Legal
Privacy Policy
Draft. Highlighted [PLACEHOLDERS] must be filled and the text reviewed by a lawyer before launch.
This policy explains how [LEGAL NAME] ("KiteTrack", "we") handles personal data.
1. Two kinds of data
- Our customers' data (you, the business using KiteTrack): we are the controller.
- Your website visitors' and customers' data that passes through your tracking server: you are the controller, we are the processor. Our Data Processing Agreement covers this.
2. Data we collect about our customers
- Account details: name, email, company, website, password (stored hashed).
- Billing details: handled by Lemon Squeezy; we receive plan, status and invoices, not full card numbers.
- Setup details: IDs for your ad, analytics and CRM accounts, and access you grant.
- Support and chat messages, including messages to our AI assistant.
- Usage of our website and dashboard (privacy-friendly analytics).
3. Why we use it
To provide and support the Service, bill you, send alerts and reports, keep the Service secure, and improve it. Legal bases (where GDPR applies): contract, legitimate interests, legal obligation, and consent for marketing emails.
4. Visitor data processed for you
Your tracking server may receive events such as page views, purchases and form submissions, with data like IP address, user agent, click IDs, order value and, if you send them, email and phone. Email, phone and similar identifiers are hashed before they are sent to ad platforms. We process this data only on your instructions to deliver the Service.
5. Who we share data with (sub-processors)
| Provider | Purpose |
|---|---|
| Stape | Server-side tracking infrastructure |
| Lemon Squeezy | Payments, tax, invoices |
| Our VPS / hosting provider | Hosting the KiteTrack app and database |
| Cloudflare | Security, DNS, backups storage |
| Resend | Sending emails |
| Anthropic | AI assistant in chat |
| Our chat inbox provider | Human support chat |
| Ad and analytics platforms you connect (Meta, Google, TikTok, etc.) | Receiving events you choose to send |
We do not sell personal data.
6. International transfers
Providers may process data outside your country. Where required we rely on appropriate safeguards such as standard contractual clauses.
7. How long we keep data
- Account and billing records: while you are a customer, then as long as the law requires.
- Event data in our dashboard: only as long as needed to show your dashboard and alerts; daily totals are kept longer for trends.
- After you leave: we delete your tracking server and account data within [X] days, unless the law requires us to keep it.
8. Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, or object to some uses. Email support@kitetrack.io. You can also complain to your local data protection authority.
9. Security
Encryption in transit, hashed passwords, two-factor login for our team, access logs for every staff action on customer accounts.
10. Cookies
Our website uses only essential cookies and privacy-friendly analytics. [Confirm with lawyer whether a cookie banner is needed.]
11. Contact
[LEGAL NAME], [ADDRESS] · support@kitetrack.io