Who we are
This website is operated by Kastl LLC and Kastl Insurance Services LLC (“Kastl,” “we,” “us”), 50 University Ave., Ste B342, Los Gatos, CA 95030. This policy explains what information we collect through 1kastl.com and how we handle it.
Kastl’s products are not yet available. When they launch, customers will receive a separate privacy notice that explains how we handle the financial information needed to provide those products.
Information we collect
We only collect what you choose to send us:
Launch updates: your email address.
Contact form: your name, email address, company, phone number (optional) and your message.
We don’t ask for financial account numbers, Social Security numbers or other sensitive information on this site. Please don’t include them in a message.
How we use it
We use your information to answer your questions and to let you know when Kastl launches. We don’t sell your information, and we don’t share it with other companies for their own marketing.
Service providers
A few companies help us run this website, and they handle information only on our behalf:
Vercel hosts the site and keeps standard server logs, such as IP address and browser type. Vercel also checks browser signals to tell people apart from automated bots, which keeps spam out of our forms.
Bird delivers form submissions to our team by email.
Adobe serves the fonts used on this site.
Cookies and tracking
This site doesn’t use advertising or analytics cookies, and it doesn’t track you across other websites. Because we don’t track visitors, we have no need to respond differently to “Do Not Track” browser signals. We count page visits with Vercel Web Analytics, which doesn’t use cookies or identify individual visitors.
How long we keep it
Form submissions go to our team’s email. We keep them only as long as we need to respond to you or to send the launch update you asked for.
Your choices
You can ask to see, correct or delete the information you’ve sent us, or ask to stop receiving launch updates. Email us at privacy@1kastl.com. Every launch email will also include a way to unsubscribe.
Security
This site uses encrypted connections (HTTPS), and we limit who at Kastl can access what you send us.
Children
This site is not meant for children under 13, and we don’t knowingly collect their information. If we learn that we have, we’ll delete it.
Changes to this policy
If we change this policy, we’ll post the new version here and update the date at the top.
Contact
Questions about this policy? Email privacy@1kastl.com, or write to us at the address above.
Privacy (Regulation P) Policy
Policy owner: Compliance Officer. Departments impacted: All employees. Approval authority: Compliance and Risk Committee. Effective date: TBD.
1. Purpose, Statement, and Scope
1.1 Purpose
This Privacy Policy ("Policy") sets out how Kastl LLC ("Kastl" or the "Company") will comply with privacy laws and regulations, such as Regulation P, the Right to Financial Privacy Act ("RFPA") and other applicable federal and state consumer financial privacy statutes, laws, and regulations (collectively, the Regulations).
The Policy also covers how and when Kastl will collect, retain, process, share, protect and transfer customers’ personal data, including nonpublic personal information (NPPI). The Policy is to be used internally by Kastl and its employees but also requires the Company to separately maintain a publicly available summary of the policy as well as a consumer privacy notice to be shared directly with customers.
It is the intent of Kastl to comply with the Regulations. To the extent deemed necessary and appropriate, policies and procedures have been or will be written to cover various areas of Kastl’s operations. These policies are in place to demonstrate Kastl’s commitment to compliance and to provide a framework for employees to operate in compliance with all applicable laws and regulations.
1.2 Statement
It is the policy of Kastl to conduct its business in accordance with its bank partners’ expectations and thus, the Regulations and to ensure proper adherence to the provisions and intent of the Regulations.
Failure to comply with applicable privacy laws and regulations can result in severe criminal and civil penalties and regulatory actions against Kastl, its bank partner, and Kastl’s Executive Management and Employees. Non-compliance with applicable laws and regulations, the Policy, and related procedures may constitute grounds for disciplinary action, including termination of employment.
1.3 Scope
This policy applies to all application, origination, servicing, marketing, and collection activities performed by Kastl. The scope of this policy includes requirements for the maintenance of controls and procedures for compliance with all related laws, including compliance with advertising requirements, application and solicitation disclosures, statement disclosures, account opening procedures, and other subsequent disclosure requirements.
2. Key Terms
Consumer: An individual who seeks to obtain a financial product or service from Kastl and has provided NPPI to Kastl in seeking to obtain an account or other access to Kastl’s products and services.
Customer: A consumer who has a continuing relationship with Kastl that involves Kastl providing one or more financial products.
Nonpublic Personal Information ("NPPI"): Any information that a consumer provides to Kastl to obtain a financial product or service from Kastl; information about a customer resulting from a transaction involving Kastl and the customer; and other information obtained about a customer in connection with Kastl providing financial products and services to the customer.
Personal data: Any data or information considered to be personal in nature and not subject to public availability. Personal information includes, but is not limited to:
Individual names
Social Security numbers
Credit or debit card numbers
State identification card numbers
Driver’s license numbers
Dates of birth
Income
3. Policy Governance
This policy is a general statement of Kastl’s objectives, direction, and expectations regarding the adherence to the Regulations. As such, it is the authority, basis and platform for the development, communication, implementation, interpretation, and enforcement of appropriate and applicable operating guidelines that follow in subsequent sections of this policy.
This Policy must be reviewed on an annual basis or more frequently when major changes occur in Kastl’s organization, its business practices, or a related policy that impacts this Policy. The Compliance and Risk Committee ("CRC") empowers the Compliance Officer ("CO") to make non-substantive updates to this Policy, such as immaterial edits or correction of typographical errors; however, all substantive changes must be submitted to the CRC for review and approval.
As a matter of practice, this Policy is made available to all employees. The CO is responsible for ensuring version control, documenting updates and amendments, and ensuring that the Policy is distributed or otherwise made available.
4. Applicable Regulations
4.1 USA PATRIOT Act
To help the United States government prevent fraud and fight the funding of terrorism, money laundering and related activities, Section 326 of the U.S.A. Patriot Act requires that Kastl obtain, verify, and record information that identifies each person who applies for credit with Kastl. We shall ask the customer control persons for their name, address, date of birth, and other identification information. The Company may also inspect or copy their driver’s license or other identifying documents. If the customer fails or refuses to provide such information, Kastl may decline to provide financial services or establish or continue a customer relationship with said customer. This policy also extends to signatory individuals added to an existing or in-process account application.
4.2 GLBA
The Gramm-Leach-Bliley Act ("GLBA") applies to Kastl’s product offering, Kastl abides by the GLBA Safeguards Rule regarding administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information. These standards are covered in the Kastl Information Security Policy. The Information Security Policy also includes the GLBA required Privacy Incident Response Program.
4.3 CalOPPA
As a business operating in California, Kastl will comply with the California Online Privacy Protection Act ("CalOPPA"). We will provide a conspicuous privacy policy stating the information that Kastl collects and with whom it is shared. Kastl’s privacy policy will be shown via a link that appears directly on the home page and is different in color than other text and the background color and is larger in size than other text on the page. To comply with CalOppa, the privacy policy itself will include the following:
A list of the categories of PII that Kastl collects;
A list of the categories of third parties with whom Kastl may share PII;
How a consumer may review and request changes to their PII as collected by Kastl;
A description of the process by which Kastl notifies consumers of material changes to the privacy policy; and
the effective date of the privacy policy.
4.4 COPPA
Kastl will comply with the Children’s Online Privacy Protection Act ("COPPA"). As stated later in this policy, Kastl will not collect information from children under the age of 13. Please see 8. Information from Children for more information on Kastl’s COPPA compliance.
4.5 CCPA
As a for-profit business that collects and controls California residents’ personal information, does business in the state of California, but has an annual gross revenue less than $25 million, Kastl is not required to comply with the California Consumer Privacy Act ("CCPA"). If at any time Kastl fulfills the conditions that would require it to comply with the Act, Kastl will only collect personal information:
In a reasonably proportionate manner.
To achieve legitimate business purposes which may not be achieved in a commercially reasonable manner without the collection of that personal information.
If Kastl has disclosed such data collection in its CCPA Disclosure, and the customer has already viewed the CCPA Disclosure.
Additionally, Kastl will only use personal information:
In a reasonably proportionate manner.
To achieve legitimate business purposes which may not be achieved in a commercially reasonable manner without the sharing of that personal information.
With partners that have adequate privacy and data security policies in place.
If Kastl has disclosed such sharing in its CCPA disclosure.
If the customer has not requested that such personal information not be shared.
To comply, Kastl will have a system of controls so that particular information can be excluded from sharing on request. Kastl will take such requests from a form that it provides on its website that enables customers to assert their rights under CCPA.
5. Privacy Notice
5.1 To Whom and When
As a best practice, Kastl chooses to provide our privacy policy statement to each customer to whom the Company provides financial services. Generally, this privacy policy statement is provided to the customer with initial disclosures, annually and when Kastl makes changes to its privacy policy, and made available on Kastl’s website.
The notice must, at a minimum, contain the following:
How Kastl obtains and gathers information
The circumstances under which Kastl may share information; and
Instructions on how to limit the information sharing.
The notice shall be provided at three (3) points in time
Initial: at the time, initial disclosures are provided.
Annual: at least annually, until the relationship is terminated; and
Change in policy: within 30 days of a material change in Kastl’s policy regarding information collection, use or disclosure.
5.2 Public Privacy Statement
Kastl shall maintain a publicly available policy statement (Policy Statement) and post the Policy Statement on its website or in its application. The Policy Statement must align with this Policy and provide a concise summary of the following information:
Applicability of policies to a customer;
Personal information to be collected by Kastl through the application or through partners;
Use of cookies;
How personal information is stored and protected;
How personal information is shared or used within Kastl;
How personal information is shared or used within the Kastl network;
How personal information is shared and used with parties outside of the Kastl network; and
How customers can limit information sharing, if at all.
6. Consent
Prior to the collection and processing of Personal Data, Kastl must obtain consent from the customer in a manner appropriate to the context. Most of the time, consent is implied from the circumstances. For example, if customers register to use Kastl services, they expect their bank account or credit card information to be used to facilitate transactions, but they would not expect that information to be sold or otherwise utilized for the purposes of marketing to them other financial products.
When Personal Data is used in ways that are not reasonably implied from the apparent circumstances, consent may be provided electronically via either an opt-in or opt-out regime.
In some circumstances, a customer may be allowed to withdraw previously provided consent to the collection and use of Personal Data, subject to contractual and legal restrictions and reasonable notice. In general, Kastl will honor the withdrawal of consent to the greatest extent possible. Withdrawal of consent may have consequences, such as no longer being able to provide certain services or communicate in certain ways with the customer, including for marketing purposes. In certain circumstances and as allowed by law, consent may not be withdrawn with respect to certain necessary uses and disclosures of Personal Data, such as with respect to certain legal and contractual obligations. Kastl will track consent and withdrawal requests to ensure they are meeting legal requirements and honoring withdrawal requests, to the best of its ability.
7. Information Sharing
7.1 Information Kastl Collects
Kastl collects information about its customers to help us better serve their financial needs, to provide them with quality products and services and to fulfill legal and regulatory requirements. We consider non-public information about our customers in our possession to be personal information, even if they cease to be a customer. The personal information we collect about our customers may include among other things:
Identifying information, such as their name, age, address, phone number and social security number.
Employment information; and
Financial information such as their income, assets, and liabilities, as well as information about their savings, investments, and insurance.
Typically, Kastl collects this information on applications and other forms completed by the customer, through conversations they may have with Kastl’s customer support agents, through discussions with other representatives, and, in some cases, via information transmitted over the Kastl website. The Company may also collect information from a wide range of other sources in order to meet its Know Your Customer, or other anti-money laundering obligations. These sources may include, among others, employers, attorneys, banks, insurance companies, and credit reporting agencies.
7.2 Limiting Information Sharing
Kastl shares personal information about its customers only as required or permitted by law, with third parties, such as service providers, who assist us in the day-to-day operations of our company in the administration, processing, and servicing of accounts. These third parties include, but are not limited to: insurance companies, processing services, printing companies, software providers, and marketing services.
As permitted by law, a customer has the right to limit or opt-out of certain information sharing. Federal law gives customers the right to limit only the following:
Affiliates’ use of customer information for everyday business purposes -- information about a customer’s creditworthiness.
Affiliates’ use of a customer’s information to market to the customer.
Non-affiliates’ use of information to market to the customer; and
Any additional rights as permitted by state law.
7.3 Information Sharing Agreements
In the event that Kastl engages in joint marketing ventures or other arrangements with non-affiliates that require the sharing of NPPI, the applicable agreement must be reviewed by Legal or the CO to confirm that it includes appropriate provisions governing NPPI and its permitted use. No information sharing agreement may be executed without the approval of the Legal Department or outside counsel. Agreements with non-affiliates shall be reviewed periodically to confirm continued compliance with applicable privacy and information security requirements.
7.4 Former Customers
Once a customer is no longer an active Kastl customer, we will continue to treat the information that they have provided as if they are still a customer.
8. Information From Children
Kastl’s products are not directed to children under the age of 13. If Kastl obtains actual knowledge that the Company has collected personal information from a child under the age of 13, Kastl shall promptly delete it, unless legally obligated to retain such data. If Kastl provides products or services to children under the age of 13, it must first obtain the verifiable consent of their parents or guardians, such as through consent forms that the parent or guardian must sign. Consent need not be obtained where information about children is provided by their parents or guardians.
9. Record Retention
Kastl shall retain evidence of compliance with this Policy and with Regulations for five (5) years. Records must be kept confidential but must be maintained in such a manner that they are retrievable in accordance with regulatory requirements governing record retrieval.
10. Training
Training employees is a crucial element in building a strong and lasting culture of compliance. Kastl will require that all employees and service providers whose jobs impact topics discussed in this Policy receive training appropriate to their roles and responsibilities at least annually. In addition, all new employees will receive training on their responsibilities under the Policy within 30 days of their start date.
Additionally, the CO and other staff, as applicable, will participate in professional training programs to receive periodic training that is relevant and appropriate to stay informed of changes in the industry, regulations, and industry best practices.
11. Exceptions
Under certain circumstances, Management may reasonably determine that a Policy exception may be warranted. This Policy requires the Compliance Officer to sign off on any such exceptions and to report all Policy exceptions to the executive leadership.
Notwithstanding the foregoing, under no circumstances does Kastl allow Policy exceptions that would result in a violation of law or any employee becoming the subject of an external investigation.
12. Version Control History
V 1.0. Owner: Compliance Officer. Approver: Compliance and Risk Committee.
13. Text Messages
Kastl sends texts on behalf of your property-management company about your home, property or work. You are texted only at a number you gave the company for that purpose, or, for company staff, the number you entered and verified at sign-in. Message frequency varies. Message and data rates may apply. Reply STOP to any text to opt out; reply HELP for help. Full terms on our texting policy.