1. Who we are
Kitstak is operated by Kitstak, headquartered in Bentonville, Arkansas, United States. Inquiries and rights requests go to privacy@kitstak.com.
2. What we collect
We collect the data necessary to operate the service:
- Account information: name, email, organization, role.
- Operational data: customers, orders, inventory, financial records you enter or import.
- Technical telemetry: request logs, IP addresses, browser metadata, error reports.
- Communication: support tickets, contract negotiation correspondence, billing exchanges.
3. How we use it
We use the data to deliver and improve the service, to fulfill contracts, to comply with law, and to communicate with customers about their accounts. We do not sell customer data.
4. How we protect it
- Encryption in transit (TLS 1.2 or higher) on every connection.
- Encryption at rest on the primary database.
- Row-level security so customers see only their own data.
- Append-only audit logs with tamper-evident hash chain.
- Access reviews on a defined cadence; least privilege by role.
- Multi-factor authentication for staff users.
5. Data residency
At launch, all customer data is stored in the United States (us-west-1). European Union residency is on the roadmap; until then, customers requiring EU residency should contact us before signing.
6. Sub-processors
We use a small set of vendors: Supabase for database and authentication, Vercel for hosting, and a transactional email provider. A current sub-processor list is available on request.
7. Your rights
You can access, correct, export, or delete your personal data. For customer organizations subject to GDPR or CCPA, a Data Processing Addendum is available. Email privacy@kitstak.com.
8. Retention
We retain customer data for the life of the contract plus a defined wind-down window after termination. Idempotency cache rows are purged at seven days. Audit log rows are retained for the regulatory horizon applicable to financial records.
9. Children
Kitstak is a business tool. It is not intended for and is not directed to children.
10. Changes
Material changes to this policy are announced in-app and by email to administrators of paying customers thirty days before they take effect.
Contact
Kitstak Privacy Inquiries
team@kitstak.com
Bentonville, AR