Privacy Policy
Caveat analyses financial statements. The statements you upload are kept as they are — section 3 sets out why and for how long. This policy sets out what else is collected, when, and what it is used for. Effective 2026-10-01.
1. The standard this policy is held to
Caveat handles personal data to the standard of the General Data Protection Regulation (GDPR). It currently operates from Korea and is also subject to the Korean Personal Information Protection Act.
- Where the two laws set different deadlines, the shorter one applies. A request from you is answered within the Korean 10 days rather than the GDPR's one month.
- Everything else follows whichever is better for you.
2. Controller and contact
| Service | Caveat (케비엇) |
|---|---|
| Controller | (to be filled after business registration) |
| Representative | (to be filled after business registration) |
| Business registration no. | (to be filled after business registration) |
| Address | (to be filled after business registration) |
| Privacy officer | (to be filled after business registration) |
| EU representative | (to be filled after business registration) |
| Contact | [email protected] |
Every privacy question and request goes to [email protected].
3. What happens to the statements you upload
- The files you upload are kept as they are. They are needed to produce several reports from the same statements and to let you reopen them later, and to check what went wrong if you tell us a figure was misread. This is processing necessary to provide the service, so no separate consent is asked. Some uploaded files may be used to improve the quality of the service.
- The documents are not altered. They are filing and disclosure documents, and removing even one page would make them a different document. If there is a part you would rather not upload, cover it before uploading.
- The content passes through the Google Gemini API. Reading the figures out of the document and writing the report text is done by that API.
- Caveat uses the paid tier of the Gemini API. Google does not use content submitted to the paid tier to improve its products, and does not train on it. It is logged only for a limited period to detect abuse, and within that scope Google acts as Caveat's processor. See the Gemini API terms.
- Reports are not stored on the server. Close the page and the result is gone.
If your statements contain names or national identification numbers, please redact them first. Caveat needs the figures.
4. What is collected
An account is required from the "read a financial statement" step onwards. Earlier steps — choosing a report, viewing the sample result — work without signing in, and collect none of the below.
| When | Data | Required? |
|---|---|---|
| Sign-up and sign-in | Email address, sign-in identifier (Firebase UID), sign-up time, last sign-in time | Required |
| Role question after sign-up | The role you pick (owner, family business, founder, other) | Optional — you can skip it |
| Uploading a statement | The file and the figures in it | Required (storage: see section 3) |
| When you correct a figure on the review screen | The figure we read, the figure you entered, and where it sits (form, account, period) | Nothing is recorded unless you change something |
| If you accept analytics | Navigation and click events, session recording (financial statement content is always masked), an anonymous browser identifier, IP address, and device information such as browser, operating system and screen size | Optional — every feature works if you decline |
| When you answer the consent banner | Whether you accepted, the version of the wording shown, language, IP address, anonymous identifier | Required — the record that consent was given |
Passwords are never stored on Caveat's servers. Email and password sign-in is handled by Google Firebase Authentication; Caveat receives only the result. Signing in with Google passes on your email address only.
There is no payment function, so no card or bank account details are collected. No special category data under Article 9 is collected.
5. Legal basis for each use (GDPR Article 6)
| Use | Basis |
|---|---|
| Creating and using an account; analysing statements and producing reports | Performance of a contract — Art. 6(1)(b) |
| Keeping uploaded files — so reports can be produced and reopened | Performance of a contract — Art. 6(1)(b) |
| Using uploaded files and your corrections to improve the reading rules | Legitimate interests — Art. 6(1)(f). Real forms, and corrections telling us how a figure should have been read, are what makes the reading rules better. You may object to this purpose (section 9) — email [email protected] and we delete your corrections and stop recording them |
| Product analytics (PostHog); the role question | Consent — Art. 6(1)(a) |
| Security, preventing abuse and misuse | Legitimate interests — Art. 6(1)(f), balanced against your rights and limited to the minimum |
| Keeping the record that consent was given | Legal obligation and accountability — Art. 6(1)(c), Art. 5(2) |
Consent can be withdrawn at any time. Withdrawal does not make earlier processing unlawful, and no further processing takes place afterwards. Declining consent leaves the analysis features fully usable.
6. Why it is used
- To analyse statements and produce reports — the service itself.
- To keep you signed in and identify your account.
- To learn which people use which reports, and improve the screens and wording (role, analytics).
- To produce several reports from one statement, and to let you reopen them later.
- To improve extraction accuracy. Real forms are what makes the reading rules better.
- To evidence that consent was obtained (consent log).
Nothing is used beyond these purposes. If a purpose changes you will be told, and consent will be sought again where consent is the basis.
7. How long it is kept
| Data | Retention |
|---|---|
| Account data (email, role, sign-in times) | Thirty days after a closure request. Signing in within those 30 days cancels the request and we keep the data |
| Uploaded files | Thirty days after a closure request, and in any case three years after the last upload. Deleted without delay, ahead of the 30 days, if you require it by email |
| Corrections you made on the review screen | The same as uploaded files — until you close the account, and three years after the last upload |
| Consent log | 3 years |
| Analytics data | Up to 12 months of event data in PostHog |
| Uploads without consent, and reports | Not kept on Caveat's servers (for the Gemini API, see section 3) |
Caveat does not collect server access logs of its own; they may exist briefly in the hosting provider's operational logs.
8. Processors and transfers
Caveat relies on the processors below. Each is engaged under an Article 28 processor agreement that forbids use beyond Caveat's instructions. Transfers outside the European Economic Area rest on an adequacy decision or on Standard Contractual Clauses under Chapter V.
Transfer happens when you use the corresponding feature, over encrypted connections.
Google LLC
| Country | United States |
|---|---|
| Purpose | Gemini API — reading figures from uploaded statements and writing report text. Firebase Authentication — sign-in and password storage. |
| Data transferred | The contents of the uploaded statement (Gemini); email address and sign-in records (Firebase) |
| Retention | The paid Gemini API tier logs content only briefly to detect abuse and does not use it for product improvement or training. Firebase account data is deleted when the account is closed |
| Transfer safeguard | EU Standard Contractual Clauses and the EU–US Data Privacy Framework |
| Contact | policies.google.com/privacy |
Fly.io, Inc.
| Country | Germany (Frankfurt) |
|---|---|
| Purpose | Application hosting |
| Data transferred | All requests passing through the service |
| Retention | Not stored after processing (may appear briefly in operational logs) |
| Transfer safeguard | Processing takes place inside the EEA (Frankfurt); access from the US parent is covered by EU Standard Contractual Clauses |
| Contact | fly.io/legal/privacy-policy |
Neon (Databricks, Inc.)
| Country | Singapore |
|---|---|
| Purpose | Database for account records and consent logs |
| Data transferred | Email address, role, sign-in records, consent log (including IP) |
| Retention | As set out in section 5 |
| Transfer safeguard | EU Standard Contractual Clauses |
| Contact | databricks.com/legal/privacynotice |
Cloudflare, Inc.
| Country | United States (global network) |
|---|---|
| Purpose | Domain and network, storage of uploaded files (R2) |
| Data transferred | Incoming requests; the files you upload |
| Retention | Thirty days after a closure request, or three years after the last upload. Deleted without delay if you require it by email before then |
| Transfer safeguard | EU Standard Contractual Clauses and the EU–US Data Privacy Framework |
| Contact | cloudflare.com/privacypolicy |
Resend, Inc.
| Country | Japan (Tokyo) |
|---|---|
| Purpose | Sending notification email to the operator (figure corrections) |
| Data transferred | The corrected positions and their figures, and the upload identifier. Company name, business registration number and email address are not sent |
| Retention | Delivery logs follow the Resend retention policy; Caveat keeps no copy |
| Transfer safeguard | Japan holds a European Commission adequacy decision (2019), so no additional safeguard is required. Access from the US parent is covered by EU Standard Contractual Clauses |
| Contact | resend.com/legal/privacy-policy |
PostHog, Inc.
| Country | European Union |
|---|---|
| Purpose | Product analytics, only where you consented |
| Data transferred | Navigation and click events, session recording (content masked), anonymous identifier, IP address, browser and device information |
| Retention | Up to 12 months for event data |
| Transfer safeguard | Processing takes place inside the EU |
| Contact | posthog.com/privacy |
Only what each processor needs is transferred: PostHog never receives statement content, the Gemini API never receives your email address, and the notification email (Resend) never carries a company name or business registration number.
Caveat itself currently operates from Korea, a country covered by the European Commission's adequacy decision (2021), so transfers from the EEA to Korea need no further safeguard.
Analytics (PostHog) can be declined in the consent banner, and everything still works. The rest is necessary to provide the service, so declining it makes the service unusable.
Apart from the above, personal data is neither sold nor disclosed to third parties, other than where law enforcement requires it through lawful process.
9. Your rights
The rights in Articles 15 to 22 are given to every user, whether or not you live in the EU.
| Right | What it means |
|---|---|
| Access | See what data is held and how it is processed (Art. 15) |
| Rectification | Have incorrect data corrected (Art. 16) |
| Erasure | Have data deleted (Art. 17, "right to be forgotten") |
| Restriction | Have processing paused while data is retained (Art. 18) |
| Portability | Receive what you provided in a machine-readable format, or have it sent elsewhere (Art. 20) |
| Objection | Object to processing based on legitimate interests (Art. 21). Asking that your files not be used to improve the reading rules falls here — your reports are unaffected |
| Withdrawal | Withdraw a consent already given (Art. 7(3)) |
Write to [email protected] and it will be handled within 10 days — the GDPR allows a month, but Caveat applies the shorter Korean deadline to everyone. There is no charge.
Analytics consent and account closure are both in the ⋯ menu at the top right: consent under Privacy settings, closure under Delete account, which appears when you tap your email.
A closure completes 30 days after you request it. In the meantime the account is locked and your files are not used for anything. If you change your mind, sign in within those 30 days and the request is cancelled with your files intact. After 30 days your account data and uploaded files are erased permanently and cannot be recovered. A download button for your data sits on the same screen.
You can also require erasure straight away. That is the right in section 1 above: write to [email protected] and we act within 10 days, regardless of the 30-day period.
If you signed up with Google, Caveat’s permission under “connected apps” is revoked at the moment you request closure. If you cancel and come back, the only difference is one more Google consent screen at your next sign-in; your files are unchanged.
When an account is closed we keep a record of what was deleted and when — counts only, such as the number of files removed. It holds no email address and no identifier. Without it we could not prove the deletion happened.
Content passed to the Gemini API is retained by Google only for a limited period to detect abuse, and Caveat cannot delete those records directly.
10. Cookies and browser storage
No advertising or tracking cookies are used. What is used:
- Staying signed in — the authentication token Firebase keeps in your browser. Strictly necessary to provide the service, so no separate consent is sought. Signing out removes it.
- Remembering screen state — your consent answer, whether the role question has been shown. These stay in your browser and are not sent to the server.
Analytics (PostHog) is not necessary, so it is switched on only after you consent. Clearing site data in your browser removes all of it, and signs you out.
11. AI-written text and automated decisions
The calculations in a report are performed by the server using fixed formulas. Turning those results into readable sentences is done by AI (Google Gemini).
This is not a decision based solely on automated processing producing legal or similarly significant effects within the meaning of Article 22. Caveat does not score creditworthiness, does not assess eligibility, does not report results to third parties, and makes no decision about you. A report supports your own judgment.
12. Security measures
- All traffic is encrypted over HTTPS, with HSTS so browsers never try plain http.
- External scripts are restricted by an allow-list (CSP).
- From the "read a financial statement" step onwards, the server accepts only authenticated requests.
- The industry statistics served to the browser contain no company identifiers.
- Database credentials and API keys live only in runtime secrets, never in the code.
- The only thing Caveat asks you for is an email address; there is no field for a name, phone number, address or national ID. Whatever is written inside the document you upload is kept along with it — redact anything you would rather not send.
A personal data breach will be notified to the supervisory authority within 72 hours of becoming aware of it, and to affected users without undue delay where the risk to them is high. Korea and the EU both set 72 hours.
13. Children
Caveat is for people running a business. It does not accept users under 14 in Korea, or under 16 in the European Economic Area.
14. Complaints
Write to [email protected] first and it will be dealt with directly. If that does not resolve it:
- EU/EEA residents — the supervisory authority in your country; the list is at edpb.europa.eu (Art. 77).
- Korean residents — Personal Information Dispute Mediation Committee, 1833-6972, kopico.go.kr; Privacy Infringement Report Centre, 118, privacy.kisa.or.kr
Your right to a judicial remedy is unaffected.
15. Changes
Changes are published on this page together with their effective date. Changes unfavourable to users are announced 30 days in advance.
Effective: 2026-10-01
This English text is provided for convenience. Where it differs from the Korean version, the Korean version governs.