Caytava — Privacy Policy
Caytava Inc. (“Caytava,” “we,” “us”) provides an integrated finance platform (accounting/GL, AP/AR, budgeting & planning, CRM, reporting, and an AI assistant), including optional connections to third-party services such as QuickBooks Online, Xero, and bank data providers (the “Service”). This Privacy Policy explains what information we collect, how we use and share it, and the choices and rights you have.
This policy is written to be prominent, accurate, and easy to understand. If you connect a third-party account, please also read Section 4 (“Connected accounts”), which explains our specific commitments regarding data from those services.
1. Who this policy covers
This policy applies to (a) visitors to our websites, (b) users of the Service (“Customers” and their authorized users), and (c) individuals whose information appears in Customer Data (for example, a Customer’s own customers, vendors, or employees). For individuals in category (c): we process that information on the Customer’s instruction to provide the Service; if you have a question about it, please contact the Customer (the business) that uses Caytava.
2. Information we collect
a. Information you provide: account and contact details (name, business name, email, password), billing information, support communications, and any data you enter into the Service.
b. Financial and business data: records you create in, upload to, or connect to the Service — including chart of accounts, transactions, invoices/bills, contacts (customers/vendors), bank and payment details, documents, and payroll-related records — and data ingested from Connected Accounts you authorize (see Section 4).
c. Usage and device data: log data, IP address, device/browser type, and product usage, collected to operate and secure the Service.
We do not intentionally collect sensitive personal information beyond what is necessary to provide the Service (for example, tax identification numbers that appear in accounting records).
3. How we use information
We use information to: (a) provide, maintain, secure, and support the Service; (b) perform the functionality you request, including AI Features (Section 5); (c) process transactions and billing; (d) communicate with you (service messages, and — with any required consent — product updates); (e) detect, prevent, and respond to fraud, abuse, and security incidents; (f) improve and develop the Service, using aggregated/de-identified data where feasible; and (g) comply with legal obligations and enforce our terms.
We process this information based on the lawful bases of performing our contract with you, our legitimate interests in operating and securing the Service, your consent where required, and legal compliance.
4. Connected accounts (including QuickBooks Online) — our specific commitments
When you connect a third-party account (for example, QuickBooks Online, Xero, or a bank data provider), you authorize us to access data from that account. We want to be explicit about how we handle it:
- We access it only as you direct and consent, and only to provide the functionality of the Service to you — for example, to import your chart of accounts and transactions, keep records in sync, and power reporting, budgeting, and AI features you use.
- We are an independent controller of that data and do not process it on the provider’s behalf. When we access data from QuickBooks Online, Xero, or a bank provider, we do so as your service provider, at your instruction and within the scope of your consent — not on behalf of, or as an agent of, Intuit, Xero, or the provider.
- We do not sell this data, and we do not use it for advertising.
- We do not use your financial data from Connected Accounts to train third-party or general-purpose AI models, and we do not share it with AI providers for their own model training.
- You control the connection. You can disconnect a Connected Account at any time in the Service. When you disconnect, we stop accessing new data from that account. You may also request that we delete data previously retrieved from it, subject to the retention limits in Section 8.
- Your use of the third-party service remains governed by that provider’s own terms and privacy policy.
5. AI features
The Service includes AI features (including the “Ask Kate” assistant) that help you draft, summarize, classify, search, and analyze. Our design principles:
- Grounded and human-confirmed. Quantitative answers are grounded in queries against your own data, and consequential actions are proposed for a human to review and confirm before they take effect.
- Model providers as subprocessors. We use one or more AI model providers as subprocessors to operate these features. We share only the data needed to perform the requested task, under contractual confidentiality and security terms.
- No third-party model training on your data. We do not permit our AI subprocessors to use your Customer Data or Connected-Account data to train their general-purpose models.
- De-identified improvement. Where we improve our own features, we use aggregated and de-identified data that does not identify you or any individual, and we keep our operational data separate from any analytics/model-improvement data.
- The website voice assistant. Conversations with the “Talk to Kate” assistant on our public website are anonymous — they are not linked to an account, a login, or your device identity. We store the text transcript of these conversations (not the audio) and review them to improve Caytava and understand what visitors ask about. If you ask Kate to have our team contact you, the contact details you provide are used for that purpose. Audio is processed in real time by our AI subprocessor to power the conversation and is subject to the same no-training commitment above.
6. How we share information
We do not sell personal information. We share information only as follows:
- Service providers / subprocessors who host and support the Service (for example, cloud infrastructure, and — for specific features — AI model, email, and payment providers), under contracts requiring appropriate confidentiality and security. See Section 12 for the current list.
- Connected services you direct us to exchange data with (Section 4).
- Legal and safety: to comply with law or valid legal process, enforce our terms, or protect the rights, safety, and property of Caytava, our Customers, or others.
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
7. Security
We implement administrative, technical, and organizational safeguards designed to protect information, including encryption in transit and at rest for sensitive fields, tenant isolation so one Customer’s data is not accessible to another, access controls, and monitoring. No method of transmission or storage is 100% secure.
8. Data retention and deletion
We retain information for as long as needed to provide the Service, and thereafter as required for legal, accounting, tax, security, and dispute-resolution purposes. You can delete records within the Service, and you can request deletion of your Customer Data (including data retrieved from a Connected Account) by contacting us; we will delete or de-identify it within 72 hours, subject to legal retention obligations.
9. Your privacy rights
Depending on where you live and applicable law, you may have rights to access, correct, delete, or receive a copy of your personal information, to opt out of certain processing, and to be free from discrimination for exercising your rights.
- U.S. (including California / CCPA-CPRA): we do not sell or “share” (for cross-context behavioral advertising) personal information. You may request access, deletion, and correction, and designate an authorized agent, as provided by law.
- Financial data (GLBA): to the extent we handle nonpublic personal financial information, we handle it consistent with applicable financial-privacy law.
- EU/UK (if applicable): if you are in the EEA or UK, you may have rights under the GDPR/UK GDPR (access, rectification, erasure, restriction, portability, and objection), and we will identify the controller and transfer mechanism.
To exercise a right, contact us at privacy@caytava.com. If your information appears in a Customer’s data, please direct your request to that Customer.
10. International data transfers
We are based in the United States and may process information in the United States and other countries. Where we transfer personal information across borders, we use appropriate safeguards as required by law.
11. Children
The Service is not directed to children and is intended for business use. We do not knowingly collect personal information from children under 18.
12. Subprocessors and third-party providers
We use the following categories of subprocessors to provide the Service.
- Cloud hosting / infrastructure: Google Cloud Platform
- AI model provider(s): Anthropic
- Bank data / aggregation: Plaid
- Accounting connections: Intuit QuickBooks Online, Xero (accessed at your direction)
- Payments / payroll: Stripe, Gusto (as applicable)
- Email / communications: Postmark
13. Changes to this policy
We may update this policy. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice (for example, in-product or by email).
14. Contact us
Caytava Inc.
8 The Green # 25854
Dover, DE 19901
Privacy requests: privacy@caytava.com ·
General: support@caytava.com