1. Who we are
kitagency.co is operated by Karki Innovative Technologies. For personal data collected through this website and through the platform at app.kitagency.co, we act as the data controller. Where we operate a website on a client’s behalf, we act as a processor for the visitor data collected on that client’s site. Data requests go to sales@kitagency.co.
2. What we collect
Lead and enquiry data
When you submit the audit form or request a booking slot, we collect your name, email address, optional phone number, business name, current website URL, your stated growth goal, the plan you are interested in, and any notes you add.
Booking data
Appointment requests record the slot you selected, the session type, your contact details and any notes, so we can confirm or reschedule the call.
Visitor analytics and heatmap data
We record page views, referral source, approximate location derived from IP, device and browser type, session duration, and interaction data used to build heatmaps — clicks, cursor movement and scroll depth. Heatmap capture records interaction coordinates, not the contents of anything you type.
Chatbot conversation logs
Messages you send to the site assistant are stored along with its replies and a session identifier, so conversations can be reviewed, attached to a lead record and used to improve the answers. Do not send payment details or sensitive personal information through the chat.
Uploaded documents used for RAG
Client accounts can upload PDFs and other documents to train their assistant. These are stored, converted into vector embeddings and retrieved to ground answers. They are scoped to the uploading account and are never used to answer another tenant’s questions or to train third-party foundation models.
Newsletter data
If you subscribe, we store your email address, the date you subscribed, and delivery and engagement events for the messages we send you.
Account and billing data
For clients, we hold account details, tier, seats, credit balances and usage. We never see or store your card details — payments are processed by Paddle as Merchant of Record, and we receive only a transaction reference and subscription status.
3. Why we process it, and on what basis
- To respond to your enquiry and run the audit call — on the basis of steps taken at your request prior to a contract.
- To deliver the subscription you bought — performance of a contract.
- To understand and improve site performance — our legitimate interest in operating an effective service, balanced against your privacy.
- To send the newsletter — your consent, withdrawable at any time from the unsubscribe link in every message.
- To meet tax and accounting obligations — legal obligation.
4. Where it is stored and who can reach it
Data is stored in MongoDB on managed cloud infrastructure, with uploaded media held in cloud object storage behind a CDN. Every record carries a tenant identifier, and queries are scoped to it, so one client’s CRM data is not reachable from another client’s account.
Access controls we apply:
- Encryption in transit (TLS) and at rest
- Role-based access, with production data limited to staff who need it to support you
- Session-based authentication on the dashboard, with every route behind an auth gate except the login page
- API access scoped by key, with browser requests restricted to explicitly allowed domains
6. How long we keep it
- Lead and enquiry records — 24 months from last contact, then deleted
- Chatbot conversation logs — 12 months, then deleted
- Analytics and heatmap data — 14 months in identifiable form, then aggregated
- Newsletter subscriptions — until you unsubscribe, plus a suppression record so we do not mail you again by mistake
- Client account data — for the life of the subscription, plus 30 days after termination
- Uploaded training documents — until you delete them, or 30 days after termination
- Billing records — as long as tax law requires, typically 6–7 years
7. Your rights and how to use them
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted
- Receive your data in a portable format
- Object to or restrict processing based on legitimate interests
- Withdraw consent for marketing at any time
Email sales@kitagency.co from the address on the record. We respond within 30 days, and we may ask for enough information to confirm it is your data you are asking about. Client accounts can also export leads to CSV directly from the dashboard at any time.
If your data was collected on a website we operate for one of our clients, we will pass your request to that client as the controller and help them action it.
9. Children
The service is for businesses and is not directed at anyone under 16. We do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.
10. Changes and contact
We update this policy as the platform changes, and material changes are notified to clients by email. The date at the top of this page reflects the current version.
Privacy questions, data requests and complaints: sales@kitagency.co. You also have the right to complain to your local data protection authority.
kitagency.co is operated by Karki Innovative Technologies. Questions about this document go to sales@kitagency.co.
This page is published as part of our Paddle Merchant of Record compliance and should be reviewed by your own counsel before you rely on it.