Privacy Policy

Effective date: January 1, 2024

Last updated: August 20, 2026 

KEPT Finance LLC ("KEPT," "we," "us," "our") is a North Carolina limited liability company providing accounting, bookkeeping, and financial reporting services. This Privacy Policy explains what information we collect, how we use it, who we share it with, and how we protect it.

This policy covers our website and the software and integrations we operate to deliver our services. It does not cover the practices of third parties whose services we connect to on a client's behalf.

Clients: your engagement agreement with KEPT governs our treatment of your information, including confidentiality obligations specific to that engagement. This Privacy Policy is supplementary and does not replace it. Where the two differ, your engagement agreement controls.
 

• Contact information — name, business name, email address, telephone number, and any message content, when you contact us or submit a form on our website.
• Client onboarding information — information you or your representatives provide when engaging our services.

• Standard server log information such as IP address, browser type, pages requested, and referring page.
• Cookies and similar technologies, where used, for site functionality and basic analytics. You can control cookies through your browser settings.

To deliver bookkeeping and financial reporting services, and only with the authorization of the account owner or an administrator empowered to grant it, we connect to systems our clients use. This is the substance of what we do, and it is described in detail in Section 2.

We do not knowingly collect information from children under 13.

We access client business systems through authorized, scoped connections. Access is granted by the client through each provider's own authorization process, and the client can revoke it at any time.

We connect to QuickBooks Online using Intuit's official API, under an application registered by KEPT on the Intuit Developer Platform. A connection is established only when a company administrator authorizes it.

What we access. Accounting records necessary to prepare and verify financial statements and workpapers, including: the chart of accounts; locations, classes, and departments; journal entries; transactions and transaction registers; financial reports such as the balance sheet, profit and loss, trial balance, and general ledger; company information; and company preferences.

Why we access it. Solely to perform the accounting, bookkeeping, reconciliation, and financial reporting services our client has engaged us to perform — for example, to reconcile a clearing account, to match payment processor payouts against the ledger, or to produce a monthly financial statement package.

What we do not do. We do not access QuickBooks Online data for any purpose other than delivering services to the client whose company file it is. We do not use it to build products, to train machine learning models, or for marketing.

Disconnection. A client may disconnect our application at any time from within QuickBooks Online (Settings → Apps → Disconnect) or by asking us to disconnect it. On disconnection our access tokens are revoked immediately and we can no longer read the company file. Data already retained in our working papers is handled as described in Section 5.

Where a client's business requires it, we connect to e-commerce and payment platforms — including Shopify and payment processors such as PayPal and Amazon Pay — using read-limited credentials, to obtain sales, order, payout, and fee information needed for revenue recognition and reconciliation.

Some of this information may include limited personal information about the client's own customers, such as a name or email address appearing on an order record. We process such information solely as necessary to perform accounting services for the client, and we do not use it for any independent purpose.

We use Google Workspace (including Google Drive and Google Sheets) to store and produce client workpapers, reports, and supporting documentation.

We use information to:

• deliver the accounting, bookkeeping, and financial reporting services our clients engage us to perform;
• prepare, review, and quality-check financial statements, workpapers, and reports;
• communicate with clients and respond to enquiries;
• operate, secure, maintain, and improve our systems;
• maintain records required for professional, legal, regulatory, or tax purposes; and
• comply with applicable law.

We do not use client information to make decisions about individuals unrelated to the services requested.

We do not sell personal information. We do not rent, trade, or otherwise disclose personal information for anyone else's marketing purposes. We have never done so.

Client accounting data is not shared beyond the client that authorized the connection, except as set out below.

We disclose information only:

• To service providers who process information on our behalf under contract, solely to provide services to us, and who are bound by confidentiality and security obligations. Our service providers include cloud hosting, document storage, and software providers necessary to operate our practice. We do not permit them to use the information for their own purposes.
• At the client's direction, or with the client's consent — for example, to a client's lender, auditor, attorney, or tax preparer at the client's request.
• Where required by law — in response to a subpoena, court order, or other lawful demand, or to comply with a regulatory or professional obligation.
• To protect rights and safety — where necessary to investigate suspected fraud, enforce our agreements, or protect the rights, property, or safety of KEPT, our clients, or others.
• In a business transfer — in connection with a merger, acquisition, or sale of assets, subject to the acquirer honoring this policy with respect to information already collected.

We use software automation, and in some workflows artificial intelligence tools, to assist in preparing and reviewing accounting work — for example, to extract figures from statements, to identify discrepancies for human review, or to draft internal analysis.

Where AI tools are used:

• A qualified person reviews the output before it is relied upon or delivered. Automated tools support professional judgment; they do not replace it.
• We use these tools under agreements that do not permit our data to be used to train the provider's models.
• No automated decision producing legal or similarly significant effects about an individual is made without human involvement.

We retain client records for as long as necessary to provide services and thereafter for the period required by applicable professional standards, legal obligations, and record-retention requirements, which may extend for several years after an engagement ends.

Website enquiry information is retained only as long as needed to respond and to maintain a reasonable business record.

When a client disconnects an integration or an engagement ends:

• our access to the connected system ceases and credentials are revoked;
• working papers and deliverables already produced are retained in accordance with the retention requirements described above; and
• on written request, and subject to those requirements, we will delete or return client information in our possession.

Backups may persist for a limited period after deletion, consistent with ordinary backup cycles, after which they are overwritten.

We maintain an information security program with administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, alteration, disclosure, and destruction. Measures include:

• encryption of information in transit and at rest;
• multi-factor authentication on systems that support it;
• access controls limiting information to personnel who need it to perform their duties;
• secure storage of API credentials and access tokens, which are never embedded in application code, published, or recorded in logs;
• read-limited integration credentials, scoped to the minimum access required;
• prompt rotation of any credential that may have been exposed;
• oversight of service providers that handle information on our behalf; and
• staff training on information security and confidentiality.

No system is perfectly secure, and we cannot guarantee absolute security. If a security incident affecting personal information occurs, we will notify affected individuals and the appropriate authorities as and when required by applicable law, including North Carolina's Identity Theft Protection Act and the breach notification laws of other states in which affected individuals reside.

KEPT operates in the United States, and information we collect is processed and stored in the United States by us and by our service providers. If you access our website from outside the United States, you understand that your information will be transferred to and processed in the United States.

• Access and correction. Clients may request access to, or correction of, information we hold about them by contacting us.
• Disconnection. Clients may revoke any integration at any time, directly in the connected system or by asking us.
• Communications. You may opt out of non-essential communications at any time. We may still send communications necessary to deliver services.
• Cookies. You may control cookies through your browser settings.

Residents of certain states may have additional rights regarding personal information, including rights to know, access, correct, or delete it. Where such rights apply to information we hold, we will honor them.

Much of the personal information we handle belongs to our clients' employees or customers and is processed on our clients' behalf and under their instruction. Where we receive a request about that information, we will forward it to the relevant client and assist them in responding, rather than acting on it unilaterally. If we cannot act on a request, we will tell you why and who to approach instead.

To make a request, contact us using the details in Section 12. We may need to verify your identity before responding.

Our website may link to third-party sites, and our services connect to third-party platforms. We are not responsible for the privacy practices of those parties. Their own privacy policies govern their handling of your information — including, for QuickBooks Online, Intuit's privacy policy.

We may update this Privacy Policy from time to time. We will post the updated version at this URL and revise the "Last updated" date. Material changes affecting how we handle client information will be communicated to affected clients directly.

Questions, requests, or concerns about this Privacy Policy or our handling of information:

info@keptfinance.com

We will respond within a reasonable period, and within any period required by applicable law.