Privacy policy

Khitamo is run by [name to be added], a sole trader based in the United Kingdom, at [postal address to be added]. You can contact us about privacy at support.khitamo@gmail.com.

We handle personal data in two different roles:

• As a controller for data about the businesses that use Khitamo and the people who work for them: your account, your messages to us, and how you use the product. This policy mainly covers that.
• As a processor for data about our customers' own clients that we read from their payment platform. The business that connected the platform is the controller of that data, and we handle it on their behalf under section 6 of our terms. See section 9 below if you're one of those clients.

• Account details: your name, business name, email address and password. Your password is stored as a secure one-way hash, so we can never see it. We also record when you accepted our terms.
• Connection details: your payment platform business ID and API key. The key is encrypted, and we only ever show its last 4 characters.
• Payment data from your platform: payment plans, payment dates and amounts, failed payments and their decline reasons, and your clients' names and email addresses.
• What you enter in the app: call list statuses and notes, integrations you ask us to build, and your answers on the recovery early-access list.
• Messages you send us: emails and social media messages, and anything in them.
• Technical data: our hosting and database providers keep short-term logs of requests, which include IP addresses and browser details, for security and troubleshooting.

• To provide Khitamo to you, including running your audit, building your call list and keeping you signed in. Basis: performing our contract with you.
• To keep Khitamo secure, prevent misuse and fix problems. Basis: our legitimate interest in running a safe, reliable service.
• To reply to you and to tell you about Khitamo features you've asked about, such as an integration or recovery becoming available. Basis: our legitimate interests, and you can ask us to stop at any time.
• To meet legal obligations, such as keeping tax records once we charge for Khitamo. Basis: legal obligation.

We don't sell personal data, and we don't use it for advertising.

We only use the cookies needed to keep you signed in to the app. We don't use analytics, tracking or advertising cookies, so there's nothing to opt out of. If we ever add any, we'll ask you first.

We use a small number of providers to run Khitamo. They only handle data on our instructions:

Where data is handled outside the UK, we rely on the safeguards UK law requires, such as UK adequacy regulations or the UK's approved data transfer agreements. We'll update this list before adding a new provider. We'll only share data with anyone else if the law requires it.

• Your account is kept until you delete it from the Account page.
• Your API key, audits and call list notes are kept until you disconnect your payment platform or delete your account.
• Messages you send us are kept for as long as we need them to help you, and no longer than two years after we last hear from you.
• Request logs are kept by our providers for a short period, usually days to weeks.

When you delete something, it's removed from our live systems straight away. Any copies in our providers' backups are removed as those backups expire.

Your API key is encrypted before it's stored. Every account's data is separated by strict database access rules, so one customer can never see another's. All traffic to Khitamo is encrypted in transit. Read more on our security page.

Under UK data protection law you can ask to see the personal data we hold about you, correct it, delete it, limit how we use it, object to how we use it, or receive a copy to take elsewhere. You can update your details and delete your account yourself from the Account page. For anything else, email support.khitamo@gmail.com. We'll reply within one month.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

If a business you bought from uses Khitamo, it shared your payment details with us so we can help it keep track of its payment plans. That business decides how your data is used, so please contact it first about your rights. If you contact us, we'll pass your request on to it and help it respond.

Khitamo is a business tool and isn't meant for anyone under 18.

If we make an important change, we'll email you or tell you in the app before it takes effect. The date at the top always shows when this policy last changed.

Email support.khitamo@gmail.com or write to us at [postal address to be added].