Privacy Policy

This Privacy Policy explains how Kestro (“we,” “us”) handles personal data in connection with the Kestro service. For most Customer Data we act as a processor on behalf of your organization (the controller), which decides why the data is processed. For account administration and our own operations, we act as a controller. This policy covers both roles.

We use personal data to provide and secure the Service, process transactions and sync them to your accounting system, enforce your spend policies, communicate with you (including verification and notification emails and SMS), prevent fraud and abuse, comply with legal obligations, and improve the product. We do not sell personal data, and we do not use your Customer Data to train models for other customers.

Where GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent fraud), legal obligation (for example, tax and accounting record-keeping), and consent where required. Where we act as a processor, our processing is governed by our agreement with your organization.

We share data only with service providers who process it on our behalf under contract, and only as needed to run the Service:

• Google Cloud Platform — hosting, database, and AI processing of receipts;
• Firebase Authentication — sign-in and identity;
• Plaid — bank and card account connections;
• Intuit QuickBooks and Xero — accounting sync (only for organizations that connect them);
• Stripe — subscription billing and payment processing;
• Resend — transactional email; Twilio — SMS notifications.

We may also disclose data to comply with law or protect rights and safety, and in connection with a merger or acquisition (with notice). An up-to-date subprocessor list is available on request.

We and our subprocessors may process data in countries other than yours. Where required, we use appropriate safeguards for cross-border transfers, such as Standard Contractual Clauses. Each record in Kestro carries a region tag — the foundation for keeping a customer’s data in a chosen region as we expand.

We retain Customer Data for as long as your account is active and as needed to provide the Service. After termination, you may export your data for a reasonable period, after which it is deleted. We may retain limited records where required for legal, tax, or security reasons. Our audit log is append-only by design and retained to preserve its integrity.

We protect data with tenant isolation at the database (Postgres row-level security), a least-privilege application role, TLS in transit, AES-256-GCM encryption of integration tokens at rest, a tamper-evident audit trail, and separation of internal support access. See our Security & Trust page for details. No system is perfectly secure, but we design for defense in depth.

Depending on your location, you may have rights to access, correct, export, delete, or restrict processing of your personal data, and to object or withdraw consent. Kestro provides self-serve export and deletion of an organization’s data; deletion cascades across our systems. For personal data we control, contact us to exercise your rights. Where we act as a processor, please direct requests to your organization, and we will assist it.

We use strictly necessary cookies to keep you signed in (a secure, HttpOnly session cookie) and to operate the Service. We do not use advertising cookies. Because our cookies are essential to the Service, disabling them will prevent sign-in.

The Service is for organizations and their staff, and is not directed to children under 16. We do not knowingly collect data from children.

We may update this policy from time to time and will notify you of material changes before they take effect. For privacy questions or to exercise your rights, contact privacy@trykestro.com.