Privacy Policy

KromaOS is a business platform that brings finance, sales, inventory and people into one workspace. This policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices you have.

It applies when you visit KromaOS, create an account, or use the product. It does not cover a company's own records that you enter into the product; those belong to the company whose workspace you use (see "Customer data" below).

We collect three kinds of information:

• Account details you give us: your name, email address, a password (stored only as a hash), and any profile details you add.
• Workspace data you and your team put into the product: the companies, contacts, invoices, records, files and messages that make up a workspace.
• Technical information created by using the service: IP address, browser and device type, pages viewed, and error and security logs.

We do not ask for special category data (such as health or biometric data) and ask that you do not put it in a workspace.

A company using KromaOS can put its form and a short script on its own website. When a visitor sends that form, the answers go to that company's workspace, together with where the visitor came from: the campaign tags of the link they followed, the site that sent them, their first page, and the pages they opened on that website during the visit.

That history is kept in the visitor's own browser, in the website's storage, and only sent when they send the form. We use no cookies across websites, no fingerprinting, and we do not store the visitor's IP address with the answers. The company that owns the form decides what to do with the lead.

• To create and run your account and give you the service you asked for.
• To keep the product working, fix faults, and keep it secure.
• To answer your questions and send you service messages, such as security alerts or changes to a plan.
• To improve the product, using aggregated or de-identified information wherever possible.
• To meet our legal, tax and accounting duties.

We do not sell your personal information, and we do not use the contents of a workspace to advertise to you.

Where the law requires a reason (a legal basis), we rely on: performance of our contract with you to run the account and the service; our legitimate interests in keeping the product safe and improving it, balanced against your rights; your consent, where we ask for it; and compliance with legal obligations.

You can withdraw consent at any time where consent is the basis. This does not affect what we did before you withdrew it.

We share personal information only with:

• Service providers who help us run the product (hosting, email delivery, payments), under contracts that limit them to our instructions.
• The other people in a workspace, where the product is designed to show them the records they work with.
• Authorities or third parties where the law requires it, or where we need to protect rights, safety or the security of the service.
• A buyer or successor, if the business is sold or merged, with notice to you.

We do not sell personal information.

We keep personal information for as long as your account is open and for a short period after it closes, to meet legal, tax and accounting duties and to resolve disputes. Workspace data is kept for as long as the workspace exists. When it is no longer needed, we delete it or make it anonymous.

We use technical and organisational measures to protect personal information, including encryption in transit, hashed passwords, access controls and monitoring. No method of storage or transmission is completely secure, so we cannot promise absolute security, but we work to protect your information and will tell you and the regulator about a breach where the law requires it.

KromaOS uses a small number of cookies and your browser's local storage to keep you signed in, remember your settings and theme, and, in the browser-only demo, hold the sample data you create. You can clear this at any time from your browser, which will sign you out and reset the demo.

We do not use advertising cookies. Where we use a cookie for something other than keeping the service running, we ask for your consent first.

Depending on where you live, you may have the right to:

• See the personal information we hold about you and get a copy.
• Correct information that is wrong or incomplete.
• Delete information we no longer need, subject to our legal duties.
• Object to or restrict certain uses, including direct marketing.
• Take your information elsewhere in a portable format.
• Complain to your data protection authority.

To use any of these, email legal@kromaos.app. We will respond within the time the law allows. If you use a workspace run by a company, that company is the controller of its records, so some requests go to them first.

KromaOS is a business tool and is not meant for children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

We may store and process information in countries other than yours. Where we move personal information out of your region, we use lawful safeguards, such as standard contractual clauses, and take steps to keep the same level of protection.

We may update this policy as the product and the law change. We will post the new version here, change the date at the top, and, for a material change, tell you in the product or by email before it takes effect.

Questions about this policy or your information? Email legal@kromaos.app or write to ITK Alliance Group, the operator of KromaOS.