Privacy Policy

This explains what personal data kitset.io holds, why, where it is processed and how long it stays. It is written to describe what the software actually does rather than to describe every thing it might conceivably do.

1. Two different roles

Where you are our customer — your billing contact, your Owner's account, the emails you send us — we are the controller of that data and this policy governs it.

Where your workspace holds data about your staff, you are the controller and we are your processor. You decide what goes in and why; we only process it to run the service on your behalf. Those terms are in the Data Processing Addendum.

2. What is stored

About the people in a workspace

Name, email address, job title, department, team, manager, cost centre, work location, role, licence type, account status, when the email was verified, when the password was last changed, and the time of the last sign-in.

About their activity

An audit trail of meaningful changes, naming the actor, what changed, a short summary and the time. Active sessions, each with a browser user-agent string, an IP address and timestamps. Failed sign-in counters, keyed to a one-way digest of the account and source address rather than to the address itself.

Content you create

Whatever the installed modules hold: vendor and contract records, purchase requests and decisions, business-system ownership and access lists with signed access reviews, policies and training with per-person acknowledgements and quiz results, handovers and their action items, employee transition checklists, asset assignments, workplace records such as incidents and visitors, KPI targets and results, calendar events, room and desk bookings, service desk tickets and their conversations, spreadsheets uploaded to Dashboards, and workflows with their run history. Some of this is personal data about your staff; you choose what to put in.

Inside your workspace, Owners and System Admins pass every permission check, so they can read every service desk ticket, including tickets in an HR or other sensitive queue.

Files

Files attached to records, plus their filename, size, type, who uploaded them and when. Stored in private object storage and served only through short-lived signed links.

Email

Queued and sent messages with their recipient, subject and body, and delivery outcomes. Addresses that hard-bounce or file a spam complaint are added to a suppression list so we stop mailing them.

Security credentials

Passwords are stored only as salted, iterated hashes and cannot be recovered. Two-factor secrets are encrypted at rest with a key kept separately from the session-signing key. Recovery codes and invitation, reset and verification tokens are stored only as one-way digests — we cannot read the original value of any of them.

Technical logs

One structured line per request: method, path, status, duration, and the workspace and user where a session was resolved. Query strings are deliberately excluded because they carry single-use account tokens. Credentials are redacted at the logging handler.

3. What is not stored

• Payment card details. Checkout happens on Stripe; we receive an identifier and a status, never a card number.
• No advertising or cross-site tracking. There are no third-party analytics, no advertising pixels and no tracking cookies anywhere on this site or in the product.
• No training data. We never use your workspace content to train machine learning models. What an AI app's provider may do with what the app reads is set by your agreement with them; see section 6.

4. Cookies

The public pages you are reading set no cookies at all. Signing in sets two: a session cookie, which is HTTP-only and, in production, secure-only; and a token used to protect against cross-site request forgery. Both are strictly necessary to operate the service and neither is used for tracking. Your browser may also keep small local preferences, which never leave your device.

The sign-in, sign-up and password-reset forms may show Cloudflare Turnstile, a check that a person rather than a script is filling them in. It runs in a Cloudflare frame, sets no cookie on this site, and sends Cloudflare your IP address and browser signals for that check alone.

5. Why we process it

• To provide the service — performance of our contract with you.
• To keep it secure — rate limiting, audit trails and session management, on the basis of our legitimate interest in preventing abuse.
• To bill you — performance of the contract and our legal obligation to keep financial records.
• To email you about the service — operational messages such as invitations, reminders and security notices are part of the service, not marketing.

6. Who else sees it

Only the providers listed on the subprocessors page, each doing one specific job under contract, and any AI app you connect yourself. We do not sell personal data, and we do not share it for anyone else's marketing. We will disclose data if legally compelled, and will tell you unless we are prohibited from doing so.

When you connect an AI app, what it reads is sent to that app's provider under your own agreement with them. That provider is one you choose, not one of our subprocessors, and the app reads only what you can see yourself, in the apps your workspace's administrators allow.

7. Where it is processed

The application and database run in Singapore, and object storage is in ap-southeast-1. Transactional email is sent through a provider in us-east-1 in the United States, which means message content and recipient addresses are transferred there. Payment processing involves the United States and Ireland. Where a transfer leaves a jurisdiction with transfer restrictions, we rely on the provider's standard contractual clauses.

8. How long it is kept

Workspace data, including the audit trail and the email log, is kept for as long as the workspace exists. We operate five automatic retention schedules and no others. Sign-in session records are deleted 30 days after the session ends, counted from when it was signed out, revoked or expired; live sessions are never removed. An AI app's connection to a person's account is deleted on the same schedule, 30 days after it ends — disconnected, at its 90-day limit or after 30 days unused; a live connection is never removed. The file a background export produces, and the file uploaded for a background import, are deleted after 24 hours. An attachment upload that was started and never finished is removed, with anything that reached storage, one day after its upload link expired; a file that finished uploading is never removed by it. When Automations is on, the record of an event it was given is deleted seven days after its workflows have handled it; the run history stays. When AI connections are on, the record of each request an AI app made is deleted 90 days after it was made. We would rather name the schedules we run than imply a policy we do not.

On termination or on request we delete workspace data within 30 days, except where the law requires us to keep it. Backups expire in the ordinary course within 30 days. The email suppression list is kept indefinitely, because forgetting that an address hard-bounced would mean mailing it again.

9. Erasing one person

A workspace Owner can erase an individual from the People screen, and we can do it on request if they cannot. It is not reversible, and it is worth being precise about what it does, because “delete” is the wrong word for part of it.

Removed: the person’s name, email address, job title, cost centre and reporting line; their password; their sessions, two-factor enrolment and recovery codes; their notifications; their permissions, group memberships and location access. Their future room and desk bookings are cancelled. Any equipment assigned to them is returned, and their access to every system record is revoked. If the Owner chooses when erasing them, the files they uploaded to company records are deleted too.

Kept, pointing at a deleted user: the audit trail, any training they completed, the record that they held a piece of company equipment between two dates, the access reviews that decided their access to a system or that they signed, the tickets they raised and the messages they wrote, and — unless the Owner chooses to delete them — the files they uploaded to company records, such as a vendor contract, a purchase quote, an asset photo or a course’s media. Your workspace is the controller of this data and in most cases needs it as evidence — who approved a purchase, who acknowledged a policy, who had the laptop, who signed off an access review — so we retain the record of what happened with the person’s identity taken off it. Where the audit trail named them in a line we can prove is about them, that name is replaced and the entry is marked as having been redacted.

What we cannot reach: free text a colleague typed. A handover note, an access review’s note, a task title, a purchase justification, a ticket’s description or reply or an uploaded file’s name may still mention the person. We count those entries and show the number when the erasure is confirmed, so nobody is told the record is clean when it is not.

Nor the rows of a spreadsheet uploaded to Dashboards: a name in a column is your data, and we cannot tell a person from a product with the same name. The person who uploaded it can delete or replace the file.

Exports. The person stays in the directory and in any register they appear in, so a count still reconciles, but the email column is blank in every CSV the product produces. The internal placeholder that replaces their address is never exported: it identifies one erased person across files, and a spreadsheet travels further than the screen it came from.

10. Your rights

Depending on where you are, you may have the right to access, correct, delete, restrict or object to processing, and to receive your data in a portable form. Much of this you can do yourself inside the product; for anything else, write to [email protected] and we will respond within 30 days.

If you are an employee of one of our customers, your employer controls your workspace data. Please ask them first; if you contact us directly we will forward your request to them and tell you we have done so.

You may also complain to your local data protection authority. In Singapore that is the Personal Data Protection Commission.

11. Security

Measures are described on the security page, including what we do not yet have. If we discover a personal data breach affecting your workspace, we will notify you without undue delay and within 72 hours of becoming aware of it, with what we know at the time.

12. Children

kitset.io is a workplace tool and is not directed at children. We do not knowingly create accounts for anyone under 16.

13. Changes

We will update the date at the top of this page when this policy changes, and give notice to workspace Owners for material changes.

14. Contact

FLOW FN PTE. LTD. (UEN 202617303Z), Singapore. Privacy: [email protected]. Data protection contact: [email protected].