Privacy notice

Who we are

kerd.ai is made by Scope Limited, a company registered in Malta (Malta Business Registry registration number C 107107), of Digital Hub, Level 1, Malta Life Sciences Park, Sir Temi Zammit Buildings, San Ġwann SGN 3000, Malta. In this notice, "we", "us" and "our" mean Scope Limited.

This notice covers the website at www.kerd.ai, the Book a demo form, and the kerd.ai product at app.kerd.ai (opens in a new tab), which helps accounting firms keep the books for their clients' investments. Our terms of use set out the rest of the agreement between your firm and us.

Because we are established in Malta, the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act (Chapter 586 of the Laws of Malta) apply to how we handle personal data. For anything about this notice, email kerd@scope.com.mt.

Controller and processor

We are the controller of personal data we handle for our own purposes: visitors to this website, people who ask for a demo, and the people at a firm who sign in to kerd.ai (their names, emails and how they use their account).

We are a processor for the data a firm puts into kerd.ai about its clients: client names, holdings, transactions, statements and the reports and journals made from them. The firm is the controller of that data. We process it only to provide kerd.ai to the firm, on the firm's instructions, and we help the firm answer requests from its clients. If you are a client of a firm that uses kerd.ai, please contact the firm about your data.

What we collect and why

When you browse this site

The site is plain web pages. It sets no cookies, runs no analytics, and loads no third-party scripts, fonts or embedded videos. Like every website, the servers that deliver it see technical details of each request: your IP address, the page asked for, the time, and your browser's description of itself. We use these only to deliver the site, keep it secure and fix faults, which is our legitimate interest in running a working website.

When you book a demo

The form asks for your name, work email and firm, and, if you choose, your country, roughly how many clients have investments, your accounting software and any notes. We also record whether you ticked the product updates box and when you sent the form. We use this to reply, agree a time and run the demo. Our legal basis is taking the steps you asked for before any contract, and our legitimate interest in answering enquiries from firms.

The product updates box is unticked unless you tick it. If you do, we may email you about changes to kerd.ai, based on your consent, which you can withdraw at any time by replying to one of those emails or writing to kerd@scope.com.mt.

Demos are video calls on Microsoft Teams or Google Meet, whichever suits you, and we don't record them. We show kerd.ai on sample data. If you'd like to see one of your own statements, we import it into a separate demo firm that only you and our team can see, and we delete the statement and everything made from it within 7 days of the call. Please don't put clients' personal data in the form's notes box.

When your firm uses kerd.ai

• Your account: your name, email address, firm, role and the clients you are assigned to. We use these to give you access, show you the right data and contact you about your account and changes to the service. Legal basis: the contract with your firm.
• Sign-in: you sign in with a Google or Microsoft account, or with a code we email you. We receive your name and email address from Google or Microsoft; we never see or store a password.
• Activity record: kerd.ai records actions taken in a firm's workspace, such as imports, approvals and changes, with who did them and when, so the firm can see who did what. Legal basis: the contract, and our legitimate interest in keeping the service secure.
• Client data: the client details, statements, holdings, transactions, prices and reports your firm puts into kerd.ai or creates there. We process these as your firm's processor, only to provide the service.
• Support: what you tell us when you email us, so we can help.

By putting other people's personal data into kerd.ai, your firm confirms it is allowed to do so. kerd.ai is for businesses; we don't knowingly collect data about children, or special categories of personal data such as health information. If you think we have some by mistake, tell us and we'll delete it.

Statements and Google Gemini

When your firm uploads a broker or custodian statement, we store the file and send it to Google's Gemini API, which we use as a sub-processor to read the statement and extract the positions, transactions and prices. Your staff then check every line before anything is saved. Statements can contain personal data about your clients, which we process as your firm's processor.

We use Gemini as a paid service, under which Google does not use the statements, the extracted data or its answers to improve its products. Google processes them under its data processing terms for paid services and may keep logs for a limited period to detect and prevent misuse and to meet its legal obligations. You can read those terms at ai.google.dev/gemini-api/terms (opens in a new tab). Google may process this data in any country where it or its agents have facilities; the transfers section explains how we protect transfers outside the EEA.

We keep statements, and the data extracted from them, for as long as your firm's account is active.

Who we share data with

We don't sell personal data or share it for advertising. We share it only with:

• Microsoft Azure, whose servers in Ireland host the website and the product. We don't run a data centre of our own.
• Cloudflare, which sits in front of www.kerd.ai and app.kerd.ai to protect them and deliver pages quickly.
• Twilio SendGrid, which delivers the Book a demo form to our inbox and the sign-in codes and other emails the product sends.
• Google, for the Gemini API described above, and Google and Microsoft when you choose to sign in with their accounts.
• our group companies and the people working for us, where they need it to provide the service;
• a regulator, court or public authority, when the law requires it, or to establish or defend a legal claim;
• a buyer or adviser if the business, or part of it, is reorganised or sold;
• anyone else only with your consent.

Each provider handles the data only for the service it gives us. We keep an up-to-date list of the sub-processors we use for client data, and we tell firms before we add or replace one, so they can object.

Transfers outside the EEA

If personal data is transferred to or processed in a country outside the European Economic Area, we make sure it is protected: either the European Commission has found that country's protection adequate, or the recipient has signed the Commission's Standard Contractual Clauses (opens in a new tab), or, within a group of companies, binding corporate rules apply.

Data you send over the internet may cross borders before it reaches us. We can't be responsible for what happens to it before we receive it.

How long we keep it

• Account and client data: for as long as your firm's account is active and we provide the service. After an account closes we keep it for a reasonable period, in case the firm comes back, and then for as long as the law requires (for example tax and accounting rules) or as long as a legal claim could be made.
• Statements and extracted data: as long as the account is active, as above.
• Demo requests: [PLACEHOLDER: retention period for demo requests, to check with Neville]
• Consent to product updates: until you withdraw it.
• Server and request logs: [PLACEHOLDER: how long server logs are kept, to check with Neville]

We may keep anonymised figures, which no longer identify anyone, without a time limit.

Security

No online service is completely secure, but kerd.ai was built with privacy in mind. Each firm's data is kept apart from every other firm's, and the app's tests check that one firm can't reach another's. Staff review every imported line before anything is saved. Sign-in is by Google, Microsoft or an emailed code, so kerd.ai stores no passwords. The people who work for us and can reach personal data must follow our security rules.

Cookies

The website at www.kerd.ai sets no cookies.

The product at app.kerd.ai sets one cookie, kerd_session, which keeps you signed in. It is needed for the product to work, lasts up to 14 days and is never used for tracking or advertising. The product also keeps two settings in your browser's storage: which firm you last worked in, and whether you hid the side menu. There are no analytics or advertising cookies.

Your rights

Where we are the controller, you can ask us to:

• tell you whether we hold personal data about you, and give you a copy;
• correct anything that is wrong;
• delete it, where we no longer need it or have no other legal reason to keep it;
• restrict how we use it, or stop using it where we rely on our legitimate interest, and stop using it for marketing at any time;
• give you the data you provided in a common machine-readable format.

Where we rely on your consent, you can withdraw it at any time, free of charge; that doesn't affect what we did before. To use any of these rights, email kerd@scope.com.mt. We'll answer within one month.

Where we are a processor, for example for a firm's client data, please send your request to the firm. We'll help the firm answer it.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to Malta's Information and Data Protection Commissioner (idpc.org.mt (opens in a new tab)) or the data protection authority where you live or work.

Changes and contact

We'll update this notice when the law, the technology or the way we work changes, and change the date at the top. If we make an important change, such as adding analytics to the website, we'll post a notice on the site or email the firms that use kerd.ai before it takes effect.

This site links to other websites. Once you leave it, their privacy notices apply, not ours.

Scope Limited, Digital Hub, Level 1, Malta Life Sciences Park, Sir Temi Zammit Buildings, San Ġwann SGN 3000, Malta. Email kerd@scope.com.mt.