Privacy Notice

1. Overview

This Privacy Notice describes how KarmaGate LLC ("KarmaGate", "we", "us", or "our") collects, uses, shares, and protects personal information when you use our website, software, and services (collectively, the "Services").

1.1 Scope

This Privacy Notice applies to all personal information collected through:

• Our website at karmagate.com and related websites
• KarmaGate software products (Free, Pro, and Enterprise)
• Customer support and communications
• Marketing activities and events

1.2 Key Principles

We are committed to:

• Transparency: Being clear about what data we collect and how we use it
• Minimization: Collecting only the data we need for legitimate purposes
• Security: Protecting your data with appropriate technical and organizational measures
• Control: Giving you control over your personal information

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly, including:

• Account Information: Name, email address, password, organization name, job title
• Payment Information: Credit card details, billing address (processed by our payment providers)
• Communication Data: Messages, support tickets, feedback, and survey responses
• Profile Information: Profile picture, preferences, settings

2.2 Information Collected Automatically

When you use our Services, we automatically collect:

• Device Information: Device type, operating system, browser type and version
• Usage Data: Features used, time spent, interactions with the software
• Log Data: IP address, access times, pages viewed, error logs
• Location Data: Country and region based on IP address (not precise location)

2.3 Information from Third Parties

We may receive information from:

• Identity Providers: When you sign in using SSO
• Payment Processors: Transaction confirmations and fraud prevention data
• Analytics Providers: Aggregated usage statistics
• Business Partners: Referral information from authorized resellers

2.4 Sensitive Data

We do not intentionally collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data. Our software is designed for security testing, and users should not input sensitive personal data into the testing functionality.

3. How We Use Your Information

3.1 Service Provision

We use your information to:

• Provide, maintain, and improve our Services
• Process transactions and manage your account
• Authenticate users and prevent unauthorized access
• Provide customer support and respond to inquiries
• Send transactional communications (license keys, receipts, updates)

3.2 Product Improvement

We use aggregated and anonymized data to:

• Analyze usage patterns and improve user experience
• Develop new features and functionality
• Fix bugs and improve performance
• Conduct research and development

3.3 Marketing and Communications

With your consent, we may:

• Send newsletters and product updates
• Notify you about promotions and new features
• Invite you to events and webinars

You can opt out of marketing communications at any time by clicking the unsubscribe link or contacting us at privacy@karmagate.com.

3.4 Legal and Safety

We may use your information to:

• Comply with legal obligations and respond to lawful requests
• Enforce our Terms of Service and protect our rights
• Detect, prevent, and investigate fraud and abuse
• Protect the safety and security of our users and the public

3.5 Legal Bases for Processing (GDPR)

For users in the European Economic Area, UK, and similar jurisdictions, our legal bases for processing are:

4. Information Sharing

We do not sell your personal information.

4.1 Service Providers

We share information with trusted third-party service providers who assist us in operating our Services, including:

• Cloud Infrastructure: For hosting and data storage
• Payment Processors: For payment processing and fraud prevention
• Analytics Services: For understanding usage patterns
• Customer Support Tools: For managing support requests
• Email Services: For sending transactional and marketing emails

These providers are bound by contractual obligations to keep your information confidential and use it only for the purposes for which we disclose it to them.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Court orders, subpoenas, or other legal processes
• Requests from law enforcement or government authorities
• Protection of our rights, privacy, safety, or property
• Emergency situations involving potential threats to safety

4.3 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.

4.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

5.1 Retention Periods

5.2 Account Deletion

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we need to retain certain information for legal purposes or to resolve disputes.

6. Security Measures

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

6.1 Technical Measures

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Regular security assessments and penetration testing
• Intrusion detection and prevention systems
• Access controls and authentication mechanisms
• Regular security updates and patching

6.2 Organizational Measures

• Employee security training and awareness programs
• Access limited to personnel who need it for their roles
• Confidentiality obligations for all employees and contractors
• Incident response procedures
• Regular security audits

For more information about our security practices, please visit our Security page.

7. Your Rights

Depending on your location and applicable laws, you may have the following rights regarding your personal information:

7.1 Right to Access

You have the right to request a copy of the personal information we hold about you and information about how we process it.

7.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal information.

7.3 Right to Erasure

You have the right to request deletion of your personal information in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.

7.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal information in certain circumstances.

7.5 Right to Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format and to transmit it to another controller.

7.6 Right to Object

You have the right to object to processing of your personal information based on legitimate interests, including for direct marketing purposes.

7.7 Right to Withdraw Consent

Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time.

7.8 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@karmagate.com. We will respond to your request within 30 days. We may request verification of your identity before processing your request.

7.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal information violates applicable data protection laws.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing activities and to distinguish you from other users.

8.1 Types of Cookies We Use

8.2 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored on your device
• Delete cookies individually or all at once
• Block third-party cookies
• Block all cookies from specific websites

Please note that blocking essential cookies may affect the functionality of our website.

8.3 Do Not Track

Our website does not currently respond to "Do Not Track" signals. However, you can manage tracking through your browser's cookie settings.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

9.1 Transfer Safeguards

When we transfer personal information outside of the European Economic Area, UK, or other regions with comprehensive data protection laws, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with all sub-processors
• Additional technical and organizational measures as appropriate

9.2 Data Residency Options

Enterprise customers may have options for data residency in specific geographic regions. Please contact us for more information about data residency options.

10. Data Processing Agreement

This section constitutes a Data Processing Agreement ("DPA") between you as the data controller and KarmaGate LLC as the data processor, as required under GDPR and similar data protection regulations.

10.1 Definitions

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on Personal Data.
• "Data Controller" means you, the entity that determines the purposes and means of processing.
• "Data Processor" means KarmaGate LLC, which processes Personal Data on behalf of the Data Controller.
• "Sub-processor" means any third party engaged by KarmaGate to process Personal Data.

10.2 Processing Instructions

KarmaGate will only process Personal Data in accordance with your documented instructions, including:

• Providing the Services as described in these Terms
• Complying with other reasonable documented instructions that are consistent with these Terms
• Processing required by applicable law (we will inform you unless prohibited)

10.3 Security Obligations

KarmaGate will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data in transit and at rest
• Measures to ensure ongoing confidentiality, integrity, availability, and resilience
• Regular testing and evaluation of security measures
• Process for restoring availability and access to Personal Data in case of incident

10.4 Sub-processors

You authorize KarmaGate to engage sub-processors to assist in providing the Services, subject to:

• Written agreements with sub-processors imposing equivalent data protection obligations
• Notice to you of any intended changes to sub-processors with opportunity to object
• KarmaGate remaining liable for sub-processor compliance

10.5 Data Subject Rights

KarmaGate will assist you in responding to requests from data subjects exercising their rights under applicable data protection law, including requests for access, rectification, erasure, restriction, portability, and objection.

10.6 Data Breach Notification

KarmaGate will notify you without undue delay upon becoming aware of a Personal Data breach affecting your data. The notification will include:

• Nature of the breach including categories and number of data subjects affected
• Contact details of our data protection officer or other contact
• Likely consequences of the breach
• Measures taken or proposed to address the breach

10.7 Audit Rights

KarmaGate will make available information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, conducted by you or an auditor mandated by you.

10.8 Return and Deletion

Upon termination of the Services, KarmaGate will, at your choice, delete or return all Personal Data and delete existing copies unless retention is required by applicable law.