Updated 24 October 2026

Privacy at Karu

Wingmen Oy operates Karu. This notice explains how we handle information from the website, waitlist and accounting pilot. Contact info@karu.finance about privacy, access or deletion.

The current pilot

Karu is being tested with invited users. Use synthetic records during this testing phase. It helps organise documents and prepare accounting drafts; an owner must review and approve accounting entries. AI output can be wrong and does not itself make decisions about anyone’s rights or eligibility.

Information we receive

We receive your sign-in email, account and business details, connection identifiers, messages, documents and the explanations or corrections you provide. Accounting records may include names and transaction details of people appearing in your documents. Only provide records you are authorised to share.

Connecting Telegram or WhatsApp associates that private chat with your Karu workspace. We receive messages and files you send to Karu, sender identifiers and delivery information. Connecting a chat does not give Karu access to your other conversations. Forwarding an email sends its contents and attachments to Karu. Disconnecting stops that connection; it does not delete records already received.

How we use information

We use account information to authenticate you, control workspace access and provide the service you request. We use documents and messages to organise records, answer questions, propose accounting drafts and produce reports. We retain your corrections and relevant conversation history to support that work. We use limited security and operational information to prevent abuse and investigate failures.

Providing the requested service is the basis for account and workspace processing. Our legitimate interest in operating a secure service supports abuse prevention and diagnostics. Waitlist updates and optional scheduled reminders depend on your choice to receive them. You can disable reminders in Settings and withdraw waitlist consent by contacting us. We do not sell your information or use customer documents to train our own models.

Providers and processing locations

Our application and database run on Wingmen’s server in Germany. Original documents are stored privately in AWS Frankfurt. Infrastructure providers and authorised Wingmen staff can access information as needed to operate, support and recover the service.

AI processing uses the provider selected for your workspace: Cerebras, OpenAI or Anthropic. Relevant messages, document contents, saved facts and conversation context are sent to that provider to perform the requested task. Some model choices use a separate supported document-reading provider. The AI settings show the text and document choices. Provider processing may occur outside the European Economic Area. We do not promise Europe-only inference, zero provider retention or identical terms across providers; contact us before using personal records if you need specific contractual or transfer safeguards.

WhatsApp messages pass through Meta’s WhatsApp Business Platform, Telegram messages through Telegram, and email through the relevant email services, including Mailchimp Transactional for Karu’s email delivery and receiving. These services handle information under their own terms and privacy notices. Copies in your messaging or email accounts are controlled by those services and their account owners.

Retention

Workspace records remain available during the pilot until you request deletion or we close the workspace. There is no automatic expiry for accounting records. We assess any necessary retention for legal obligations or disputes when handling closure or deletion requests. Contact us to arrange an export before deletion.

Waitlist entries expire after 12 months. Recovery backups can retain deleted information until their expiry, for up to 24 months. Backups are used for recovery, and deletions must be reapplied after a restore. A request to delete data from Karu does not automatically delete copies held in your own chat or email accounts, or change a provider’s retention rules.

Access, correction and deletion

Email info@karu.finance from your account address with the subject “Karu data request”. Tell us whether you want access, an export, a correction, disconnection or deletion of your account and workspace. Do not include passwords or API keys. We will verify that you are authorised before acting and explain any information we must retain. Deletion requests are handled by our team; there is no automated account deletion button yet.

Depending on applicable law, you may request access, correction, erasure, restriction, portability, or object to processing. You can withdraw consent for optional communications. You may also complain to your local data protection authority, including Finland’s Office of the Data Protection Ombudsman. For personal information held in a business workspace on that business’s behalf, contact the business responsible for those records or ask us to help route the request.

Website and waitlist

The waitlist stores your email address, registration date and consent to early-access updates. Joining does not create a paid subscription. Waitlist records are not sent to AI providers. The website uses essential sign-in cookies and short-lived hashed request identifiers for security and rate limiting. It does not use advertising cookies or third-party analytics.

Changes and questions

We will update this notice as the pilot changes. The date above identifies the current version. For questions about a provider, data location or your records, contact info@karu.finance.