Privacy Policy
This policy explains what personal information KzNet Technologies collects, why, and what we do with it. It covers our website at kznettech.com and our hosted CRM application at app.kznettech.com. It is written in plain language on purpose. If something here is unclear, write to privacy@kznettech.com.
1. Who we are
KzNet Technologies is a small technology firm based in the United States. We build websites and custom web applications for small businesses, and we operate a hosted CRM (customer relationship management) application for our clients. We are the operator of the services described here and the party responsible for how the information in this policy is handled.
2. Two kinds of data, two roles
The CRM holds two different kinds of information, and our responsibility is different for each.
- Account and billing data about the people who sign up for and pay for our services. For this data we decide what is collected and why. We are the controller.
- Workspace data that our clients put into their CRM: their customers, contacts, messages, quotes, and invoices. Our client decides what is collected and why. We store and process it only on their instructions. Our client is the controller and we are the processor.
If your information is in a client's workspace because you are one of their customers, that client is responsible for it. Section 9 explains how to reach them through us.
3. The website (kznettech.com)
The public website is a set of static pages. It runs no analytics, no advertising, and no tracking scripts. It sets no cookies on public pages. Our web server keeps standard access logs (IP address, requested page, browser type, time) for security and troubleshooting. Those logs rotate and are not used to build profiles of visitors.
The password-protected client area sets a cookie so you stay signed in. That cookie holds no personal information beyond the sign-in itself.
If you contact us through the address on the site, we keep your message and our reply so we can follow up.
4. The hosted CRM (app.kznettech.com)
4.1 Account data we collect
- Name, email address, and a password (stored as a one-way hash, never in readable form).
- Two-factor authentication secrets and backup codes, if you enable them.
- Billing details for paid plans. Card numbers are handled by our payment processor, Stripe. We never see or store full card numbers.
- Sign-in activity: IP address, time, and device type. We use this for security, to detect abuse, and to rate-limit repeated failed sign-ins.
- An audit log of changes made inside your workspace: who changed what, when, and the old and new values. Your workspace administrator can review it.
4.2 Workspace data we process on your behalf
Whatever you and your team put into the CRM: contacts, companies, notes, tasks, logged communications, quotes, invoices, and files. We store it, back it up, display it to your authorized users, and otherwise leave it alone. We do not read it, analyze it, sell it, share it with anyone, or use it to train any software model.
Each client's workspace is isolated from every other client's at the database level. Row-level security is enforced by the database itself, not only by application code.
4.3 What we use account data for
- To provide the service and keep your account secure.
- To bill you and send receipts.
- To send you service messages: sign-in codes, password resets, invoices, outage or security notices, and changes to our terms or this policy.
- To answer support requests.
We do not send marketing email to CRM account holders, and we do not use account data for advertising of any kind.
5. Connected accounts: Google, Microsoft, and GitHub
The CRM can connect to third-party accounts you already own so that activity shows up in your CRM automatically. Every connection is optional, is started by you, and can be disconnected at any time.
5.1 Google account data (Gmail)
When you connect a Google account, the CRM asks Google for permission to read your mail and send mail as you, and for your email address to identify the connection. This is what the CRM does with that access, and all it does:
- Auto-logging. The CRM watches for new messages from the moment you connect. When a message is to or from an email address that already exists as a contact in your CRM, the CRM saves a copy of that message to that contact's timeline. Messages that do not match a CRM contact are read only to check for a match and are not stored.
- Nothing older is imported. Connecting starts from now. Existing mail in your mailbox is never scanned or copied.
- An exclusion list you control names addresses and domains that are never logged, whatever the match.
- Sending. When you write a message in the CRM and click send, the CRM sends it through your Gmail account. It never sends anything on its own.
- Your mailbox is never changed. The CRM does not ask for permission to modify, delete, label, or mark mail as read, and it cannot.
Access tokens for your Google account are stored encrypted in our database and nowhere else. Disconnecting the account inside the CRM deletes those tokens. You can also revoke the CRM's access at any time from your Google Account's Security → Third-party access page. Messages already logged to a contact stay in your workspace, because they are your records; you can delete them like any other record.
KzNet Technologies' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used only to provide the auto-logging and sending features described above. It is not used for advertising. It is not sold. It is not transferred to anyone except as needed to provide the feature, to comply with the law, or as part of a merger or acquisition with prior notice to you. No person at KzNet Technologies reads it, except with your explicit permission to resolve a support issue, for security purposes, or where the law requires. It is not used to train or improve any machine-learning or AI model.
5.2 Microsoft 365 account data (Outlook)
Connecting a Microsoft 365 mailbox works the same way, with one difference: the CRM also asks for permission to update read state, so that reading a message in the CRM marks it read in Outlook. The same rules apply: only mail matching a CRM contact is logged, nothing older than the connection is imported, the exclusion list applies, sending happens only when you click send, and tokens are stored encrypted and deleted when you disconnect. You can revoke access from your Microsoft account's Privacy → Apps and services page.
5.3 GitHub
If you connect a repository to a client account, the CRM stores a read-only token, encrypted, and shows commit titles and links on that client's timeline. It reads nothing else from the repository and writes nothing to it.
6. Who else handles the data
We do not sell personal information and we do not share it for advertising. We use a short list of service providers to run the service. Each one handles data only to the extent needed to do its job for us.
| Provider | What it does for us | When it sees your data |
|---|---|---|
| DigitalOcean | Hosts our servers and database, in the United States. | Always. All service data lives here. |
| Stripe | Processes payments and stores card details. | When you pay for a plan or a service. |
| Resend | Delivers the email we send you: sign-in codes, receipts, notices. | When we email you. |
| Gmail access, as described in section 5.1. | Only if you connect a Google account. | |
| Microsoft | Outlook access, as described in section 5.2. | Only if you connect a Microsoft 365 account. |
| GitHub | Repository activity, as described in section 5.3. | Only if you connect a repository. |
The CRM loads an icon font from a public content-delivery network (cdnjs, operated by Cloudflare). Your browser contacts that network directly to fetch the font file, which discloses your IP address to it in the same way as loading any public web page. No account data is sent.
We will give account holders at least 30 days' notice by email before adding a provider that would handle workspace data.
We will disclose information if we are legally required to, for example by a valid court order. Where we are allowed to, we will tell you first.
7. How long we keep things
- Workspace data stays as long as your account is open. When you close your account, we give you a full export in standard formats, then delete the workspace.
- Issued quotes and invoices are never silently deleted, even by you. They are voided or cancelled and kept with a watermark so that numbering and financial records stay intact. When a workspace is deleted, we keep only the financial records we are legally required to retain, for as long as the law requires.
- Backups are taken regularly and age out on a rolling schedule. Something you delete can remain in a backup for a limited period after deletion, and disappears when that backup ages out.
- Server and sign-in logs rotate on a short schedule and are kept only as long as they are useful for security.
- Connected-account tokens are deleted the moment you disconnect the account.
8. How we protect it
- All connections use HTTPS. Nothing is served over plain HTTP.
- Passwords are stored as one-way hashes. Connected-account tokens are encrypted at rest.
- Every workspace is isolated by database-enforced row-level security.
- Two-factor authentication is available on every account.
- Repeated failed sign-ins are rate-limited and the source is temporarily blocked.
- Every change inside a workspace is written to an audit log.
If we learn of a security incident that affects your data, we will tell affected account holders without undue delay, describe what happened and what we are doing about it, and keep a record of the incident.
9. Your choices and rights
If you hold an account with us, you can at any time:
- Export everything in your workspace, in standard formats, from inside the CRM.
- Correct your account details from your profile.
- Disconnect any connected account.
- Close your account and have the workspace deleted, subject to the financial-records rule in section 7.
- Ask us what we hold about you, or ask us to delete it, by writing to privacy@kznettech.com. We answer within 30 days.
If you are a customer of one of our clients and your information is in their workspace, they are responsible for it. If you write to us instead, we will forward your request to that client within five business days and tell you we have done so. We will not act on their records without their instruction, because they are not ours to change.
Depending on where you live, you may have additional rights under laws such as the GDPR or state privacy laws. We honor those rights whether or not the law strictly requires us to.
10. Children
Our services are for businesses and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to us and we will delete it.
11. Where data is stored
Our servers are in the United States. If you use the service from outside the United States, your data is transferred to and stored there.
12. Changes to this policy
When we change this policy we update the version and date at the top and keep the current version at kznettech.com/privacy. If a change materially affects how we handle your data, we will email account holders before it takes effect.
13. Contact
Privacy questions and requests: privacy@kznettech.com
Security reports: security@kznettech.com
General enquiries: info@kznettech.com