Privacy Policy

Last updated: 2026-10-12

This policy explains what personal information KachiFlow handles and why. It goes with our Terms of Service.

1. Who we are

KachiFlow operates the KachiFlow workspace. Contact: info@kachiflow.com. Our privacy officer is Sung Lee, reachable at info@kachiflow.com.

2. Two roles

Account data: this is information about the people who sign in. KachiFlow decides how it is used, as described below.

Client data: this is what a firm puts into the service about its own clients and books. We process it on the firm's behalf and under its instructions. The firm is responsible for having the right to share it with us.

3. What we collect

About people who sign in:

• Name, email address, role, and the firm (company) the account belongs to.
• When the account was created, when you last signed in, and whether it is active or temporarily locked.
• A hash of your password, never the password itself.
• An encrypted authenticator (multi-factor) secret, and a count of recent failed sign-in attempts.
• A hash of each one-time setup link, with its expiry and use times. We do not keep the link itself.
• An activity log: sign-ins, failed attempts, lockouts, sign-outs, changes to accounts and setup links, changes to client records and to who can see them, and attempts to open a client record a user may not see. Each entry has the time, which account did what, and the IP address the request came from. A failed sign-in with an unknown email records that it happened, but not the email typed.
• Request logs kept by our hosting platform: the time, the page requested, the response status, your IP address and browser details.
• Emails you send us.

About people who join the waitlist or ask us to contact them:

• What you type in the form: name, email address, company, what describes you, what you are interested in, what you would like from us, and any message.
• Whether you agreed to receive our build update, when, and the exact wording you agreed to. If you unsubscribe, when.
• The campaign tags in the link you followed (for example which video it came from), the page you came from, and the IP address the form was sent from.
• Our own notes about our conversations with you, and the status of your request.

Client data that a firm enters is described in section 2. We do not collect anything else from your browser, and we do not collect payment card details in the service.

4. Why we use it

To provide and secure the service, to prevent misuse, to keep a record of activity on accounts, and to contact you about your account. If you joined the waitlist or asked us to contact you, we use what you sent to reply, to arrange a call or early access, and to learn which of our videos and posts bring people to us. We send the build update only if you ticked the box for it. We do not sell personal information. We do not use it for advertising or tracking.

5. Cookies and browser storage

We set one cookie: a sign-in session cookie. It is strictly necessary for the service. It is set when you open a sign-in or waitlist form or sign in, it is marked Secure, HttpOnly and SameSite=Lax, and it holds a form-protection token, on the waitlist form when the form was opened and the campaign tags of the link you followed, and, once you sign in, your session details. It lasts until you close your browser, or up to 8 hours once you are signed in, or until you sign out.

Your light or dark display choice is stored in your browser's local storage. It stays on your device.

We use no analytics, no advertising and no third-party cookies.

6. Service providers

We use third-party AI model providers to process content sent to agents. We only use providers whose commercial terms do not allow them to train models on your content. Each provider may keep content for a limited period under its own terms, and longer where required by law or for its own safety review. Where a provider offers a zero data retention arrangement, we intend to use it.

Current service providers:

• Google Cloud (hosting, database, logs)
• Anthropic (AI model processing)

We update this list when providers change.

KachiFlow stores chats, agent runs, approvals and the activity log in its own database, so firms keep a full record. That data is covered by this policy and the firm's agreement.

Some processing happens outside Canada, including in the United States, and may be accessible to authorities there under local law.

7. Retention

We keep account data while the account is active, and afterwards as needed for legal and record-keeping purposes. The activity log is an append-only record: the application does not edit or delete entries. Request logs and backups held by our providers are kept for the periods set in their settings. Client data is kept under the firm's agreement with us, and on termination we make it available for export and then delete it, subject to any law that requires us to keep records. Waitlist and contact requests are kept until you ask us to delete them or we no longer need them to reply to you.

8. Security

Multi-factor authentication is required for every user. Passwords are hashed, authenticator secrets are encrypted, access is limited by role, and activity is logged. No method of protecting information is 100% secure, so we cannot promise absolute security.

9. Your rights

You can ask for access to your personal information, or for it to be corrected, by writing to info@kachiflow.com. You can also ask us to delete a waitlist or contact request. Every build update has a link to unsubscribe. If you use KachiFlow through a firm, we may refer your request to that firm. You can complain to the Office of the Privacy Commissioner of Canada.

10. Breaches

If personal information is breached, we will notify affected people and the Privacy Commissioner of Canada where the law requires.

11. Not for children

KachiFlow is a service for business users only. It is not intended for children, and we do not knowingly collect their information.

12. Changes

We may update this policy. We will change the "Last updated" date when we do.