What we hold, who can see it, and how to get it back.

This policy covers the Kinetel service, which is operated by Norivant Holdings, LLC, a New Mexico limited liability company. It took effect on 30 September 2026.

There are two kinds of people in it, and the distinction matters. You are our customer — you have an account. Your customers are the people whose orders and delivery addresses you put into the product. For their data we are a processor acting on your instructions: you decide what goes in and what comes out, and we handle it for you.

Three categories, and nothing outside them.

Your account. Names and email addresses of your team, hashed passwords, roles, your company name and industry, and your billing contact. We never see your password, and card numbers go to Stripe directly without touching our servers.

Your warehouse. Everything you put in: products, costs, inventory, lots and expiry dates, purchase orders, vendors, orders, and your customers' names and delivery addresses. Photographs you upload for shipment verification.

How the service is used. An audit trail of who did what and when, error reports when something breaks, and request logs. These carry identifiers and actions rather than the contents of your inventory.

We do not use tracking cookies or third-party advertising or analytics on the product. The only cookie the application sets is the one that keeps you logged in.

• To run the service you are paying for — that is what almost all of it is for.
• To bill you, and to keep the invoice records that tax law requires.
• To send you the mail the service needs to send: verification, password resets, low-stock alerts, payment failures.
• To keep the service secure and working — rate limiting, audit trails, error alerting.
• To answer you when you get in touch.

We do not sell your data. We do not share it for anyone else's marketing. We do not build a profile of you for advertising, and there is nowhere in the product where that would even be useful.

This is the question people ask first, so it gets its own section rather than a clause buried in the one above. Text and photographs are handled differently, so it is worth taking them in turn.

Text goes to a commercial AI provider. When you paste an order, match a product name, ask the copilot a question or generate a forecast narrative, the text of that request is sent to our AI provider over their commercial API — along with the catalogue rows needed to answer it, and nothing else. We hold a commercial agreement with terms that prohibit training on our traffic and provide no retention beyond answering the request. It is not a consumer chat service, where the data terms are entirely different.

Photographs are checked here first. When a packer photographs a box, the barcode reading, the label text and the image-quality scoring all run on a computer-vision service hosted alongside your warehouse data. None of that leaves, and it settles the large majority of parcels — a clean barcode read never goes anywhere.

Only a frame those checks cannot decide is escalated to our AI provider's vision model, under the same zero-retention terms as the text above. That escalation is deliberate and infrequent: it is the exception the deterministic checks could not resolve, not the routine path.

In no case is your data used to train a model — not ours, and not the provider's. It is not shared between tenants, and no model has a connection to your database or the ability to browse it.

A warehouse can require the photograph without the checking. Some do: the picture is what answers a customer who says the box arrived empty, and that works whether or not anything analysed it. Where a warehouse has switched the automated checking off, the photograph is stored and nothing reads it — no computer-vision service, no AI provider, no model of any kind. It is kept, and deleted, on exactly the same terms as the paragraph below.

A warehouse can choose to send a packing photograph to the supplier whose goods are in the box. It is off unless they switch it on, per supplier, and it is narrow when they do: the photograph goes only with orders assigned to that supplier, never with an order that mixes several, because the picture is of the open box and would otherwise show one supplier another's products alongside the customer's label. The image is resized for email and stripped of its camera metadata, including the location a phone records, before it leaves. This is the warehouse's decision about its own evidence and its own supply chain; we do not send these anywhere on our own account, and switching it off stops it from the next night.

Photographs are deleted after 30 days by default. A scheduled sweep removes the image itself — escalated or not — while the evidence drawn from it stays with the order: the barcodes read, the label text, the verdict, and any override a supervisor made. So an old decision remains reviewable, and the picture of somebody's parcel does not sit on a disk indefinitely.

The warehouse can set that window itself, between 7 and 365 days, because a business that has to answer a payment dispute months later needs longer than one that does not. Thirty days is what applies unless they change it, and the ceiling is deliberate: a warehouse wanting these images for years should be keeping its own copy rather than making us the long-term custodian of its customers' doorsteps.

The results — a parsed draft, a forecast, a verification verdict — are stored in your account like any other record, so you can review them later and see what was decided.

These are the services we rely on to run Kinetel. Everything marked optional only applies if you choose to connect it.

We will update this list before adding anyone new to it. If you want to be told when that happens, ask and we will add you to the notice.

The short version: we do not delete your warehouse because you stopped paying, and we do delete it when you ask.

While your account is active

We keep your data for as long as you have an account, because it is the record of your warehouse and deleting it on a schedule would be deleting your books.

After a trial ends without a subscription

Nothing is deleted. The account goes read-only and you can still read and export everything. We hold it for at least 90 days so you have time to decide or to get your data out.

After you cancel

Same: read-only, exportable, retained for at least 90 days. Ask us to delete it sooner and we will.

When you ask us to delete

We remove the tenant and everything belonging to it — products, inventory, orders, customers, users and audit history — within 30 days. Encrypted backups age out on their own cycle within 90 days.

Fulfilment photographs

Deleted 30 days after they are taken, by a nightly sweep. Only the picture goes — the barcodes read from it, the label text, the verdict and any override stay with the order, because those are the audit trail and the photograph is not. Nobody reviews a frame from three months ago; keeping one forever was a cost with no benefit.

Order drafts, and the text they were parsed from

A draft you rejected is deleted 30 days later; an approved one 90 days after it was created. This matters more than it sounds: a draft holds the first few thousand characters of whatever was pasted in, which for an emailed order is the customer's own message — their signature, their phone number, whatever else they wrote. The order that came out of it is the record worth keeping; the email is not.

Webhook deliveries

The body of each event sent to your endpoints is kept for 30 days after it settles, then deleted. Long enough to answer “we never received that one”, short enough that we are not the long-term custodian of your order contents in a second place. Deliveries still being retried are never swept, however old.

Waitlist sign-ups

Deleted after 180 days if they never became an account. Somebody who gave us an address once and then went quiet should not be on our disk indefinitely.

Billing records

Invoices and payment records are kept for as long as tax and accounting law requires, which is longer than the rest. That is the one category we cannot delete on request.

Your customers' data is yours, and the requests about it come to you. For the data you put into Kinetel about your own customers, you are the controller and we are the processor: you decide what is collected and why, and we hold and process it on your instructions. If one of your customers asks what you hold about them, or asks you to erase it, the request is yours to answer — and the product gives you the means to. Every customer record can be exported in full, with their order history, as a single file you can send them; and any customer can be erased, which removes their name, email, phone and street address from their record and from the shipping details of every order they placed, while leaving the order, its contents and its lot history intact so your traceability and your books still work. Both actions are recorded in your audit log.

Depending on where you are, you may have rights under the GDPR, the UK GDPR, the CCPA or similar law. We apply the following to everyone rather than checking your postcode first.

• Get a copy. Every table is exportable as CSV and through the REST API, on every plan, without asking us. If you want it in another form, ask.
• Correct it. Nearly everything is editable in the product. Anything that is not, we will change for you.
• Delete it. Ask and we will remove your tenant and everything in it within 30 days, apart from billing records we are required to keep.
• Object or restrict. Tell us what you object to and we will either stop or explain why we cannot.
• Complain. To us first, please — but you can go to your data protection authority, and we will not hold it against you.

Write to support@kinetel.io and we will answer within 30 days. If you are asking about data belonging to your customers, come to us and we will help you action it.

The same collection described above, mapped to the categories the CCPA names in §1798.140(v)(1) and to the lawful basis we rely on under GDPR Art. 6. A category listed as none is none — it is here so you can see we considered it, not left it out.

The short version of this table, given at the point we ask you for anything, is the Notice at Collection.

This distinction decides who you should be writing to, so it is worth two minutes. It is not a formality we inherited from a template — it is the same split the software enforces.

Do we sell or share your personal information? We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have never done either. There is no advertising pixel, analytics script or tag manager anywhere in this product — the only cookie it sets is the one that keeps you signed in.

We do not knowingly collect personal information from anyone under 16, and we have never sold or shared the personal information of a consumer we knew to be under 16.

Sensitive personal information. We do not collect sensitive personal information as the CPRA defines it — no government identifiers, no precise geolocation, no racial or ethnic origin, no religious beliefs, no union membership, no genetic or biometric data, no health data, and no contents of your mail, email or texts. Your account password is a credential. It is stored only as a one-way hash, is used only to sign you in, and is never sold, shared, disclosed, or used to infer anything about you — which is the limited use the statute permits without a separate right to limit.

Global Privacy Control. If your browser sends the Sec-GPC signal we read it on every request and treat it as an opt-out of sale and sharing, as 11 CCR §7025 provides. You can see whether we are receiving it, and set the rest of your choices, at Your Privacy Choices.

Non-discrimination. Exercising any of these rights changes nothing about your price, your plan, or the service you get. §1798.125 forbids it, and we would not want to anyway.

Authorised agents. Somebody may make a request on your behalf. We will ask for your written authorisation and will still verify you directly, because an agent request we accept without checking is a disclosure to whoever sent it.

How long we take. 45 days, extendable once by a further 45 where the request is complex (§1798.130). We aim to answer inside 30 days for everyone, whichever regime applies.

Shine the Light (§1798.83). We do not disclose personal information to third parties for their own direct marketing purposes, so there is nothing to request under it.

CalOPPA. This policy is reachable from the footer of every public page and from beside every form that asks you for anything. It states the categories we collect and who we share them with, describes how you can review and change your information, and carries an effective date that changes when the policy does. We do not respond to browser Do Not Track headers in any other way than the GPC handling described above — there is no standard for what a DNT header should mean, and claiming to honour one would be claiming more than we can define.

Who is responsible. Norivant Holdings, LLC is the controller for the processing listed as Controller in the table above. For everything you put into the product we are a processor and you are the controller.

Lawful bases. The per-category table above names the basis for each one. In short: contract where we need the data to give you the service you asked for, legitimate interests for keeping the service secure and working and for answering you when you write, and legal obligation for billing records and for the log of privacy requests. Where we rely on legitimate interests we have weighed them against your rights, and you can object.

We do not currently rely on consent for anything, which is worth saying plainly rather than listing it as an option we never exercise: there is no non-essential cookie to consent to and no marketing list separate from the waitlist you asked to join. If that changes, consent will be asked for before the processing starts, not assumed until you withdraw it.

International transfers. The service is operated from the United States, so personal data of people in the EEA or the UK is transferred there. [COUNSEL REVIEW REQUIRED] Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with the UK International Data Transfer Addendum are the intended mechanism. Norivant Holdings, LLC is putting executed agreements in place with each subprocessor; until they are signed, this is stated as intent rather than as a completed control.

Automated decision-making. Nothing here makes a decision with a legal or similarly significant effect on you without a person involved. The AI features described above suggest and draft; a human decides.

Data Protection Officer. [COUNSEL REVIEW REQUIRED] No Data Protection Officer is appointed. Art. 37 does not appear to require one on current processing — no large-scale systematic monitoring, no large-scale special category data — but this should be assessed before EU customers are onboarded.

EU/UK representative (Art. 27). [COUNSEL REVIEW REQUIRED] No Art. 27 representative in the EU or UK is designated yet. One is required if we offer the service to people in those territories without an establishment there.

Complaints. If you are in the EEA or the UK you can complain to your local supervisory authority — in the UK, the Information Commissioner's Office at ico.org.uk. We would rather you came to us first, and it will not count against you either way.

How long we take. One month, extendable by two further months for complex requests (GDPR Art. 12(3)). We aim to answer inside 30 days for everyone, whichever regime applies.

Exercise any of them through the privacy request form, or email support@kinetel.io. There is no charge and no account required.

Two are strictly necessary and exempt from consent under the ePrivacy Directive Art. 5(3) and its UK equivalent: one keeps you signed in, the other remembers your privacy choices.

There are no others. No analytics script, no advertising pixel and no tag manager exists anywhere in this product, which is why you have not been asked to dismiss a banner to read this. The consent machinery is built and the switches are at Your Privacy Choices — they are simply not switching anything at the moment.

How consent works here. Non-essential categories are off until you turn them on — never on until you object. We ask once, with accept and reject the same size and one click apart, and we do not treat carrying on browsing as agreement. Withdrawing is the same switch you granted with, and takes effect on the next page load.

Refusing costs you nothing. No feature is withheld, no page is blocked, and the price does not change — a cookie wall that makes refusal expensive is not asking a question, and §1798.125 forbids it in California regardless.

Tenant isolation is enforced in the code and checked by the test suite. Connected store credentials are encrypted at rest. Passwords are hashed. Roles limit what each person can do, and privileged actions are checked on the server. Backups are restored on a drill rather than assumed to work.

The detail is on the security page, written for the person filling in a vendor questionnaire.

If there is ever a breach affecting your data, we will tell you what happened, what was affected and what we did — without waiting to have a comfortable version of the story.

Your data is stored on infrastructure we operate. Some of the services in the table above — payment processing, email delivery — may process data in other countries.

The service is operated from the United States, so personal data of people in the EEA or the UK is transferred there. [COUNSEL REVIEW REQUIRED] Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with the UK International Data Transfer Addendum are the intended mechanism. Norivant Holdings, LLC is putting executed agreements in place with each subprocessor; until they are signed, this is stated as intent rather than as a completed control.

If you have a requirement that your data stay in a particular jurisdiction, tell us before you sign up rather than after.

If we change anything that materially affects you, we will email you before it takes effect. Minor corrections get a new effective date at the top. We will not quietly edit this page and hope nobody notices, because the only value a policy has is that it can be relied on.