KOLO HQ / LEGAL

Privacy Policy

Effective date: October 12, 2026 | Last updated: October 12, 2026

This Privacy Policy describes how KOLO HQ (“KOLO HQ,” “we,” “our,” or “us”) handles personal information in connection with the KOLO HQ websites, web application, mobile applications and related support services (together, the “Services”). KOLO HQ is a configurable business operations platform for multiple industries.

Service: KOLO HQ. Privacy contact: support@kolohq.com.

1. Our role and who this policy covers

We generally act as a controller or equivalent responsible party for account registration, website analytics where enabled, subscriptions, security, and communications relating to our own Services. When a business customer (“Workspace Owner”) uses KOLO HQ to store and manage information about its customers, staff, contractors, jobs or projects, the Workspace Owner generally determines the purposes of that processing and KOLO HQ generally acts as a processor or service provider on its behalf, subject to the applicable agreement and law. These roles may differ for particular data or jurisdictions.

Workspace Owners are responsible for providing any notices and obtaining any permissions needed for personal information they enter into the Services. To exercise rights concerning information held by a particular business in a KOLO HQ workspace, contact that business first; we may assist it with its request.

2. Information we collect and process

Account and identity: name, business email, login identifiers, workspace membership, authentication-related records, profile and account settings.
Business and workspace data: business name, contact details, industry selection, roles, user permissions, customers, leads, suppliers, team data, job sites, projects, jobs, tasks and inspections.
Documents and media: estimates, contracts, invoices, uploaded files, photos, notes, materials, schedules and any information users place inside those records.
Billing data: subscription plan, transaction identifiers, billing contact information, subscription status and invoice or payment metadata provided by our billing provider. Payment card details are generally collected and processed by the applicable payment provider, not directly by KOLO HQ.
Technical and usage data: IP address, device/browser information, session and security logs, error diagnostics, usage events and cookie or similar technology information, to the extent enabled in the deployed Services.
Support communications: messages, support requests and information you choose to provide when asking for help.
Integrations: information shared through third-party integrations that a Workspace Owner or authorized user enables, within the permissions and configuration of the integration.

Do not upload highly sensitive personal information (such as government identity records, payment card numbers, health records or children’s data) unless the Services explicitly support that processing and the Workspace Owner has an appropriate legal basis and safeguards.

3. How we use information

We process information to provide and maintain the Services; authenticate users; administer workspaces and permissions; store and display customer-provided business content; create and manage documents and operational workflows; deliver support; communicate service-related notices; manage subscriptions; investigate abuse; protect accounts and infrastructure; comply with legal obligations; and improve reliability and usability using information we are permitted to process for that purpose.

We do not claim ownership of a Workspace Owner’s business records. We do not sell workspace contents as advertising data. If we introduce new advertising, analytics, AI or automated processing features, we will update relevant notices and permissions before using information for materially different purposes.

4. Legal bases where applicable

Where laws such as the GDPR or UK GDPR apply, our legal bases for activities for which we are a controller may include performance of a contract, legitimate interests in operating and securing the Services, compliance with legal obligations, and consent where required (for example, certain nonessential cookies or marketing communications). Where we act as a processor, processing is performed on the Workspace Owner’s documented instructions, subject to law and contract.

5. Workspace sharing and permissions

Workspace Owners and authorized administrators may invite users, assign permissions, access business content and manage workspace records. Information entered into shared workspaces may be visible to other members according to their roles and permissions. KOLO HQ does not independently decide which individuals a Workspace Owner may lawfully include in its records.

6. Service providers and disclosures

We use service providers as needed to operate the Services, including hosting, database and authentication infrastructure (including Supabase), application deployment or hosting (including Vercel where used), billing and subscription management (including Paddle when activated), and email, monitoring or support providers where configured. They may process information for us under applicable contractual and legal protections. We may also disclose information to comply with valid legal demands, protect rights and safety, investigate fraud, or as part of a legitimate business transaction subject to appropriate safeguards.

Important: The final list of processors, integrations and data locations must match the production configuration. Contact support@kolohq.com with questions about service providers relevant to your data.

7. Paddle subscriptions and other payments

Where Paddle is used, it may act as Merchant of Record for KOLO HQ subscription purchases and process checkout, taxes, transaction records, renewals, refunds and supported methods such as Apple Pay where available. Paddle handles buyer payment information under its own applicable privacy notice and contractual terms. KOLO HQ may receive limited transaction and subscription information needed to administer access and support.

Payment records, invoices or receivables that Workspace Owners create inside KOLO HQ for their own clients are separate from fees paid for a KOLO HQ subscription. If third-party payment integrations are provided to Workspace Owners, those payment processors have their own terms and privacy practices.

8. Cookies and similar technologies

Essential cookies or local storage may be used for login sessions, security and preferences. Optional analytics or marketing technologies, if enabled, will be described in our Cookie Policy and subject to consent controls where required. Your browser may also allow you to manage cookies.

9. Security

We use organizational and technical measures intended to protect information, such as account access controls, infrastructure protections and permission-based workspace access. No service can guarantee absolute security. Users must safeguard credentials, configure appropriate permissions and promptly report suspected unauthorized activity to support@kolohq.com.

10. International processing

Data may be stored or accessed in countries different from your own, depending on service-provider regions, workspace configuration and support operations. Where legally required, we use an appropriate transfer mechanism and additional safeguards.

11. Retention

We retain account data and business content for as long as needed to provide the Services, fulfill lawful instructions from Workspace Owners, resolve disputes and meet applicable legal obligations. Retention periods differ by data category, subscription status and workspace ownership. Some transaction, security and compliance records may be retained after account deletion where legally required or otherwise permitted.

Live account deletion and removal of linked records are subject to authorization, technical dependencies, shared workspace ownership, lawful retention and backup cycles.

12. Account and data deletion

Users can initiate deletion through the KOLO HQ application’s account settings. If access is unavailable, they may request assistance through our public Account & Data Deletion page. Following verification, we remove eligible account data and associated personal information in accordance with the applicable request, workspace permissions and legal obligations. Deleting an individual user account does not necessarily delete records owned by a separate organization or other authorized workspace members. Owners should review their team’s and workspace’s data before deleting an entire workspace.

Account deletion and cancellation of a paid subscription are separate processes. Review our Refund & Cancellation Policy and applicable Paddle cancellation options before deleting your account.

13. Your rights and choices

Depending on your location and our role, you may have rights to access, correct, delete, export or restrict processing of your personal information, object to certain uses, withdraw consent and lodge a complaint with a competent privacy regulator. Requests can be sent to support@kolohq.com. We may need to verify identity and may direct workspace-content requests to the relevant Workspace Owner. Rights are subject to applicable exceptions.

14. Children

KOLO HQ is a business operations service and is not directed to children. Individuals must meet the minimum age required under our Terms and applicable law. We do not knowingly solicit children to open independent user accounts.

15. Changes to this policy

We may update this policy as our features, processors or legal obligations change. We will post the new effective date and give additional notice where required by applicable law.

16. Contact

KOLO HQ
support@kolohq.com

Additional platform-specific provisions

These provisions describe KOLO’s operational modules and must be checked against the deployed service and applicable law before publication.

Categories of workspace information

Workspace content may include customer contact details, service locations, vehicle or job-site information, quotations, signed documents, photos, invoices, personnel roles, tasks, inspection notes, and other records entered by users.

Roles in data processing

For data a business uploads about its clients, staff or suppliers, that business generally determines purposes and lawful basis. KOLO acts as a service provider or processor where required by the applicable data protection framework. The applicable data processing agreement should be finalized before launch.

Access controls and activity

Workspace administrators may manage member access. To secure the service we may process authentication information, access events, errors, operational logs and abuse signals, subject to configured retention policies.

Infrastructure and subprocessors

Hosting, database, storage, email authentication and payments may involve services such as Vercel, Supabase and Paddle, to the extent actually configured. A verified current subprocessor list, hosting locations and cross-border transfer measures should be published before production.

Files, retention and deletion

Uploaded documents and photos may remain in storage and backups for limited periods after removal from the application. Specific schedules, account deletion controls and export availability must match the production implementation.

Privacy requests and international rights

Applicable rights can include access, correction, deletion, portability, restriction, objection or appeal. Certain U.S. state laws and other regional laws may provide additional notices and opt-out rights. Requests are subject to identity verification and lawful exceptions.

Automated processing and marketing

This policy does not claim that automated profiling or targeted advertising exists. If such features are later introduced, KOLO must provide appropriate disclosures, choices and safeguards before deployment.