Documentation
Compliance reviewer guide — data handling for Kalc
Who this is for: You assess whether a modelling tool fits client confidentiality, GDPR, and internal policy — without reading engineering internals.
Companion docs: Privacy Notice · Modeler guide · Install reference
Summary for reviewers
| Question | Answer |
|---|---|
| What is processed? | Account data (name, email); workbook uploaded for analysis; optional stored results |
| Where? | EU hosting (Germany); optional EU AI provider (France) only in Grounded mode |
| How long is the file kept? | In memory for the analysis only — not written to long-term storage |
| Can users avoid storage entirely? | Yes — Zero Retention per run |
| EEA transfer? | No transfers outside the EEA described in the published notice |
| Automated decisions about people? | No — Kalc analyses spreadsheets, not natural persons |
Two controls users hold (different jobs)
Zero Retention
Controls whether Kalc keeps anything after the run. When on, the file and results are not retained.
Evidence environment
Controls whether anything leaves the estate for optional advisory features:
| Setting | Default? | Egress |
|---|---|---|
| Contained | Yes — all new workspaces | No third-party AI on model content |
| Grounded | Opt-in | Assumption labels and values may be sent to EU AI provider for market-context advisory |
Failure mode: if the setting cannot be resolved, Kalc treats the workspace as Contained.
What is not in scope for this product
- Kalc does not provide legal, financial, or transaction advice
- Kalc does not sign off models for credit, audit, or regulatory purposes
- Findings are identification and suggestion — professional judgement remains with the user
GDPR rights and erasure
Users may request access, correction, deletion, and portability as described in the Privacy Notice. Kalc provides a data erasure path for workspace-scoped data (including indexed artefacts where applicable).
Contact: privacy@kalc.tech
Enforcement context (aggregate only)
EU regulatory enforcement on privacy and data handling has reached billions of euros in aggregate penalties across sectors since GDPR application. This is not a prediction about any user's risk — it explains why data-minimisation defaults (Contained, in-memory analysis, Zero Retention option) are product choices, not afterthoughts.
Suggested review checklist
- Confirm Zero Retention meets your client contract for sensitive models.
- Confirm Contained is acceptable for default rollout; document if Grounded is approved.
- Align with your external model review policy — Kalc as preparation layer, not sign-off.
- File the published Privacy Notice and Beta Terms with your vendor register.
Beta programme notes
- Invitation-only; mutual confidentiality expectations in Beta Terms
- Anonymous product statistics may be recorded when Zero Retention is off — no user/file identifiers (see Privacy Notice)
- Programme duration: 30 days from first analysis, extendable on material contribution