Last updated: 12 July 2026
Privacy policy
This privacy policy describes how Klix (the “Service”), operated as a hosted cloud product, processes personal data. It is a product template — replace operator identity and contact details before production use. It is not legal advice.
1. Who we are
The Service is provided as multi-tenant software-as-a-service. The operator of this deployment is the data controller for account and service data, and typically acts as a processor for Klix content that customer workspaces enter about their own clients and prospects (for which the customer organization is the controller).
2. Categories of personal data
Account data: name, email, password hash, role, avatar. Session data: session token, IP address, user agent, expiry. Workspace data in Klix: contacts (name, email, phone, title), companies, deals, notes, tasks, boards, files, billing parties (bill-to details, seller details), and any free-text or custom fields your team stores. Technical logs may include IP addresses and request metadata.
3. Purposes and legal bases
We process data to provide the Service (contract / legitimate interests): authentication, workspace collaboration, Klix records, billing documents, security, and support. Transactional emails (for example invoices or offers) are sent when a workspace user initiates them. We do not run advertising trackers in the product.
4. Cookies and local storage
crm_session (HttpOnly): authentication session, typically up to 30 days. locale: UI language preference. localStorage may store recent navigation items for convenience. These are essential or strictly functional; we do not set advertising cookies.
5. Subprocessors and third parties
Depending on configuration, processing may involve: PostgreSQL (database), object storage (e.g. MinIO or S3-compatible), SMTP email providers, and Cloudflare Turnstile for login bot protection (which may receive an IP address). Hosting and infrastructure providers used to run the Service are also subprocessors. A current list should be maintained by the operator.
6. International transfers
If infrastructure or subprocessors are outside the EEA/UK, the operator must implement appropriate safeguards (for example standard contractual clauses) as required by law.
7. Retention
Account and workspace data are retained while the workspace is active. Sessions expire after about 30 days of validity; expired session records are purged periodically. Activity logs, notes, and files are retained until deleted by authorized users or the workspace is closed, unless a longer legal retention applies (e.g. invoices).
8. Your rights (GDPR / similar laws)
Depending on your location, you may have rights to access, rectify, erase, restrict, or port personal data, and to object to certain processing. Account users can update profile details in Settings, download a personal data export, and request account deletion (with password confirmation). Workspace admins can delete or correct Klix records they control. For formal data-subject requests beyond self-service tools, contact the operator using the contact details published with this Service. If we process Klix contact data as a processor, we will direct end-customer requests to the relevant workspace controller where appropriate.
9. Security
We use password hashing, HttpOnly session cookies, role-based access control, and optional login bot protection. No security measure is perfect; report suspected incidents to the operator promptly.
10. Children
The Service is intended for business use and not directed at children under 16.
11. Changes
We may update this policy as the product or legal requirements change. Material changes will be reflected by updating the “last updated” date on this page.
12. Contact
For privacy requests, contact your workspace administrator or the Service operator at the support / privacy address configured for this deployment (replace this placeholder with a real contact).