Privacy Policy

1. Who We Are

Kveldo is a software-as-a-service platform operated by Kveldo ("Kveldo," "we," "us," or "our"), a Pennsylvania limited liability company based in Pittsburgh, USA. Kveldo provides accounting practice management and secure client portal software to accounting firms, CPA firms, tax professionals, bookkeepers, and enrolled agents (collectively, "Firm Users").

In the context of this Privacy Policy:

• "Firm Users" are accounting professionals who subscribe to Kveldo and their authorized staff members.
• "Client End Users" are the clients of accounting firms who access Kveldo's secure client portal.
• "Client Data" is information that Firm Users input about their clients — including financial and personal information — to run their practices on Kveldo.

2. Data Controller and Processor Roles

For Firm Users' account data (name, email, billing info, usage data), Kveldo acts as a data controller — we determine the purpose and means of processing that data.

For Client Data that Firm Users input about their clients (taxpayer information, financial records, uploaded documents), Kveldo acts as a data processor on behalf of the Firm User. The Firm User is the data controller for their clients' data, and we process it only according to their instructions and as described in our terms of service.

Firm Users are responsible for obtaining any consents or legal bases required to share their clients' personal information with Kveldo, and for informing their clients that Kveldo will process that data on their behalf.

3. Information We Collect

3.1 Account and Firm Information

When you create a Kveldo account, we collect:

• Name, email address, and password (hashed — never stored in plain text)
• Firm name, business address, phone number
• Payment and billing information (processed by Stripe; Kveldo does not store full card numbers)
• Your selected plan and subscription details

3.2 Client Data You Input

As a Firm User, you input client information to run your practice. This includes:

• Client contact information (name, email, phone, address)
• Taxpayer identification numbers (SSN, EIN, ITIN) — encrypted at rest using AES-256
• Business entity information (type, fiscal year, state of incorporation)
• Financial information and tax-related documents
• Employee information for payroll clients (W-4 data, direct deposit)
• Contractor information (W-9 data)

This data is stored encrypted. It is never used for advertising, never sold, and never shared except as necessary to operate the service for your firm.

3.3 Documents Uploaded by Clients

When your clients upload documents through the Kveldo client portal, those documents are stored in encrypted cloud storage. Documents may include W-2s, 1099s, prior year returns, bank statements, and other sensitive financial records. These files are only accessible to the Firm User and their authorized staff — never to other firms on the platform.

3.4 Usage and Technical Data

We automatically collect certain technical data when you use Kveldo:

• Browser type, device type, and operating system
• IP address (anonymized in logs after 30 days)
• Pages visited, features used, and session duration
• Error logs (these never contain PII or document content)
• Referrer URL

4. How We Use Your Information

We use the information we collect to:

• Operate the service — store, retrieve, and process your client data as you direct
• Process AI intake extraction — when you trigger extraction on an uploaded document, its content is sent to our AI processing pipeline (which uses enterprise-grade LLM services under strict data processing agreements) to extract structured data; the document content is not retained by the LLM provider after extraction
• Authenticate users — verify passwords, issue email confirmation and invitation links, and validate time-based one-time codes from your authenticator app
• Send transactional communications — document request notifications, document received confirmations, deadline reminders, and status updates
• Provide support — respond to your questions (a support session runs as one of your own people and sees what they see; every session is time-limited, recorded, and disclosed to that person and to your administrators)
• Improve the product — analyze aggregate, anonymized usage patterns to prioritize features
• Billing and payments — process your subscription through Stripe
• Security and fraud prevention — detect and respond to security events, unauthorized access, and abuse
• Legal compliance — comply with applicable law and respond to lawful requests

We do not use your client data or Client End User data to train AI models. We do not sell your data. We do not use your data for advertising purposes.

5. Security Controls for Sensitive Financial Data

Because Kveldo handles financial and tax information subject to FTC Safeguards requirements, we implement the following security controls:

• AES-256 Encryption at Rest: All PII fields (SSNs, EINs, DL numbers, bank routing/account numbers) are encrypted at the database level.
• UI Masking: Sensitive fields are masked as ••••••7890 across the interface. Staff who work a client’s return can see the full identifiers that work requires.
• TLS 1.3 in Transit: All connections — browser, mobile, API — use TLS 1.3.
• Multi-Tenant Isolation: Each firm's data is isolated, and that isolation is enforced beneath the application rather than by application code. Every table holding firm data is classified, and most carry a rule in the data layer that fails closed: a connection that has not declared which firm it is acting for returns nothing rather than everything. The exceptions are named one by one, each with a written reason, and fall into three kinds. A few must be readable before any firm is known — sign-in and the branding on the sign-in page — and those are read-only. A few are reached by a single-use link rather than a session: an invitation, a payment request, a signature request. The third kind is our own operational record of running the service — activity and security logs, email delivery events, support and impersonation records, and our billing of your firm. We read those across firms because operating the platform requires it, and they are protected by controls on who may open those screens rather than by the per-firm rule.
• No PII in Logs: Application logs never contain PII values. If a log entry would contain a PII field, it is replaced with a redacted placeholder.
• Role-Based Access: Staff access to PII is controlled by role-level permissions configured by the firm administrator.
• Audit Trails: All document access, PII view events, and data exports are logged with user ID, timestamp, and action.
• Azure Cloud Infrastructure: Kveldo is hosted on Microsoft Azure, which maintains SOC 2, ISO 27001, and other enterprise security certifications.

6. How We Share Information

We share your information only in the following circumstances:

• Subprocessors: We use a limited number of subprocessors to operate Kveldo (listed in Section 7). Each subprocessor is under a data processing agreement with security and confidentiality obligations at least as protective as this policy.
• Within your firm: Firm staff members you authorize in Kveldo can access the client data assigned to them based on their role permissions.
• Your clients: Client End Users can see their own documents and messages in the client portal. They cannot see data belonging to other clients.
• Legal requirements: We may disclose information if required by law, subpoena, or other legal process — or to protect the rights, safety, or property of Kveldo or others. We will notify you before disclosure where legally permitted.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change and the acquirer will be bound by this policy.

We do not sell personal data. We do not share data with advertising networks.

7. Subprocessors

We use the following categories of subprocessors to operate Kveldo:

8. Data Retention

• Active accounts: Data is retained for as long as your subscription is active.
• After cancellation: Your data is retained in read-only state for 30 days after cancellation, during which you can export everything. After 30 days, data is permanently deleted from our production systems. Encrypted backups are purged within 90 days.
• Audit logs: Security and access audit logs are retained for 12 months from creation, then deleted.
• Support communications: Retained for 24 months to provide consistent support, then deleted.
• Billing records: Retained for 7 years as required by financial recordkeeping law.

9. Your Rights and Choices

You have the following rights regarding your data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Export: Export all your client data, documents, and firm data at any time via the Settings panel.
• Deletion: Request deletion of your account and all associated data. We will complete deletion within 30 days.
• Restrict processing: Request that we stop processing certain data while a dispute is resolved.
• Opt out of marketing: Unsubscribe from marketing emails at any time using the link in any email, or by contacting us.

For Client End Users: your rights regarding data held by an accounting firm on Kveldo should be directed to the accounting firm (the data controller for your information). The firm can action data access and deletion requests within Kveldo.

To exercise any of the above rights, contact us at: [email protected]

10. FTC Safeguards Rule Compliance

The FTC Safeguards Rule (16 CFR Part 314) requires financial institutions — including tax preparers and accounting firms — to implement a Written Information Security Program (WISP) and specific technical safeguards for customer financial data.

Kveldo's security architecture is designed to support your firm's FTC Safeguards compliance obligations. Specifically:

• Encryption at rest and in transit for customer financial information
• Access controls limiting staff access to data on a need-to-know basis
• Mandatory multi-factor authentication for all users, staff and client, with no route to disable it
• Audit trails supporting incident response and documentation requirements
• Written security policies documented in our security program

Using Kveldo does not relieve your firm of its independent WISP obligations, but our security controls are documented and can be referenced in your WISP.

11. Cookies and Tracking

The Kveldo marketing website uses:

• Strictly necessary cookies: Session management and CSRF protection. Cannot be disabled.
• When you contact us: the contact form records what you typed, and also the IP address you sent it from and your browser’s user-agent string. That is deliberately different from the analytics above, which keep no address at all: an inquiry is a person choosing to write to us, and the address is how we tell one automated submission from a thousand and investigate abuse if it happens. It is not used to profile you, it is never sold or shared, and it is deleted with the rest of the inquiry on our retention schedule. If a bot challenge is shown, whether it passed is recorded too.
  
  From that address we also work out an approximate city, state and postal code and store it with your inquiry, so we know roughly where a firm writing to us is based before we reply. This is a lookup against a database held on our own server — your address is not sent to anyone to do it, and no location service is contacted. It is an estimate of where your network connects, not where you are: on a mobile connection, a VPN or a company network it is frequently wrong, and we treat it that way. It is deleted with the inquiry.
• Our own analytics, no cookie: This marketing site counts how people move through it — which pages are read, in what order, and which of them lead to someone starting a trial. Two random identifiers are kept on your device to do that: one so a second page is recognized as the same visit, one so a return visit is recognized as a return. Neither is your name, your email, or anything you typed. These set no cookie and they run whether or not you accept the banner below, because nothing here goes to another company.
  
  This part involves no vendor at all: the data goes into Kveldo’s own database rather than someone else’s. We do not store your IP address — it is truncated before it is written, which is enough to tell which country traffic comes from and useless for identifying a person. We do not record your screen, we do not capture every click, and we never sell or share any of it.
• Google Analytics, only if you accept: We also use Google Analytics 4 to see how people arrive here — which search terms and which links bring firms to us — because that is the one question our own counter cannot answer. It is switched off until you press Accept. Before you answer, Google receives an anonymous signal that a page was viewed and stores nothing on your device; if you accept, it sets its own cookies (the _ga family, which expire after two years) so a return visit is recognized as a return. If you decline, it stays off and we do not ask again.
  
  You can change your mind at any time using Cookie settings in the footer of any page. We run no advertising or remarketing tags — not before you answer and not after — and advertising and personalization storage are switched off permanently in our configuration rather than left to a preference. Google anonymizes IP addresses on collection and we do not link this data to your contact inquiry or your Kveldo account. Google is the data controller for what it collects; see Google’s Privacy Policy.
• Do Not Track is honoured: if your browser sends a Do Not Track signal, none of the above runs. No identifier is created, no Google tag is loaded, nothing is recorded, and you are not shown a consent banner — you have already answered.

The Kveldo application (once logged in) is different and stricter: it uses only strictly necessary cookies, and no analytics, advertising or tracking cookies of any kind. Google Analytics runs on this marketing website only — it is not present in the product, and it never sees your client data.

12. Children's Privacy

Kveldo is a business software platform intended for adults operating professional accounting practices. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided personal information to Kveldo, contact us immediately at [email protected] and we will delete the information.

Note: Dependent information entered by Firm Users for tax preparation purposes (e.g., a client's minor children as claimed dependents) is Client Data handled on behalf of the Firm User and subject to the controls in Section 5.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify Firm Users via email and in-app notification at least 30 days before the change takes effect. The effective date will always be visible at the top of this page. Continued use of Kveldo after a change becomes effective constitutes acceptance of the updated policy.

14. Contact Us

Privacy inquiries, data requests, and security concerns: