PRIVACY POLICY.

1. Introduction

Kaching CRM Inc. (“Kaching”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at kachingcrm.com. Please read this policy carefully. By using the Service, you consent to the practices described in this Policy.

2. Information We Collect

We collect the following categories of information:

• Account information: Name, email address, phone number, company name, and billing details provided during registration.
• Usage data: Information about how you interact with the Platform, including pages visited, features used, and time spent.
• Business data: Contacts, leads, quotes, invoices, jobs, and other data you input into the CRM.
• Technical data: IP address, browser type, device identifiers, and cookies.
• Communications: Emails and messages you send to our support team.

3. How We Use Your Data

We use the information we collect to:

• Provide, operate, and improve the Platform
• Process payments and manage subscriptions
• Send transactional emails (receipts, invoices, notifications)
• Respond to support requests and inquiries
• Detect and prevent fraud and security threats
• Analyze usage trends to improve product features
• Comply with legal obligations

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Data Storage & Security

All data is stored on Supabase infrastructure, which maintains SOC 2 Type II compliance and is hosted on AWS in Canada. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

We implement industry-standard security measures including row-level security, role-based access controls, and regular security audits to prevent unauthorized access, disclosure, or destruction of your data.

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. After account cancellation, we retain data for 90 days to allow for account reactivation, after which it is permanently deleted.

Billing records and transaction logs are retained for 7 years to comply with applicable tax and financial regulations. You may request deletion of personal data not subject to legal retention obligations by contacting privacy@kachingcrm.com.

6. Third-Party Services

Kaching uses the following third-party services to operate the Platform. Each is bound by their own privacy policy:

7. Cookies & Tracking

We use cookies and similar tracking technologies to operate the Platform and improve your experience. Types of cookies used:

• Essential cookies: Required for authentication and session management.
• Preference cookies: Remember your language and display settings (e.g., NEXT_LOCALE).
• Analytics cookies: Used to understand usage patterns (anonymized).

You can control cookie settings through your browser. Disabling essential cookies may affect Platform functionality.

8. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal retention requirements).
• Portability: Request your data in a machine-readable format (CSV/JSON export).
• Objection: Object to processing of your data in certain circumstances.
• Withdrawal of Consent: Withdraw consent for non-essential data processing at any time.

To exercise these rights, contact us at privacy@kachingcrm.com. We will respond within 30 days.

9. GDPR & PIPEDA Compliance

For users in the European Economic Area (EEA), we comply with the General Data Protection Regulation (GDPR). Our legal basis for processing personal data includes: performance of a contract (providing the Service), legitimate interests (security and fraud prevention), and your consent.

For Canadian users, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25 (Bill 64). We collect only the data necessary to provide the Service and maintain a privacy management program as required by applicable law.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us at privacy@kachingcrm.com and we will take steps to delete such information.

11. Data Breach Policy

In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by applicable law.

Notification will be sent to the email address associated with your account and will include: the nature of the breach, the data affected, the likely consequences, and the measures taken or proposed to address the breach.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or a prominent notice within the Platform at least 14 days before the changes take effect.

Your continued use of the Service after changes take effect constitutes your acceptance of the updated Policy.