Legal
Last updated: September 10, 2026
This policy is provisional and requires final legal review before general availability. If you are evaluating Kelvaro for use with sensitive contractor, tax, or payment data and need finalized legal terms, use the contact channel supplied during controlled-pilot onboarding before proceeding.
When you use Kelvaro, we collect information you provide directly, such as your name, work email address, organization information, and contractor records you enter or request through the product. Contractor records may include names, contact details, work records, payment amounts, and tax information used in W-9 or W-8 workflows and year-end readiness.
We also collect operational and security data such as actions taken, timestamps, device or request information, audit events, and other information needed to operate, secure, support, and troubleshoot the service.
On public marketing pages, Kelvaro may record privacy-minimized acquisition information to understand how people discover the site. These events contain a coarse referral category (for example, a search engine, AI assistant, community site, direct visit, or other source), the public page pathname, and a timestamp. The acquisition event does not store the full referring URL, search terms, cookies, account or user identifiers, email addresses, or the visitor's IP address. Request IP information may be processed transiently into a one-way hash for abuse-rate limiting, but that value is not stored with the acquisition event.
We use information to provide contractor onboarding and operations workflows, maintain records and audit trails, process payout approvals and related payment instructions, track year-to-date amounts and 1099 readiness, provide exports and reports, secure the service, prevent abuse, provide support, and comply with applicable obligations. We also use the privacy-minimized acquisition events described above to understand which public search, AI, community, and referral channels help people discover Kelvaro and which public pages are useful entry points.
Kelvaro does not currently provide live 1099 electronic filing. Tax features are limited to supported W-9/W-8 workflows, threshold monitoring, readiness records, and exports or accountant handoff. We do not sell personal data or use it for cross-context behavioral advertising.
Kelvaro uses Stripe for payment-processing and connected-account infrastructure. Stripe may collect identity, business, tax, bank, card, or other payment information directly from users or contractors under Stripe's own terms and privacy practices. Kelvaro receives provider identifiers, status information, transaction information, and other data needed to coordinate the supported payment workflow, but customers and contractors should provide sensitive payment credentials only through the approved Stripe-hosted or product-integrated flows.
We use service providers that are necessary to operate Kelvaro. Current production providers include, as applicable:
Additional providers may be added as the service changes. We will update this disclosure when a material production data-processing relationship changes.
Kelvaro retains information for product operation, security, payment reconciliation, support, dispute handling, and applicable contractual, tax, recordkeeping, or legal obligations. We do not promise a fixed deletion period in this provisional policy because the final retention schedule is still subject to legal review and technical validation.
During a controlled pilot, request an export or deletion review through the contact channel supplied in the pilot agreement or onboarding materials. Some records may need to be retained when required for financial integrity, tax or recordkeeping obligations, fraud/security investigation, legal claims, or other applicable requirements.
We use technical and organizational safeguards designed to protect the service and sensitive records, including access controls, tenant scoping, audit logging, secret isolation, signed provider webhooks, monitoring, and payment reconciliation controls. No security measure can eliminate all risk, and users should report suspected account or data-security issues promptly.
Controlled-pilot privacy requests should use the contact channel supplied during pilot onboarding. A verified public privacy or support address will be published before broader availability.