Privacy Policy

Who we are

Kalends is a product of Thinkfast Group, LLC, a Texas limited liability company. This policy covers kalends.ai, the public site, and the Kalends application at app.kalends.ai. It is incorporated by reference into our Terms of Service and carries the same version number, because the two are one agreement.

Where a section applies to only one of them, it says so. Everything else applies to both.

Whose data this is

Two different kinds of information reach us, and our role is different for each. This is the most important thing on this page.

Information about you. Your email address on the waitlist, your account, the messages you send us. Here we decide what is collected and why — we are the controller, in the language the GDPR uses — and the rest of this policy describes what we do with it.

Financial data your practice uploads. The ledgers, statements, and budgets you bring into the application are yours. We hold and process them on your instructions, to produce the reports you asked for, and for nothing else. Here your practice decides what is collected and why, and we act on its behalf.

That distinction matters most for the people whose figures sit in a ledger without ever having used Kalends — your clients, their customers, their employees. They are not our users and we have no relationship with them. If one of them asks what is held about them, the answer sits with the practice that uploaded it, and we will help that practice answer rather than answer over its head.

We are a filing cabinet you own, not a filing cabinet we own and let you use.

What we collect

Information you give us

On kalends.ai, one thing: the email address you enter to request early access. We ask for nothing else — no name, no company, no phone number, no password, and no payment details. If you email us directly, we hold that message and your address so we can reply.

In the application, what an account needs: your name and email address, your sign-in credentials, whether you have enrolled in two-factor authentication, the practice you belong to, and who invited you.

What your practice uploads

In the application, ledgers, statements, budgets, and figures — uploaded directly or pulled from a connected accounting system — together with everything the application derives from them: account classifications, reports, reconciliations, ratios, forecasts, and written commentary.

This is financial data about companies, and some of it is personal information about people: a supplier’s name, an employee reimbursement, a customer’s payment history. We do not go looking for it, and the application does not use it to build a profile of anyone. It is held because it is in the books you gave us.

Information collected automatically

The site is served as static files by Firebase Hosting, part of Google Cloud. Like any web server, it records ordinary request data: IP address, browser and device type, referring page, and the pages fetched. We use this to keep the site running and to understand load. It is not linked to your email address. The application records the same kind of request data on the same infrastructure.

Typefaces are served from this site, not from a font network. Loading a page here sends no request to Google Fonts or to any other third-party host, so no separate disclosure of your IP address is made to one.

Analytics

On kalends.ai we use Google Analytics (Google Tag) to collect aggregated, anonymized request data to understand site usage and performance. This helps us optimize site performance and user experience. It is not linked to your email address, and it does not run over your practice’s financial data.

What we do not do

• We do not sell, rent, or trade your information, and we never will. There is no version of this business that is funded by selling a finance leader’s contact details.
• We do not track you across unrelated third-party websites.
• We do not use one practice’s data to serve another.
• We do not use your clients’ financial data to train models.

How we use it

Your email address is used to notify you when Kalends opens for access, to reply if you have written to us, and for nothing else. We do not add waitlist addresses to a marketing list, and we do not send unrelated mail.

Account information is used to sign you in, to keep your practice’s membership right, and to reach you about the service — a security notice, a change to these documents, or a problem with your data.

What your practice uploads is used to operate the application for you: to classify accounts, produce reports, reconcile statements, generate insights, and show you your own history. That is the whole list.

Request data is used to operate and secure the site and the application, and to meet legal obligations where they apply.

Application only

AI processing

Some Kalends features use AI models to classify accounts, draft commentary, and summarize insights. Where they do, figures from your reports are sent to third-party model providers to produce that output.

This is off unless your practice turns it on. The setting is practice-level, disabled by default, and the owner controls it. While it is off, nothing from your books reaches a model provider.

We send figures, not narrative context you have not asked us to send. We send your data only to providers whose terms prohibit using it to train their models. We do not name those providers on this page; we will tell you who they are if you ask.

Application only

Connected accounting systems

You can connect Kalends to QuickBooks Online, Xero, or MYOB. When you do, we read the data needed to produce your reports and hold it exactly as we hold anything else you upload.

The connection is authorized by you and can be revoked by you, in the application or from the accounting platform itself. Disconnecting stops future syncs; it does not delete what has already been imported. Ask us and we will delete that too.

Where it goes

Waitlist submissions are processed by Firebase, sent through Resend, and stored in an internal Thinkfast Group mailbox. Access is limited to people at the company who need it.

Application data is stored on managed Google Cloud infrastructure. Inside Kalends, access is limited to the people who need it to run or support the service, and looking at a practice’s books is something support does at your request rather than as a matter of course.

We share information with service providers who operate parts of Kalends on our behalf — hosting, email delivery, error reporting, and, where your practice has turned it on, AI model providers — and only to the extent they need it to provide that service. We may also disclose information where the law requires it, or to protect our rights or the safety of others. Nothing else is shared.

If Kalends is ever sold or merged, information would move with the business. We would tell you before that happened, and this policy would keep applying until it was replaced by one you had the chance to read.

How long we keep it

We keep waitlist addresses until launch, and then for as long as you remain interested in hearing from us. Ask us to delete yours at any time and we will, without asking why.

In the application, we keep your data while your account is active, and you can export it at any time. When you close your account we delete it within 90 days, except where we are required to keep something longer, and except for backups which age out on their own schedule.

Server logs are retained on our provider’s ordinary schedule.

Your choices and rights

You can ask us to show you what we hold about you, correct it, or delete it. Email hello@thinkfastgroup.com and we will act on the request. Every email we send carries an unsubscribe link, and unsubscribing removes you from the list entirely rather than pausing it.

If your information is in the application because a practice put it there, that practice decides what happens to it. Ask them, and we will help them answer. We will not delete or change a practice’s data on the instruction of someone outside that practice — that protection is the point, and it applies even when the request is a reasonable one.

Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA — including the right to access, correct, delete, or port your data, to object to processing, and to complain to a supervisory authority. We honor these requests wherever you are, not only where they are mandatory.

Children

Neither the site nor the application is directed at anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, write to us and we will delete it.

Security

The site and the application are served over HTTPS, and data is transmitted encrypted and stored on managed Google Cloud infrastructure. Your practice’s owner can require two-factor authentication for everyone in it, and we would rather they did. No method of transmission or storage is perfectly secure, and we do not claim otherwise.

Links to other sites

Where we link to a site we do not operate, that site’s own privacy practices apply. We are not responsible for them.

Changes to this policy

We may update this policy as the product develops. The effective date and version at the top reflect the current version, and they track the Terms of Service because the two are one agreement.

Material changes affecting people already on the waitlist are sent by email rather than posted quietly. For the application, we put a material change in front of you to accept before you carry on using it, and we record which version you accepted and when.

Contact

Thinkfast Group, LLC — hello@thinkfastgroup.com