← Legal

Kalku Privacy Policy — v1.4 (Beta)

Last updated: July 2026.

Kalku is a personal financial diary. To do its job it holds some of the most personal information you have — how you earn, how you spend, who you owe, who owes you. We take that seriously. This policy explains, in plain language, what we collect, why, who else touches it, and the control you have over it. If anything here is unclear, email hello@kalku.ai and ask.

The short version: your money story is yours. We don't sell it, and we don't hand it to advertisers. But we can't do zero-knowledge magic either — to understand what you type, our systems and a few trusted providers have to read it. The rest of this document is the honest detail.

1. Who We Are

Kalku is operated by KALKU DIGITAL SOLUTIONS LIMITED (RC 9539234), a company registered in Nigeria. We are the data controller for the information described here. As a Nigerian company, we handle personal data in line with the Nigeria Data Protection Act / NDPR.

Contact for anything privacy-related: hello@kalku.ai.

2. What We Collect

Who you are. The email address, WhatsApp number, and/or Telegram identity you sign up with, plus a display name. Your PIN is stored hashed — we can't read it back.

What you tell Kalku. The messages you send us — typed or spoken — and everything we record from them: amounts, categories, dates, the people and businesses you mention, loans, gifts, IOUs, savings goals, budgets, and recurring entries. This is your diary. It is the core of what Kalku stores.

Voice notes. When you send a voice note, we transcribe it to text. The audio file itself is not kept — we discard it after transcription. The transcript is treated like any other diary message.

Uploads. If you import a bank statement or send a receipt, we store that file (for example, the statement PDF) so we can process it and so you have a record. These live in encrypted object storage.

Payments. When you subscribe, payment is handled by Paystack. We do not store your card number or bank details — Paystack does, under their own terms.

Technical data. Basic device and app information, and logs we need to run the service securely and diagnose problems. Our error logs are scrubbed of personal detail at the point they're written.

3. How We Use It

We do not use your financial data for advertising, and we do not sell it to anyone.

4. AI Processing — The Part You Should Actually Read

Kalku understands plain language ("sent 5k to my brother for fuel") by sending your message to third-party AI providers that do the language parsing. This is central to how the product works, so we want to be straight about it:

This is separate from the optional Training Archive (Section 8), which is the only place your phrasing is ever stored for our own future use, and only if you opt in.

5. Where It Lives and How It's Protected

Your data is stored in managed Supabase (PostgreSQL) databases, encrypted at rest, with uploaded files in Cloudflare R2 object storage. The service runs on Railway. We use reasonable technical and organisational measures to protect it.

Being honest about limits: no online service is 100% secure, and authorised Kalku staff can access your data where they need to in order to operate, support, and protect the service. We are not a "not even we can see it" product, and we won't claim to be. The Training Archive is the exception — it sits behind a separately-controlled credential and is not browsable from normal admin tools.

6. Who We Share It With

We share data with the service providers we need to run Kalku, and no one else except where the law requires it. These include:

We may disclose data if required by a valid legal process, or to protect the rights, safety, and property of our users or Kalku. We never sell your data.

7. Messaging Channels

When you use Kalku over WhatsApp or Telegram, your messages pass through Meta's and Telegram's systems, which are governed by their privacy policies as well as this one. On WhatsApp we operate within Meta's rules, including the 24-hour messaging window. If you'd rather keep everything on one surface, you can use the Kalku web app.

8. The Training Archive (Opt-In)

Kalku is building toward its own AI model that understands how Nigerians and the diaspora actually talk about money — in Pidgin, Yoruba, Hausa, Igbo, and English. To do that we ask (but never require) permission to keep a de-identified copy of your messages.

It is off by default. Nothing is archived unless you turn it on in Settings → Privacy. Before any row is stored, a stripper removes your name, contact names, phone numbers, emails, and Nigerian bank account numbers. Bank statements, PINs, images, and documents are never archived. You can turn it off and erase every archived row at any time. The full explainer is the Privacy Archive page at kalku.ai/legal/privacy-archive, and the binding terms are in §12 of the Terms of Service (kalku.ai/legal/terms).

9. How Long We Keep It, and Deleting Your Account

We keep your data for as long as your account is active. You can export everything (CSV, JSON) from the web dashboard at any time, and you can request deletion at any time from Settings → Privacy or by emailing us.

When you delete your account, a 30-day grace window applies (in case it was a mistake). After that, your personal data is irreversibly erased across our systems. A small amount of information survives deletion for legitimate reasons: a forensic audit record of the deletion itself, and operational error logs that have already been scrubbed of personal detail. Payment records held by Paystack are retained under their terms and applicable financial-record law.

10. Your Rights

Under the NDPR and applicable law, you can:

To exercise any of these, use Settings → Privacy or email hello@kalku.ai. If you believe we've mishandled your data, you have the right to complain to the Nigeria Data Protection Commission.

11. Children

Kalku is for adults. You must be at least 18 years old to use it. We don't knowingly collect data from anyone under 18.

12. International Transfers

Some of the providers in Section 6 process data on servers outside Nigeria. Where that happens, we rely on those providers' safeguards and contractual terms to keep your data protected to a comparable standard.

13. Changes to This Policy

If we make a material change to this policy, we'll notify you by in-app message and email at least 30 days before it takes effect. Continued use after the effective date means you accept the updated policy.

14. Contact

Questions, requests, or complaints: hello@kalku.ai.

KALKU DIGITAL SOLUTIONS LIMITED · RC 9539234 · 6, Adegbite Street, Oluyole Extension, Ibadan, Oyo State, Nigeria

For questions: hello@kalku.ai

For questions: hello@kalku.ai