Kinshiro Privacy Policy#

Effective date: 05/11/2026 (DD/MM/YYYY) Last updated: 05/11/2026 (DD/MM/YYYY)

1. Who we are#

Kinshiro is a web service for bookkeeping firms that work on the accounting systems of their clients. It is provided by Kinshiro LLP, a limited liability partnership registered in India ("we", "us"); the web service it provides is called Kinshiro.

• Registered address: #16, 2nd Cross, SRK Garden, Jayanagar, Bangalore, Karnataka 560041
• Privacy and support contact: Support@kinshiro.com.

This policy covers the Kinshiro web app at app.kinshiro.com and the emails and pages Kinshiro sends. It does not cover the accounting systems you connect to Kinshiro. Their own privacy statements apply to them.

2. Our role#

• Client books data is the information a customer puts into Kinshiro or connects to it. For this data we are a service provider (processor) for the firm that subscribes to Kinshiro (the "customer"), and we use it only to run Kinshiro for that customer.
• Account, billing and security data is information about the people who use Kinshiro and the customer's subscription. For this data we are the controller.
• If a customer's instructions conflict with the choices of the owner of a connected company, or with a connected platform's terms, we follow the company owner's choices and the platform's terms.

If you are a CPA firm or client company whose data is in Kinshiro, the bookkeeping firm that uses Kinshiro is your first contact for privacy requests (section 14).

The customer decides what data to put into Kinshiro and is responsible for having the right to do so, for giving notices to and getting consents from its users, CPA firms and clients, and for the accuracy of that data. We act on the customer's instructions. This policy describes our practices; it is not a promise or warranty. Our responsibilities are in the Terms and, to the extent the law allows, our liability is limited as stated there. We are not responsible for the privacy practices of connected platforms or other services the customer uses.

3. What we collect#

Platform data. When an authorized person connects a company from an accounting system (for example QuickBooks Online or, as they are added, other accounting systems), we read the information Kinshiro needs to do the work: company details, accounts, vendors, customers, past transactions, and the entries Kinshiro posts so we can check they arrived. Platform data means this information and anything made from it, such as rules and choices learned for that client.

Uploaded files. Bank and card statements and similar files that the customer's staff upload, and the lines read from them.

Account data. Name, work email, a securely stored password, sign-in codes, session records, the IP address and browser used to sign in, and a device identifier that lets us recognise a browser we have seen before.

Client contacts. Names and emails of people at client companies and CPA firms, used to send messages the customer chooses to send.

Activity records. Records of important actions in Kinshiro, and counts of active clients and transactions for invoicing (section 12).

Technical data. Basic records needed to run and protect the service, such as request times and error codes.

Staff time entries. Time and notes that users enter themselves. We do not monitor what staff do on their computers.

We do not collect payment-card data from client companies. Kinshiro may in future offer features that work with a customer's email. We will ask for separate consent and update this policy before any such feature is used.

4. Connected systems#

• We ask a connected system for the smallest permission Kinshiro needs.
• We use platform data only to provide Kinshiro to that customer for that client company.
• A person at the customer approves entries (or the customer has switched on an automatic approval rule) before Kinshiro posts them to the connected system. Kinshiro does not create accounts there.
• We do not sell platform data, use it for advertising, or process it on a platform's behalf.
• We read a connected system only to do work for that client (for example at set-up, on an upload, an approval or a post, or when a person asks us to check), not to copy whole companies on a schedule.
• We record when each connection was made and which link or staff member made it, so we can show it if asked.

5. How we use data#

We use data to provide, secure and support Kinshiro; let the customer's people review and approve work; send the emails the customer has asked for; bill the customer; and keep records and respond to lawful requests. We do not run advertising and we do not sell data. We do not use customer data to train AI models.

Our staff can see a client's data only if the customer approves a support request, each time. Direct access to production systems is limited to the owner and a system administrator for maintenance and emergencies.

6. AI#

Kinshiro uses third-party AI providers to suggest categories for statement lines and provide useful insights. A person reviews every suggestion before anything is posted.

• Each request carries information from one client only.
• We do not use customer data to train AI models. Providers may keep inputs for a limited time under their own terms, for example for safety and abuse monitoring; we have not obtained zero-retention terms.
• Kinshiro shows where each value came from, including AI suggestions. We do not use AI for lending, credit or decisions about a person.

7. Who we share data with#

We share data only with services that help us run Kinshiro, only for that purpose and only what each needs:

We use these services under their standard terms and privacy policies, which we have accepted, and each is bound by its own data-processing terms. The list of named providers is available to customers on request.

We may also share data when the law requires it; with a connected platform, or an auditor it approves, when it audits our use of its data or investigates a security incident; and in a merger or sale, with the same protections. We do not share a customer's data with other customers.

8. Built-in vendor list#

Kinshiro uses a built-in list of common vendors and general categories. It contains no customer data and does not learn from customers' data.

9. International transfers#

Customer data is stored on servers in the United States. People who use Kinshiro, including customer staff and our staff, may work from India and other countries and so can see data from there. We do not promise that data never leaves the United States.

10. How long we keep data#

11. Disconnecting#

You can disconnect at any time, in the connected system or in Kinshiro. We then revoke our access, stop using that company's platform data, and delete it as in section 10. If you reconnect within the 7 days the deletion is cancelled; later, Kinshiro starts afresh. We stop as soon as we learn the connection has ended: at once when you disconnect in Kinshiro, and at the latest the next time we try to use the connection when you disconnect elsewhere.

12. Security#

We protect data with measures that suit its sensitivity: encryption in transit and at rest; encrypted storage of the credentials that connect Kinshiro to other systems, with access restricted; separation between customers and between clients; access controls and monitoring; and staff access to client data only as in section 5. Sign-in uses a password and, on new devices, a one-time code sent by email. No system is perfectly secure and we cannot promise it.

12A. Activity records#

We keep records of important actions (for example sign-ins with IP address and browser, user and permission changes, uploads, connection changes and review decisions) to protect data, show who did what and settle disputes. Records are kept 7 years (longer where a legal claim or law requires) without client data values, and are seen by the customer's administrators, by our staff with approval, and by authorities, platforms or auditors when required. We may also use them to investigate an incident or protect ourselves in a dispute. An IP address is personal data; we use it only for security and evidence.

13. If something goes wrong#

If we learn of unauthorized access to personal or platform data we will tell the affected customer without undue delay, and within 48 hours of becoming aware that it has compromised the customer's data, with what we know and what we are doing. The customer decides what to tell its own clients, except where the law or a platform requires us to notify affected company owners or individuals directly. We notify a connected platform within the time its terms require.

14. Your rights#

Depending on where you live you may have rights to access, correct, export or delete personal data we hold about you. Kinshiro users: email Support@kinshiro.com. People at client companies and CPA firms: contact the firm that uses Kinshiro first; if you cannot, email us. The owner of a connected company can always ask us directly to disconnect and delete its platform data.

15. Staff time notice#

Users may enter their own work time and notes; this is used for the work reporting of the customer that employs them.

16. Cookies#

Kinshiro uses only cookies that are strictly necessary or store display preferences. It uses no advertising or analytics cookies.

17. Children#

Kinshiro is a business service, not for anyone under 18.

18. Changes#

We will post changes here, update the date, and tell customers by email at least 30 days before a material change takes effect. We will tell each connected platform of changes its terms require us to tell it about.

19. Contact#

Privacy and support: Support@kinshiro.com. Complaints and grievances (India): write to Support@kinshiro.com; we acknowledge a complaint within 3 business days and resolve it within 30 days. Post: #16, 2nd Cross, SRK Garden, Jayanagar, Bangalore, Karnataka 560041.