consent. You can withdraw consent at any time.
How long we keep it
- Financial records. 7 years from creation, to meet IRS retention requirements. If you delete your account, we keep only a stripped-down copy of these records (amounts, dates, and categories) for the remainder of that window. Names, bank descriptions, and tax IDs are removed.
- Account profile. Until you delete the account, then a 30 day grace period before permanent deletion.
- Audit log. Kept for the life of your account, plus 30 days after account deletion (then permanently purged).
- Bank tokens. Destroyed when you disconnect a bank or delete your account.
Who we share it with
Each of the services listed below acts as a sub-processor under our direction. We share only the minimum data each one needs to perform its function, never for advertising or resale.
- Stripe Financial Connections. Your bank-connection authorization and transaction sync.
- Stripe. Payment processing for your Kept subscription and, if you use it, outgoing invoices via Stripe Connect.
- AI service providers. Power Kept's AI features, including the AI assistant, Canvas and voice conversations. Depending on the feature, we send: your transaction details and amounts (categorization, anomaly checks, reconciliation, reports, and forecasts); the questions you ask and the financial figures behind them (the AI assistant and Canvas); documents you upload for the AI to read, such as receipt images, bank-statement PDFs, payroll reports, and loan or mortgage statements (text/image extraction); the details needed to draft AI-written messages like invoice reminders (recipient, invoice number, amount, and due date); and, when you use voice mode, the audio of what you say, so it can be turned into text, and the text of Kept's reply, so it can be spoken back to you. Voice runs only while you have a conversation open, and ending it stops the microphone; voice audio is deleted by the provider within 30 days. We never send your bank login. Under our agreements, our AI service providers do not use your data to train their models.
- Microsoft Azure. Application hosting (Azure Container Apps), database (Azure Database for PostgreSQL Flexible Server), file storage for receipts and avatars (Azure Blob Storage), and transactional email (Azure Communication Services). All Azure services are hosted in US regions.
- Nango. Runs the sign-in when you connect outside software to Kept, and stores the access tokens that let Kept read from it. Today that is QuickBooks; others are listed on the Connections page as they become available. Because Kept's requests to those platforms pass through Nango, the records we read, such as your QuickBooks transactions and accounts, travel through it on the way to us. We never send your Kept password, and Nango cannot sign in to your Kept account.
Chat apps you connect. If you connect Kept Books to Claude or ChatGPT, that chat app receives the Kept information you ask about in it, from the business you pick: balances and bank names with their last four digits, transactions and their categories, invoices, estimates and payments, customer and project names and their contact details, receipt details, reports, tax estimates and payments, and your referral code. Nothing is sent until you connect, and only what a question needs. The chat app handles your conversation under its own privacy policy. A change is made only when you tap the button on a Kept card. You can disconnect at any time in Settings, Security, Connected chats.
We do not sell or share your personal information, including for cross-context behavioral advertising. We do not share it with advertisers.
Browser privacy signals. Some browsers can send a Global Privacy Control (GPC) or “Do Not Track” signal. We recognize and honor these signals. Because we do not sell or share your personal information and do not use it for targeted advertising, there is nothing for these signals to opt you out of, and we will continue to honor them as the law requires.
Cookies and tracking
We use cookies that are necessary to sign you in and keep the app secure, plus product analytics from PostHog to understand how the product is used: the pages you open, what you click, and session recordings in which everything you type and every word and number on screen is blanked in your browser before anything is sent. We do not use third-party advertising or cross-site tracking cookies. You can control cookies in your browser; blocking the essential ones will break sign-in.
How we protect it
- TLS 1.2 or higher for all data in transit. HSTS preloaded.
- AES-256-GCM encryption at rest for taxpayer IDs, bank routing and account numbers, business addresses, phone numbers, and Stripe Financial Connections access tokens.
- Per-row authorization on every database query so your data is never reachable by another tenant.
- Optional two-factor authentication (TOTP) available in Settings.
- CSRF protection, rate limiting, signed webhooks, and a comprehensive audit log on every sensitive action.
- Soft-delete grace period (30 days) so an accidental delete can be reversed, permanent purge after.
- If a breach affects your personal information, we'll notify you and any required authorities without undue delay.
Your rights
Depending on where you live, you have some or all of the following rights. Email support@keptbooks.co to exercise any of them.
- Access. Download every piece of data we hold on you via Settings › Export, or by emailing us.
- Correction. Fix wrong information in Settings.
- Deletion. Delete your account in Settings. A 30 day grace lets you reverse the request, after which the data is permanently purged.
- Portability. The export is machine-readable JSON.
- Objection. Opt out of marketing email at any time via the unsubscribe link.
- Restriction. Ask us to pause processing of your data in certain cases.
- Appeal. If we deny a privacy request, we will tell you why. You can appeal by replying to our response or emailing support@keptbooks.co with the word “appeal.” We will respond within the time your state’s law requires. If we deny your appeal, several states also let you complain to your state Attorney General, and we will tell you how.
- EU/UK residents (GDPR). You also have the right to lodge a complaint with your local supervisory authority. We aim to respond to rights requests within 30 days. Our AI suggests categories and answers, but a person stays in control; it does not make legally significant decisions about you on its own.
- California residents (CCPA/CPRA). You have the right to know what we collect, to correct it, to delete it, to limit how we use sensitive personal information (your SSN, EIN, and bank account numbers, which we use only to run the service and never to profile you), and not to be treated differently for exercising these rights. We do not sell or share your personal information, so there is no sale or share to opt out of. You may use an authorized agent to make a request, and we will verify your identity before acting.
Mobile app: additional data we collect
The Kept iOS and Android apps collect the same account data the web app does, plus a few mobile-specific items:
- Device identifier (push token). When you install the app and grant notification permission, your device receives a unique token from Apple Push Notification Service (iOS) or Firebase Cloud Messaging (Android). We store this token to deliver notifications like the daily summary email and anomaly alerts. The token is not personally identifying on its own.
- Camera access (only when uploading a receipt). The app uses your camera to capture receipt photos. Photos go directly to your account’s receipt storage and are not uploaded anywhere else.
We never collect contacts, photos beyond what you choose to upload, microphone audio, advertising identifiers, or biometric data (Face ID and Touch ID are handled entirely on your device. Kept never sees your face scan or fingerprint, only a yes/no result from the OS).
Children
Kept is for businesses run by adults. You must be at least 18 to use Kept, and we do not knowingly collect data from anyone under 18.
International transfers
Our servers are hosted in the United States. If you use Kept from outside the US, your data is transferred to and processed in the US under the standard contractual clauses our processors maintain.
Changes to this policy
We'll email you and post a notice in-app at least 14 days before any change that materially reduces your privacy rights. The effective date at the top reflects the current version.
Contact
For all privacy, security, and support questions: support@keptbooks.co
Kept AI, Inc.
5543 Edmondson Pike, P.O. Box 238
Nashville, TN 37211