Privacy Policy

1. The short version

We do not sell your personal information, and we do not share it with third parties for their own marketing.

We do use what we hold to operate the service, to improve it, and to tell you about our own products and features. You can opt out of that marketing at any time without losing access to anything.

Your financial data belongs to you. You can export it or ask us to delete it.

2. What we collect

We collect only what the service needs to work:

• Account details: your name, email address, and optionally a mobile number for verification and alerts.
• Business details you enter: entity names, legal names, jurisdictions, and settings.
• Financial data: transactions, balances, account names and masked numbers, categories, and reconciliation state, either supplied by a connected provider or entered by you.
• Documents you upload, and the data extracted from them.
• Usage information: which screens you open, which choices you make, sign-in times, approximate location derived from IP address, device and application version.
• Technical logs needed to operate and secure the service.

3. What we never store

We never accept or store your bank username or password. Bank connections are made through the provider’s own authorisation flow, and we hold only an encrypted access token that you can revoke at any time.

We do not store full bank account numbers or full payment card numbers, only the masked last four digits supplied by the provider.

4. How we use it

We use the information we hold to:

• Provide the service: categorise transactions, read documents, reconcile deposits, produce reports, and show your books.
• Improve the service, including improving how accurately documents are read and transactions are categorised.
• Keep the service secure, detect fraud and abuse, and investigate incidents.
• Support you when you ask for help.
• Meet our legal, tax, and regulatory obligations.
• Tell you about our own products, features, and offers that we think are relevant to you.

5. Marketing

We may use what we know about how you use the service, including aggregate information about your activity, to decide which of our own products and offers to tell you about, and to send you those messages.

We do not sell your personal information. We do not share it with third parties so that they can market their own products to you. We do not permit advertising networks to track you inside the service.

Every marketing message includes a way to unsubscribe, and you can turn marketing off in your account at any time. Opting out never limits your access to the service. We will still send necessary operational messages, such as security alerts, verification codes, and notices about changes to these documents.

6. Automated processing

The service uses automated systems, including artificial-intelligence models, to read uploaded documents, suggest categories, detect duplicates, and produce forecasts.

Where a document is processed by a model provider, the document content is sent to that provider for the purpose of reading it and returning a result. We choose providers that do not train their models on customer content by default, and we do not authorise such training.

These systems make mistakes. Their output is a suggestion for you to check, never a decision made about you. Nothing in the service produces a legal or similarly significant effect about you by automated means alone.

7. Who we share it with

We share information only in these circumstances:

• Service providers who host, store, secure, and process data on our behalf, under contract and only for those purposes.
• People you invite into your own organisation, according to the role and permissions you give them.
• Where you instruct us to, such as connecting an account or sending an accountant package.
• Where we are legally required to, or where it is necessary to establish or defend a legal claim, or to protect anyone’s safety.
• A successor in a merger or acquisition, in which case this policy continues to apply until you are told otherwise.

8. Where it is kept and for how long

Data is stored with our hosting and database providers, which may process it outside your country. Where data leaves a region with data-transfer restrictions, we rely on the safeguards our providers offer.

Financial records and documents are retained for seven years by default, which reflects common record-keeping expectations. Usage signals used to learn your preferences are capped and roll over. You may ask us to delete your data sooner, subject to any legal obligation to retain it.

9. Security

Each organisation’s data is isolated at the database level, not merely hidden in the interface. Access is governed by your role. Documents are stored in encrypted, access-controlled storage. Provider keys and access tokens are held encrypted and are not readable by any signed-in account.

No system is perfectly secure. Keep your credentials safe, and tell us immediately if you suspect a problem.

10. Your rights

Depending on where you live, you may have the right to access, correct, export, delete, or restrict the use of your personal information, to object to certain processing, and to withdraw consent. You may also have the right to opt out of “sharing” for cross-context behavioural advertising, which we do not do at all.

To exercise any of these, write to privacy@bkapp.ai. We will not treat you differently for exercising a right. You may also complain to your local data-protection authority.

11. Children

The service is for business use and is not directed at anyone under 18. We do not knowingly collect information from children.

12. Changes

We will update the version date when this policy changes and ask you to accept material changes. We will not reduce your rights under this policy without your consent.

13. Contact

Questions, requests, or complaints: privacy@bkapp.ai. Operated by BKApp.ai.