Privacy Policy

1. Introduction

Kloutify Inc. ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Business Leadership Intelligence platform (the "Platform").

We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. Our security controls are aligned with ISO 27001 and the NIST Cybersecurity Framework 2.0; ISO 27001 and SOC 2 Type II certification are in preparation.

2. Data Controller

Kloutify Inc., a Delaware corporation (file no. 10267333), is the data controller responsible for your personal data.

3. Information We Collect

3.1 Information You Provide

• Account information (name, email address, company details)
• Professional information (job title, industry, executive role)
• Billing and payment information (processed securely via Stripe)
• Executive profile data for KEII assessment
• Communications with our support team
• Workspace collaboration data (team invitations, member roles)

3.2 Information Collected Automatically

• Usage data (features accessed, pages viewed, time spent)
• Device information (browser type, operating system, IP address)
• Log data (access times, error logs, performance metrics)
• WebSocket presence data (online status for team collaboration)

3.3 Information from Third Parties

• Publicly available executive information for KEII scoring
• Azure Active Directory authentication data (for enterprise SSO)
• Payment processing data from Stripe

4. How We Use Your Information

4.1 Service Delivery

• Provide and maintain the Platform
• Calculate proprietary LLM KEII scores
• Generate executive influence reports and analytics
• Enable team workspace collaboration features
• Process payments and manage subscriptions

4.2 Platform Improvement

• Analyze usage patterns to enhance features
• Monitor and improve platform performance
• Develop new AI-powered capabilities
• Conduct security audits and threat detection

4.3 Communication

• Send service-related notifications
• Provide customer support
• Send workspace invitations and team updates
• Share platform updates and new features (with your consent)

4.4 Compliance and Protection

• Comply with legal obligations
• Enforce our Terms of Use
• Protect against fraud and security threats
• Resolve disputes and troubleshoot issues

5. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide Platform services
• Legitimate Interests: Platform improvement, security, and fraud prevention
• Legal Compliance: Fulfilling regulatory and legal obligations
• Consent: Marketing communications (you may withdraw consent anytime)

6. Data Storage and Infrastructure

6.1 Azure-Exclusive Infrastructure

All Platform infrastructure is hosted exclusively on Microsoft Azure with enterprise-grade security:

• Azure Container Apps for application hosting
• Azure PostgreSQL Flexible Server for database storage
• Azure Blob Storage for document and file storage
• Azure Key Vault for secrets management
• Azure Application Insights for monitoring

6.2 Dual-Region Deployment

We maintain dual-region deployment for data sovereignty and compliance:

• Azure East US: Primary region for North American users
• Azure West Europe: GDPR-compliant region for European users

7. Data Security

We implement enterprise-grade security measures to protect your data:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• bcrypt password hashing with salt
• JWT-based authentication with secure session management
• Azure Key Vault for secrets and credentials
• Helmet security headers (CSP, HSTS, XSS protection)
• Rate limiting and DDoS protection
• SQL injection prevention through parameterized queries
• Regular security audits and penetration testing
• Controls aligned with ISO 27001 and NIST CSF 2.0 (certification in preparation)

8. Data Sharing and Disclosure

8.1 Service Providers

We share data with trusted service providers who assist in Platform operations:

• Microsoft Azure: Cloud infrastructure and hosting
• Stripe: Payment processing
• SendGrid: Transactional email delivery
• Anthropic & Google: LLM KEII scoring computation

8.2 Corporate Affiliates

Data may be shared with companies in our corporate group and with service providers that help us run the Platform, only as needed for those purposes and under written terms that protect it.

8.3 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal process or government requests
• Enforce our Terms of Use
• Protect rights, property, or safety of Kloutify, users, or the public
• Prevent fraud or security threats

9. Your Privacy Rights

9.1 GDPR Rights (EU Users)

If you are in the European Union, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for marketing communications

9.2 Exercising Your Rights

To exercise any of these rights, please contact us through the Platform's contact form. We will respond to your request within 30 days as required by GDPR.

10. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy:

• Account Data: Retained while your account is active
• Transaction Records: 7 years for tax and accounting compliance
• Usage Logs: 90 days for security and performance monitoring
• Marketing Data: Until you withdraw consent

11. International Data Transfers

Your data may be transferred to and processed in the United States and European Union. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Azure data centers certified for GDPR compliance
• Data sovereignty controls for EU users (Azure West Europe)

12. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Authentication and security (required)
• Performance Cookies: Monitor platform performance and errors
• Analytics Cookies: Understand usage patterns (with consent)

You can control cookie preferences through your browser settings.

13. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware of such collection, we will promptly delete the information.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Posting the updated policy on the Platform
• Updating the "Effective Date" at the top
• Sending email notification for significant changes

Your continued use of the Platform after changes constitutes acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us through the Platform's contact form.