FINANCIALS

Privacy Policy

Financials — The KRÄM Group internal financial reporting application

Effective date: October 4, 2026. This version replaces the policy dated March 10, 2026.

1. Overview

This Privacy Policy describes how The KRÄM Group ("KRÄM", "we", "us", "our") accesses, uses, stores and protects information in Financials (the "App"), our internal financial reporting and bookkeeping-review application at https://financials.esplot.com. The App is a proprietary, internal-use tool operated by KRÄM for KRÄM's own companies and used only by authorized KRÄM personnel. It is not offered to the public and has no external customers.

2. Scope

This policy applies to all data the App accesses, processes or stores in connection with the QuickBooks Online companies of The KRÄM Group and its affiliated companies (the "KRÄM companies"). It does not apply to third-party services, except as described in section 6.

3. Information the App accesses

The App connects to each KRÄM company's QuickBooks Online account through the Intuit QuickBooks Online API, with the authorization of a KRÄM administrator of that company, and only reads data. It does not create, change or delete anything in QuickBooks. It reads:

  • the chart of accounts (names, numbers, types, status);
  • general ledger transaction lines (dates, types, document numbers, amounts, memos, accounts, classes, projects);
  • lists of vendors, customers and projects, classes and employees, as names that appear on transactions;
  • financial report data (for example General Ledger, Profit and Loss, Balance Sheet);
  • the QuickBooks company identifier (realm ID) and company name of each connected company.

The App also processes General Ledger report files that KRÄM exports from QuickBooks.

All of this is KRÄM's own business data. Because bookkeeping records name the people and businesses a company deals with, it can include the names of KRÄM's vendors, customers and employees as they appear in those records. The App does not collect information from those people directly. For vendors and employees it requests only the name and whether the record is active. It does not store bank credentials, payment card numbers, tax identification numbers or Social Security numbers, and it does not access payroll detail beyond what appears on general ledger lines.

About the App's own users (KRÄM personnel) we hold only what sign-in provides: name, work email address and profile picture from their Google Workspace account, plus their role in the App.

4. How we use the information

Solely for KRÄM's internal purposes:

  • consolidated financial reporting across the KRÄM companies (profit and loss, balance sheet, expense targets);
  • reviewing the bookkeeping for consistency (for example, the same vendor coded to different accounts) and recommending corrections to KRÄM's bookkeepers;
  • automating routine retrieval of financial data;
  • operating, securing and troubleshooting the App.

We do not use the data for advertising or marketing, we do not sell it, and we do not use it to train machine-learning or artificial-intelligence models.

5. Sharing and disclosure

KRÄM does not sell, rent or trade data accessed through the App. It is disclosed only:

  • to authorized KRÄM employees and contractors who need it to do their jobs, according to their role in the App;
  • to the service providers in section 6, only as needed to run the App;
  • as required by applicable law, regulation or valid legal process;
  • in connection with a merger, acquisition or sale of substantially all of KRÄM's assets, provided the receiving party agrees to honor this policy.

6. Service providers

The App relies on these third parties:

  • Intuit (QuickBooks Online API) — the source of the data, accessed under Intuit's terms and privacy policy.
  • Hetzner Online GmbH — hosts the App's server and database in a data center in the United States.
  • Google (Google Workspace) — sign-in for KRÄM personnel, storage of the exported report files in KRÄM's Google Drive, and delivery of the App's summary emails to KRÄM recipients.
  • An AI model provider (currently xAI) — when the bookkeeping review finds a possible inconsistency, a short excerpt describing that finding (account names, a payee name, and a few sample lines with dates, amounts and memos) is sent to the provider's API to obtain a written recommendation. The ledger as a whole is not sent. The provider processes the excerpt to return its answer, under its API terms. This step can be switched off by KRÄM at any time, in which case nothing is sent to the provider.

7. Security

  • All connections to the App and to Intuit use TLS (HTTPS).
  • QuickBooks access uses OAuth 2.0. Access and refresh tokens are encrypted at rest (AES-256-GCM) and are never written to logs or source code.
  • The App's code issues read requests only to the QuickBooks API.
  • Sign-in is restricted to KRÄM's Google Workspace domains; access within the App is limited by role and, where assigned, by company. Administrative functions, including connecting or disconnecting a QuickBooks company, are restricted to administrators.
  • Credentials and keys are kept in server-side configuration, outside the source repository.
  • The database is backed up nightly; backups are access-restricted.

No system is immune to breach. If a security incident affects data handled by the App, KRÄM will investigate, contain and remediate it, and will notify affected parties, including Intuit where required, as applicable law and our agreements require.

8. Retention and deletion

Data read from QuickBooks is stored in the App's database so that reports cover multiple years and week-to-week changes can be tracked. It is kept for as long as KRÄM uses the App for the company concerned.

  • Disconnecting a company (in the App under Settings › QuickBooks, or from within QuickBooks under Apps) revokes the App's authorization. On disconnect in the App, the data synchronized through the API connection for that company is deleted from the App's database.
  • Database backups are kept for 30 days and then deleted.
  • Report files exported from QuickBooks remain in KRÄM's Google Drive under KRÄM's general retention practices.
  • A KRÄM company's data is deleted from the App on request of KRÄM's management to the contact below.

9. Changes to this policy

KRÄM may update this policy. Changes take effect when the updated policy is posted at this address with a new effective date. Authorized users are informed of material changes.

10. Contact

The KRÄM Group — Operations Email: legal@thekramgroup.com Headquarters: Reed City, Michigan, USA

This App is an internal KRÄM tool and is not a consumer-facing product.