Privacy Policy

Account data: your name, email address and the business details you enter.

Business records: invoices, bills, ledger entries, payroll data and tax figures you create in the product.

Employee and vendor data you enter, including the last four digits of Social Security numbers and taxpayer identification numbers. We deliberately do not collect or store full SSNs or TINs.

Technical data: IP address, browser type and pages visited, used to keep the service running and secure.

To provide the service you signed up for: keeping your books, computing payroll and preparing tax figures.

To secure accounts, prevent fraud and abuse, and diagnose faults.

To comply with our own legal obligations.

We do not use your business or payroll data to train machine-learning models.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CPRA. There is nothing to opt out of, because we do not do it.

Depending on your state, you have the right to know what we hold about you, to obtain a copy, to correct it, to delete it, and not to be discriminated against for exercising any of these rights.

To exercise any of them, write to privacy@kangarooerp.com. We respond within 45 days, extendable once by a further 45 days where the request is complex, and we will tell you if we need the extension.

We verify identity before acting on a request, because acting on an unverified deletion request is itself a privacy failure.

Some features send a summary of your figures to a third-party language model to generate explanations and suggestions. Only what is needed for that specific request is sent, the provider does not retain it to train models, and every AI feature is optional and clearly labeled where it appears.

Data is encrypted in transit. Passwords are stored hashed with bcrypt and are never recoverable in plain text, by us or by anyone else.

Every US state has a breach notification law. If a breach affects your data we will notify you and the relevant authorities within the deadlines those laws set.

We keep your data while your account is active. After closure we delete it within 90 days unless retention is legally required.

This is a business product and is not directed at anyone under 18. We do not knowingly collect data from children.