Privacy
Policy.

1.1 Scope of this Policy

This Privacy Policy applies to all information collected through our platform at kazu.global, our web application, APIs, and any related services (collectively, the "Services"). It governs how we collect, use, store, share, and protect information about:

• Business customers — companies and organizations that subscribe to Kazu ("Clients")
• Authorized users — individuals granted access to the platform by Clients (e.g., employees, contractors)
• Visitors — individuals who visit kazu.global without creating an account
• Prospective customers — individuals who contact us or request a demo

1.2 B2B Service Model

Kazu is a business-to-business (B2B) platform. When our Clients use the Services, they may input or upload data about their own customers, employees, suppliers, and operations ("Client Data"). Kazu processes Client Data as a data processor on behalf of our Clients, who act as the data controllers of that information. This policy primarily governs data that Kazu collects directly. Client Data is governed by our Data Processing Agreement (DPA) with each Client.

1.3 Governing Law

Kazu Technologies is headquartered in South Florida, Florida, United States. This policy is governed by the laws of the State of Florida and applicable federal law, including the Florida Information Protection Act (FIPA), the FTC Act, and CAN-SPAM Act. Where Clients operate in other jurisdictions (including the EU/UK), additional terms may apply as set forth in the applicable DPA.

1.4 Pilot Phase

Kazu is currently operating in a pilot phase. Our infrastructure, integrations, and data practices — including the QuickBooks Online Integration described in Section 4.2 — are being operated and reviewed at a limited scale as we validate the Service with early Clients. During this phase, data practices are intentionally narrow: we do not use external subprocessors, analytics vendors, or hosting providers beyond Intuit/QuickBooks Online for purposes of the QuickBooks Integration. This Policy will be revised as Kazu's infrastructure and data governance practices mature beyond the pilot, and any material change will be reflected in an updated version with a new Effective Date.

2.1 Information You Provide Directly

Category	Examples	When collected
Account & contact data	Name, business email, phone number, company name, job title	Registration, demo requests, contact forms
Billing information	Company billing address, payment method details (processed via PCI-compliant third parties)	Subscription enrollment
Platform content	Data entered into Kazu modules (inventory records, purchase orders, CRM contacts, etc.)	Ongoing platform use
Communications	Support tickets, emails, chat messages sent to Kazu	Customer support interactions
Survey & feedback	Responses to product surveys, NPS scores, feature requests	When voluntarily provided

2.2 Information Collected Automatically

When you access our Services, we automatically collect certain technical data:

• Log data: IP address, browser type, operating system, referring URLs, pages viewed, timestamps
• Device data: Device identifiers, screen resolution, language settings
• Usage data: Feature usage patterns, session duration, clicks, and navigation paths within the platform
• Cookies and similar technologies: Session cookies (required for authentication), analytics cookies (see Section 6)

2.3 Information from Third Parties

We may receive information about you from third-party integrations you authorize (e.g., QuickBooks, Xero, Shopify), public business directories, or marketing intelligence platforms. We use this information only in accordance with this policy and applicable law.

2.4 QuickBooks Online Data (via OAuth 2.0)

If you choose to connect your QuickBooks Online account, Kazu uses Intuit's OAuth 2.0 authorization flow to obtain a secure access token. We do not collect or store your QuickBooks username or password. Once authorized, and only for tenants that enable the integration, we access and synchronize the following categories of data, strictly to provide the sync features you configure:

• Customer records (QuickBooks Customer objects) and supplier/vendor records (QuickBooks Vendor objects)
• Invoices and bills, including line items and payment/sync status
• Items/products and related pricing information used for invoicing
• Basic tax configuration required to keep invoices and bills consistent between systems
• Connection metadata, such as QuickBooks Realm ID (company identifier), OAuth tokens, sync timestamps, and sync/error logs

This data flows between Kazu and QuickBooks in the directions you configure (Kazu to QuickBooks, QuickBooks to Kazu, or both), as described in the Service's QuickBooks settings.

3.1 Service Delivery

• Providing, maintaining, and improving the Kazu platform
• Authenticating users and managing account access
• Processing transactions and managing subscriptions
• Enabling integrations with third-party services you authorize
• Providing technical support and responding to inquiries

3.2 Communication

• Sending transactional emails (account confirmations, receipts, security alerts)
• Notifying you of product updates, new features, and policy changes
• Responding to demo requests or sales inquiries
• Sending marketing communications, where you have opted in or where permitted by law (you may opt out at any time — see Section 9)

3.3 Security & Compliance

• Detecting, investigating, and preventing fraudulent transactions and abuse
• Enforcing our Terms of Use and other legal agreements
• Complying with applicable law, legal process, or government requests
• Fulfilling breach notification obligations under FIPA and other applicable statutes

3.4 Analytics & Product Improvement

• Analyzing usage patterns to improve platform performance and usability
• Generating aggregated, de-identified analytics reports
• Conducting internal research and development

4.1 Service Providers (Sub-processors)

We engage trusted third-party companies to help us operate and improve the Services. These vendors act as sub-processors and are contractually bound to use your data only as directed by Kazu and to protect it with appropriate safeguards. Categories include:

• Cloud infrastructure: Hosting, database management, and storage services
• Payment processing: PCI-DSS compliant payment processors (we do not store raw payment card data)
• Email delivery: Transactional and marketing email service providers
• Analytics: Product analytics and performance monitoring tools
• Customer support: Help desk and ticketing platforms

4.2 Authorized Integrations

If you connect a third-party service to Kazu (such as QuickBooks, Xero, Shopify, or HubSpot), we will share data with that service as necessary to enable the integration. Your use of those services is governed by their respective privacy policies, over which Kazu has no control.

4.3 QuickBooks Online Integration — Specific Disclosures

Because the Service integrates with QuickBooks Online through Intuit's API, we make the following specific commitments regarding data obtained from QuickBooks:

• Purpose limitation: Data accessed from QuickBooks is used solely to deliver the synchronization features you enable within Kazu (e.g., keeping customers, vendors, invoices, bills, and items aligned between the two systems), and for related support and troubleshooting.
• No sale of data: We do not sell, rent, or trade QuickBooks-derived data to any third party.
• No unrelated sharing: We do not share QuickBooks data with any third party except as strictly necessary to provide the Service (see Section 4.1) or as required by law.
• User control: You control when the QuickBooks Integration is enabled, its sync direction and frequency, and you may disconnect it at any time from within the Service.
• Revocation: Disconnecting the integration in Kazu, or revoking access from your Intuit account, immediately stops further data exchange. During the current pilot phase, we retain previously synchronized QuickBooks-derived data for up to thirty (30) days after disconnection or account closure, solely to allow account recovery, troubleshooting, or reconnection, after which it is permanently deleted from our production systems unless a longer period is required by law or to resolve disputes and enforce our agreements.

4.4 Legal Requirements

We may disclose your information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law or legal process; (b) respond to a lawful request from a government authority; (c) protect the rights, property, or safety of Kazu, our users, or the public; or (d) enforce our agreements.

4.5 Business Transfers

In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business assets, your information may be transferred to a successor entity. We will provide notice of such a transfer and any material changes to this policy.

4.6 With Your Consent

We may share your information in other circumstances with your explicit consent.

5.1 Security Measures

Kazu implements administrative, technical, and physical safeguards designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 or equivalent standards
• Role-based access controls limiting data access to authorized personnel only
• Regular security assessments and vulnerability management
• Secure software development practices and code review procedures
• Multi-factor authentication (MFA) for internal systems

No method of electronic storage or transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5.2 Breach Notification

In the event of a data breach affecting Florida residents, Kazu will comply with the Florida Information Protection Act (FIPA), which requires notification to affected individuals within 30 days of determining that a breach has occurred, and notification to the Florida Attorney General if more than 500 individuals are affected. Affected Clients will be notified as promptly as practicable in accordance with our Data Processing Agreement.

5.3 Data Retention

Data Type	Retention Period
Account & profile data	Duration of account + 3 years after termination
Billing & transaction records	7 years (tax & audit compliance)
Platform usage logs	12 months rolling
Support communications	3 years from last interaction
Marketing opt-out records	Indefinitely (to honor preferences)
Client Data (upon termination)	Deleted or returned within 60 days per DPA
QuickBooks-derived data (upon disconnection)	Up to 30 days during the pilot phase, see Section 4.3

6.1 Types of Cookies We Use

Cookie Type	Purpose	Required?
Strictly necessary	Authentication tokens, session management, security features. The platform cannot function without these.	Yes
Functional	Remembering user preferences (language, display settings, dashboard layouts).	No
Analytics	Understanding how users navigate the platform to improve usability. Data is aggregated and de-identified where possible.	No
Marketing	Tracking effectiveness of marketing campaigns on kazu.global. Not applied within the authenticated platform.	No

6.2 Managing Cookies

You can control non-essential cookies through your browser settings or through cookie preference controls available on kazu.global. Disabling strictly necessary cookies will impair the functionality of the Services.

6.3 Do Not Track

Because there is no industry-standard interpretation of DNT signals for SaaS platforms, Kazu does not currently alter its data practices based on DNT signals. We will reassess this position as standards evolve.

6.4 Third-Party Analytics

We may use third-party analytics services (such as Google Analytics or similar tools) on our marketing website. These services may use cookies and similar technologies to collect information about your use of kazu.global. Their data practices are governed by their own privacy policies.

7.1 Access

You may request a copy of the personal information we hold about you, including information about how it is being used.

7.2 Correction

You may request that we correct inaccurate or incomplete information. Most account data can be updated directly within the platform.

7.3 Deletion

You may request deletion of your personal information, subject to our legal obligations and legitimate business needs (e.g., financial records we are required to retain).

7.4 Portability

You may request your personal data in a structured, commonly used, machine-readable format where technically feasible.

7.5 Marketing Opt-Out

You may opt out of marketing emails at any time via the unsubscribe link in any email, or by contacting us at legal@kazu.global. Transactional and service-related emails cannot be opted out of while your account is active.

7.6 How to Exercise Your Rights

Submit requests to legal@kazu.global. We will respond within 30 days. We may verify your identity before processing sensitive requests.

8.1 Children's Privacy

The Kazu platform is intended for use by business professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected such information, we will delete it promptly.

8.2 International Users

Kazu is operated from the United States. If you access our Services from outside the United States, your information will be transferred to, stored, and processed in the United States. Clients with users in the EU, UK, or other jurisdictions with specific transfer requirements should refer to their Data Processing Agreement with Kazu.

8.3 Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date, notify active Clients via email at least 30 days before changes take effect, and post a notice on our website and within the platform.

8.4 California Residents

If you are a California resident, the CCPA and CPRA may grant you additional rights, including the right to know, delete, and opt out of the sale of personal information. As a B2B platform, most of Kazu's data processing falls under CCPA business-to-business exemptions. Nonetheless, we honor CCPA requests from individuals where applicable. Contact legal@kazu.global for any CCPA-related requests.

9.1 Dispute Resolution

Disputes related to this policy shall be governed by the laws of the State of Florida, with venue in the courts of Palm Beach County, Florida. You may also contact the Florida Attorney General's Office if you are not satisfied with our response to a privacy concern.