LAST UPDATED · 3 OCTOBER 2026
Privacy notice
The Karvilo AI service provider is identified in our terms of use. This notice describes this public product website and the private business workspace. Use the contact page for privacy questions or requests.
Information used
The private workspace processes signed-in identifiers, company and staff settings, customer and vendor details supplied by the business, products, stock, sales and purchase documents, receipts, expenses, bank statement entries, accounting records, people and payroll workings, assets, loans, service jobs, production records, tasks and uploaded files. Optional marketplace workflows also process account identifiers, orders, SKUs, fees, refunds, settlements, advertising reports and business-supplied product costs.
Purpose and access
Information is used to operate the workflows you select: billing, inventory, collections, books, reports, planning and business operations. Server-side identity, company membership and action permissions govern access to records and files. The operator can manage workspace access and review audit events for support and operation.
The public website
The public pages show product information and an actual interface screenshot containing illustrative sample records. They cannot access private workspace data. This website adds no advertising or analytics cookies and has no subscription checkout. Hosting services may process technical request information needed to deliver the pages.
Support requests
The support form collects your name, reply email, category, message and acknowledgement. Requests are stored in the support queue and are available to the Karvilo owner for investigation and follow-up. A request reference confirms storage, not email delivery. Technical rate limits use a hashed network identifier and email identifier to reduce abuse. Do not submit passwords, one-time codes, card details or unneeded customer information.
Files and capture
Uploaded files are used for the import, attachment or analysis you request. English PDF/image OCR extracts text locally in the browser for your review. When you save reviewed records or upload source attachments, those records and files become part of the company workspace.
Optional connections
Amazon Seller Central and Ads authorisations are separate. Saved refresh tokens and source archives are encrypted at the application level; tokens are not returned to the browser or included in finance exports. Disconnecting removes the saved token; revoke authorisation with the provider as well to remove provider-side consent. Amazon tax and order imports discard buyer names, addresses, emails and telephone numbers before storing allowlisted finance fields.
Guidance and AI
Guided finance checks use saved figures and calculation rules. Amazon imports and synchronisation do not transmit their records to an AI provider. Optional live AI requires separate activation and follows the record scope shown by that feature. Browser microphone and speech depend on your browser and its permissions; the browser may use its own speech services.
Storage and providers
The application uses Sites hosting with Cloudflare-backed database and object storage. Supabase provides email sign-in; the application also keeps protected sessions in its hosted storage. These providers process information needed to host, authenticate and operate the service. Depending on provider infrastructure and configuration, processing may take place outside your country. Optional Live AI uses OpenAI only when enabled and selected for a request. Optional connections process information within the scope you authorise.
Records, export and deletion
Retention depends on the record type, account status, legal obligations and connected-provider requirements. Do not assume that source reports or attachments will be retained indefinitely. Request correction, export or deletion through support; we may need to verify your authority before acting. Amazon information is subject to its provider retention and deletion rules, including applicable deadlines after revocation or termination. You can export reports and request help with access, correction or deletion. Disconnecting a marketplace account removes its saved token and cancels queued jobs; imported records and approved company journals may require separate handling. Manual book snapshots are a separate recovery tool with their own data scope.
Contact
For privacy requests, contact the Karvilo team through the support page. Share sensitive records through the private workspace or an agreed secure channel. You may also raise concerns with the applicable regulator or authority. This notice will be updated when data handling changes.