Privacy policy

1. Who we are

Klayim is a financial-signal tool for founders. This policy explains what personal data Klayim collects, how it is used and shared, how long it is kept, and your rights under the GDPR. For any privacy question or request, email contact@myx.family.

2. What we collect

Your account and settings: your name and email address; the time zone and language setting recorded when you sign up; and the details and settings you enter, such as your country, hourly rates, business entities, budgets and email preferences. If you add team members, we store their names, email addresses and hourly rates. If you record clients, we store their names.

Bank and brokerage data: when you connect an account, we store a copy of the account and transaction records that Enable Banking or Plaid sends us. What these records contain depends on your bank, and can include: your details as your bank holds them (the account holder's name and postal address, your role on the account, and the names of any joint holders or additional cardholders); account details (name, type, number or IBAN, bank, balance and credit limit); transaction details (amounts, currencies, dates and times, status, the balance after each transaction, reference numbers and category codes); the people and businesses you pay or are paid by (their names and, where the bank provides them, addresses, account and bank details and contact details); payment messages, which can contain anything the sender wrote; merchant and location details, including for some card payments the address or map location of the shop; and, for brokerage accounts, the securities you bought or sold, with quantities, prices, fees and dates. Individual holdings are read to calculate the account balance but are not stored.

Other connected services: if you connect Stripe, your open invoices (including your customers' names and email addresses) and upcoming payouts are read when you view them and are not stored; we store your Stripe account identifier and the VAT totals we calculate from your paid invoices. If you connect Linear, we store your workspace name, your Linear display name and the names, dates and status of your projects; issues are read when you view them and are not stored. Google Calendar is described in section 7.

Information we derive: the signals we calculate, what you do with them, recurring charges we detect as possible subscriptions, daily liquidity figures and records of each bank sync.

Requests you send us: what you write in the agency form, the budget range you choose, the phone or WhatsApp number you give us if you choose that contact method, and any file you attach. Emails you send us, to our support address or through Help & feedback in the app, are received in our team's mailboxes.

Payments: payment is handled by Stripe, which collects your card details and email address. We record that you have paid and your purchase number. We do not receive or store your card details.

How the app is used: we record when a session starts and ends and which of the six tabs you open. We do not record what you click inside a tab, any figures, or the content of your data. These records are kept for 180 days and are deleted with your account.

3. Read-only access

Klayim requests read-only access from every provider: account information from your bank, read access to invoices, payouts and account events in Stripe, and read access to your Linear workspace and Google Calendar. It cannot move money or make payments. Apart from setting up the connections you ask for, the only action Klayim takes at a provider is to end its own access when you disconnect a service or delete your account.

Where a provider issues Klayim an access token — Plaid, Linear and Google — we store it in Google Secret Manager, not in our database. Enable Banking and Stripe do not issue Klayim a token for your account: for Enable Banking we store the session and account identifiers needed to request your data, and for Stripe your account identifier.

4. How we use it

We use your data mainly to provide the product: calculating your signals, showing your accounts and activity, and operating and supporting the service. We do not sell your data, and we do not use it for advertising.

We email you to send your sign-up code, password-reset links, your purchase receipt and the notice that confirms an account-deletion request. We also send a daily brief and a weekly summary, which are on when you sign up; you can turn either off in the app's notification settings.

We also use the total balance of the accounts you connect for one purpose beyond providing the product: to see which accounts are the largest, so that we can decide where support and product effort go first. Our team sees this as a list of accounts ordered by that total, as described in section 6. You have the right to object to this use; to do so, email us at the address in section 9.

5. Where it is stored, and who receives it

Your data is stored on Google Cloud (Firebase) infrastructure in the United States. If you are in the EU, EEA or UK, this means your data is transferred outside that area.

We share personal data only with these service providers, and only what each needs for its part: Google Cloud (Firebase), for hosting, database, file storage, sign-in and secret storage; Plaid, which connects banks and brokerages in the United States (its connection window runs in your browser when you use it); Enable Banking, which connects banks in the EEA; Stripe, which processes your purchase and, if you connect your Stripe account, provides read access to it; Linear and Google Calendar, only if you connect them and only with read access; and Resend, which sends every email Klayim sends and receives your email address and the content of each email.

Requests you send through the agency form, including any file you attach, and emails you send us are delivered to our team's email accounts.

6. When our team can see your account

To answer support questions and keep the service running, Klayim staff can look up your account. They can see your name and email address, when you joined and were last active, whether you have finished setting up and paid, whether you have asked to delete your account, and, for each connection, the provider, the bank's name, its status, when it last synced and any error it returned. They can also see requests you have sent through the agency form, including any file you attached, one balance figure per connection, the total across your account, and a list of accounts ordered by that total.

These support tools do not show your transactions or the contents of your signals; that limit is built into the software. Opening an individual account or agency request in these tools is recorded — who looked, whose account and when. The record is written before anything is shown; if it cannot be written, the lookup still goes ahead and the failure is logged. Access to the tools is limited to an explicit list of staff accounts.

Separately, the people who administer Klayim's Google Cloud project have technical access to the underlying systems, including the database, in order to operate, maintain and secure the service. That access is not limited in the way the support tools are.

7. Google Calendar

Klayim's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect a calendar, we read the title, time, link and attendees of the events in the period you are viewing, so that the app can show how your time is committed and what each meeting costs. We show each attendee by name, or by their email address where your calendar has no name for them. Event titles and attendee details are shown while the page is open and are not stored.

For each meeting we keep a record so the product can tell you what cancelling it gave back: the event's identifier, the identifier of the calendar it is in, its start and end times, how many people were invited, its status, and the cost calculated from the hourly rates you entered. We also keep the email address of each Google account you connect, the names and identifiers of its calendars, and which tab you show each calendar on. A calendar's identifier is often an email address, including for calendars other people have shared with you.

8. How long we keep it

While your account is open, we keep your data for as long as the account exists; signals are calculated from your full history, so older records are not deleted on a fixed schedule. Bank data continues to sync for as long as the connection is active. Usage records are kept for 180 days.

Disconnecting a service stops Klayim reading new data from it; data already imported stays until you remove it or delete your account. For Plaid, we ask Plaid to close the link to your bank and delete our stored access token once Plaid confirms it; if Plaid does not confirm, the app tells you. For Linear and Google Calendar, we delete our stored access token and ask the provider to revoke Klayim's access, but we cannot confirm that the provider has done so. For Stripe, we ask Stripe to uninstall the Klayim app; if that does not succeed, the app tells you and you can uninstall it in your Stripe Dashboard. For Enable Banking, we stop requesting data but do not ask Enable Banking or your bank to withdraw the consent you gave; Klayim requests access for no more than about 90 days, and you can withdraw the consent sooner with your bank.

Removing a bank in the app deletes the connection, its accounts and every transaction imported from it.

You can ask to delete your account at any time in the app. This starts a 90-day waiting period, during which your account keeps working, your banks keep syncing, and the daily and weekly emails stop. We send an email with the deletion date and how to cancel. You can cancel at any time during the waiting period: your account and data stay as they are, and the daily and weekly emails resume according to your notification settings. After it, deletion runs in two stages and can take several days or longer, so we cannot promise a finishing date: first we close your Plaid bank links (if we no longer hold any credential for a link, we cannot ask Plaid to close it: deletion continues, and our team keeps Plaid's identifier for that link so it can follow up with Plaid; you can still cancel at this stage, but closed links stay closed and need reconnecting); then we delete your data, delete the access tokens we store, ask Stripe, Linear and Google to end Klayim's access, and remove your login. Once that second stage has started, the request cannot be cancelled, and completed deletion cannot be undone. Deleting your account does not withdraw your Enable Banking consent.

Some records are not removed when your account is deleted: records of staff looking up your account; if a payment reaches us while your account is being deleted, a record of that payment, kept so that our team can deal with it; if we could not ask Plaid to close a bank link because we no longer held a credential for it, Plaid's identifier for that link and the record of why, kept so that our team can follow up with Plaid; our service logs, which can include your account identifier and are kept for 30 days; emails already sent, including agency requests and support emails; and records held by Plaid, Enable Banking, Stripe, Linear, Google and Resend under their own policies. We do not currently make backups of our database. How long our service providers keep data after it is deleted is set by their own policies.

9. Your rights

Under the GDPR you can access, correct, export or delete your data, and object to or restrict processing. In the app, under Settings → Data & Privacy, you can request deletion and download your transactions; your accounts and connections; your signals, and the actions you took on each of them; your business records; your investment activity; and your meeting records. For a copy of anything else, or to exercise any other right, email contact@myx.family.

You also have the right to lodge a complaint with a data protection supervisory authority in the country where you live or work, or where you believe the issue occurred.

10. Cookies and browser storage

Neither this website nor the Klayim app sets cookies. The app keeps your sign-in session in your browser's storage, and keeps the progress of connecting an account there for the length of the browser session. When you connect a US bank, Plaid's connection window runs in your browser under Plaid's own policies.

11. Changes

When this policy changes, the "last updated" date at the top of this page changes with it.

12. Contact

Questions about your privacy or this policy? Email contact@myx.family.