Privacy notice

1. Who we are

KITSS, [legal entity name], registered in [country] under company number [registration number], with its registered address at [registered address]. Website: kitss.net. For anything in this notice, contact us at [privacy contact email].

2. Our role

• For our clients’ leads and contacts (people imported from LinkedIn, uploaded files or Apollo), the client decides who to reach and why, so the client is the controller and KITSS acts as its processor, under a data processing agreement [link or reference to DPA].
• For client accounts, website enquiries and the “Request access” form, KITSS is the controller.

3. What data we handle

Client accounts

Name, work email, password (stored only as a one-way hash), workspace membership and role, and a record of actions taken in the console (for example, runs started, leads approved, replies sent).

Business contacts (leads)

• From LinkedIn: the client’s own 1st-degree connections (name, headline, job title, company, profile link), read through a read-only connection or from the Connections export the client uploads.
• From uploads: whatever business contact fields the client includes in a file they upload.
• From Apollo: business details such as company, company size, industry, location and work email, used to enrich leads and to find people outside the client’s network.
• Generated in the console: fit reasons, research notes (labelled as estimates), conversation history synced from GoHighLevel, reply drafts and meeting prep briefs.

We do not intend to process special-category data (such as health, religion or political views) and ask clients not to upload it.

Website visitors and enquiries

If you use the “Request access” form we keep your name, email, company, LinkedIn profile link (if you give one) and your message. To limit abuse, we briefly count requests per IP address; the count expires after an hour.

4. How the data is used

• To run the console for the client: importing, enriching and matching leads against the client’s rules, and showing the reasons for each result.
• To write research notes, reply drafts and meeting briefs with AI. Matching and scoring are rule-based; AI is not used to decide who is a fit.
• To send approved leads, and replies the client approves, to the client’s own GoHighLevel account.
• To answer access requests and support our clients.
• To keep the service secure and to meet legal obligations.

Legal basis. For client accounts: performance of our contract. For website enquiries: our legitimate interest in responding to people who contact us. For leads, the client as controller determines the legal basis (typically legitimate interests in business-to-business outreach) and is responsible for it. [Legal review: confirm bases and any jurisdiction-specific wording.]

5. Service providers we use

GoHighLevel and the client’s meeting tools (for example Google Meet, Zoom, Microsoft Teams, Calendly or Cal.com) are accounts the client holds directly; their own terms and privacy notices apply to data held there. Some providers are based outside [the UK / EEA]; where data is transferred, we rely on [standard contractual clauses / adequacy decisions – to be confirmed].

6. How long we keep data

• Client and lead data: for as long as the client’s workspace is active, then deleted within [number] days of the contract ending, unless the client asks for deletion sooner.
• Access requests: [period, e.g. 12 months] after our last contact, unless you become a client.
• Credit and billing records: as long as tax and accounting law requires. They do not contain lead details beyond an internal reference.

7. Deletion and the suppression list

Anyone whose data is in the console can ask to have it removed, either through the client who added them or by contacting KITSS at [privacy contact email]. We delete the person’s lead record together with related conversations, drafts, meeting records and briefs. So that they aren’t imported or contacted again, we keep only a one-way hash of their email address on a suppression list; we cannot recover the email from it. Data already in the client’s own GoHighLevel account must also be deleted there by the client.

8. Your rights

Depending on where you are, you may have the right to access, correct, delete or export your data, to object to or restrict its use, and to complain to a data protection authority [name of supervisory authority]. Where we are the processor, we pass your request to the client concerned and help them answer it.

9. Cookies

We use one cookie: a session cookie that keeps you signed in to the console. It is strictly necessary, set only when you sign in, and expires after seven days or when you sign out. We do not use analytics, advertising or tracking cookies on this website.

10. Security

Connections are encrypted in transit. Integration keys are encrypted at rest. Passwords are stored only as hashes. Every client’s data is kept in a separate workspace, and access is limited to that workspace’s members and to KITSS staff supporting it.

11. Changes

We will update this notice when the console or our providers change, and show the date of the latest version at the top. See also our terms of service.