Privacy Policy

Who we are

KiteGTM is a product of Inkris Technologies Inc., a company incorporated in the Province of Ontario, Canada, with its head office at 500 4 Ave SW, Calgary, AB T2P 2V6, Canada. For anything in this policy, including a request about your own data, write to support@kitegtm.com.

What we collect

When you sign in with Google

We request the openid, profile and email scopes. Google returns your name, email address, and profile picture. Signing in does not give us access to your Gmail, Drive, Calendar, or contacts. If you connect a mailbox or calendar later so KiteGTM can run outreach for you, we ask for those permissions separately, and each one is described below.

When you sign in with Microsoft

We request the openid, profile and email scopes. Microsoft returns your name, email address, and the identifiers of your account and of the organisation it belongs to, which is how KiteGTM recognises you the next time you sign in. Signing in does not give us access to your mailbox, files, calendar, or contacts. Connecting a Microsoft calendar is a separate step, described below.

When you connect Google Calendar

Connecting a Google calendar is optional. It lets KiteGTM offer times you are free and put a meeting in your calendar when somebody agrees to one. You grant three permissions, and KiteGTM uses each only for this:

• calendar.calendarlist.readonly, to see the list of your calendars, so KiteGTM knows which calendar and address you connected
• calendar.freebusy, to see when you are free or busy, so the times KiteGTM offers are times you can actually take
• calendar.events.owned, to create the meeting somebody agreed to on a calendar you own, to check that meeting afterwards, and to show your upcoming meetings in KiteGTM so nothing is booked on top of them

We store the address of the calendar you connected, the settings you choose for it in KiteGTM, the meetings KiteGTM books, and the access Google gives us, which is encrypted. Other events are read when they are needed. Calendar-derived times and meeting details may also appear in your saved conversations and booking history. To write a reply that offers times, KiteGTM gives our AI provider, OpenAI, the times you are free, not your events. If you ask KiteGTM about your calendar, it reads your upcoming events to answer you. If you authorize a connected AI app to request calendar information, that app can receive the information needed to answer your request, as described below.

We do not sell Google user data, use it for advertising, or use it to develop, improve, or train generalised AI or machine-learning models. This includes raw Google data and information aggregated, anonymised or derived from it. Our Google-data processing serves the calendar and scheduling features described above. We use OpenAI directly through its API to process information needed for these features. OpenAI does not use API inputs or outputs to train its models by default, and sharing for model improvement is disabled in our API organization. This no-training protection is separate from retention: OpenAI may retain data under its standard API retention policy, including for abuse monitoring. See OpenAI’s API data controls. People at KiteGTM do not read it unless you ask us to, it is needed for security, or the law requires it. KiteGTM’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting the calendar in KiteGTM deletes the access we stored for it. You can also remove KiteGTM from your Google account at any time at myaccount.google.com/permissions.

When you connect a Microsoft calendar

Connecting an Outlook or Microsoft 365 calendar is optional and does the same job as a Google calendar. You grant three Microsoft Graph permissions, and KiteGTM uses each only for this:

• Calendars.ReadWrite, to see when you are free or busy so the times KiteGTM offers are times you can take, to create the meeting somebody agreed to, to move or cancel that meeting when they ask, and to show your upcoming meetings in KiteGTM so nothing is booked on top of them
• User.Read, to read your name and address, so KiteGTM knows which Microsoft account you connected
• offline_access, so KiteGTM can keep booking meetings without asking you to sign in to Microsoft again

We store the address of the account you connected, the settings you choose for it in KiteGTM, the meetings KiteGTM books, and the access Microsoft gives us, which is encrypted. Your other events are read when they are needed and are not kept. We do not sell this data, use it for advertising, or use it to train AI models, and the same limits on our AI providers apply as for Google Calendar above.

Disconnecting the calendar in KiteGTM deletes the access we stored for it. You can also remove KiteGTM from your Microsoft account at any time at account.live.com/consent/Manage for a personal account, or at myapps.microsoft.com for a work or school account.

When you connect Zoom

Connecting Zoom is optional. It lets KiteGTM put the calls your prospects agree to on your own Zoom account, each with its own meeting link. You grant these Zoom permissions, and KiteGTM uses each only for this:

• meeting:write:meeting, to create a Zoom meeting for a call that was booked, on your account
• meeting:update:meeting and meeting:delete:meeting, to move a meeting KiteGTM created when the prospect asks for another time, or remove it if it was created in error
• meeting:read:meeting and meeting:read:list_meetings, to read the time and join link of a meeting KiteGTM created, and the start times of your other scheduled meetings, so nothing is booked on top of them
• user:read:user, to read your Zoom name, email address, and user ID, so KiteGTM knows which Zoom account you connected

We store the Zoom account you connected (its email address and user ID), the ID, time, and join link of each meeting KiteGTM creates, and the access Zoom gives us, which is encrypted. The times of your other Zoom meetings are read when they are needed and are not kept. KiteGTM never joins, records, or reads the content of a Zoom meeting. We do not sell this data, use it for advertising, or use it to train AI models.

Disconnecting Zoom in KiteGTM deletes the access we stored for it. You can also remove KiteGTM in the Zoom App Marketplace under My library. Zoom then tells us, and we delete the stored access and your Zoom user ID as soon as that notice arrives. Meetings already created stay on your Zoom account. The Zoom guide has the steps.

When you connect an AI app

Connecting an AI app such as Claude, ChatGPT or Codex is optional. It lets you ask about your KiteGTM workspace, and act on it, from that app. The app connects only after you sign in to KiteGTM and press Allow.

• We store which app you allowed (the name it gave itself), when you allowed it, and the access we issued to it
• We keep a record of each request the app makes, as we do for everything done in your workspace
• The app receives the KiteGTM records it asks for. These can include the names, companies, job titles, email addresses and messages of the people you are in conversation with
• Calendar information requested through the connection, and calendar-derived meeting times and details already included in workspace conversations

Connected AI apps are separate from KiteGTM’s own OpenAI API account. Their processing and retention depend on the provider’s terms, your plan and your account settings. When using Google-derived information, you must use a plan and settings that exclude that information, including conversation content derived from it, from generalised model training. Do not opt in to training or submit that information as model-improvement feedback. KiteGTM cannot inspect or change the training settings in your external AI account. The AI apps data-protection guide explains the settings to check.

KiteGTM does not use what an AI app sends it to train AI models. You can disconnect an app at any time under Settings, AI apps, which ends its access at once. The AI apps guide has the steps.

When you build a market

• The description of the market you type
• The qualification criteria you select or write
• The markets, the people matched to them, and the introductions that follow
• Business contact information about the companies and decision-makers in your market. Where it comes from, and how a person can have it removed, is set out under “People in KiteGTM’s business-contact data” below

Automatically

• When first-party measurement is enabled, we store public page observations and University search intent categories, helpfulness reactions, reading depth, media actions and product/help clicks in our existing website storage. We do not use Vercel Web Analytics for this measurement or send it to a paid analytics provider. We do not store raw search queries, prompts or private URLs in these events
• Standard server logs, including IP address and browser user agent
• When website storage is enabled, first-party page visits and market-building and import events associated with a random visitor identifier. These activity events are retained for 90 days.
• A public first landing page, referring hostname and recognised campaign labels. If you create an account, we can associate that first touch and a public University resource reference with the confirmed creation. A content-assisted signup does not establish that the content caused it, or that you activated or paid for Kite

This website runs no advertising pixels and no cross-site trackers. There is no Google Analytics, Tag Manager, Meta, or LinkedIn tracking on it.

In the KiteGTM app

• A record of what happens in your workspace and who did it. It covers the changes you and your teammates make, in the app, on the phone, through Ask Kite, through a connected AI app or with an API key. It covers what KiteGTM does for you: the people it sources, the messages it drafts and sends, how it decides to answer a reply, the meetings it books and the credits it uses. It covers what prospects and providers report back, such as replies, bounces, bookings and unsubscribes. It also notes when you open a conversation or a contact, or export a list. It points to your messages rather than copying them.
• Each sign-in and sign-in attempt: the time, your browser, operating system and type of device, your IP address and your approximate location (city, region and country)
• In the app and the mobile app, the pages you open and how long you stay, the buttons and links you press, errors and notices shown to you, searches and downloads. We never record what you type into a field.

What we store in your browser

• A session cookie once you sign in, so you stay signed in. It is HTTP-only and strictly necessary for the product to work.
• When online saving is enabled, an HTTP-only visitor cookie that lasts 90 days. It lets you return to your website market before signing up. Your saved website records are separate from product accounts and can be linked when you import after signing in.
• Your light or dark theme preference, in localStorage
• A first-party cookie, kite_first_touch, that lasts 90 days. It holds a referring hostname, recognised campaign labels and public landing page. First touch is preserved. The raw cookie is never sent to an analytics provider
• A separate HTTP-only kite_university_assist cookie lasts 30 days. It holds the latest eligible public guide or story reference, version and timestamp after ten visible seconds. An opaque HTTP-only kite_university_visitor cookie lasts 90 days; only its hash is used in event records, without changing saved market drafts or account profiles. First-party events are retained for 90 days. Confirmed-signup records use a private keyed deduplication value, not your email, sign-in code, session or account identifier. Browser blocking, disabled storage and recording failures can leave attribution unavailable
• The market you are part-way through building, in sessionStorage, so it survives the sign-in redirect. It is cleared when you close the tab.

Saved website markets and sharing

When online saving is enabled, we retain your market description, result, and qualification settings on our server as well as the current draft in your browser. Saved records remain until deleted; closing the tab does not delete the server copy. Contact support to request deletion.

Sharing creates an unlisted link containing your count, locations, buying roles, and company cards. Anyone with the link can view that snapshot. Your private notes, raw description, and people's names are not included. You can turn off the link from the sharing controls. Importing into your account preserves a record connecting the website market and its destination.

People in KiteGTM’s business-contact data

This section is for people KiteGTM may find or contact for its customers, most of whom have never used KiteGTM.

What we hold

Your name, job title, employer, work email address, LinkedIn profile address, and business phone number. A direct number, which can be a mobile, is looked up only when a customer asks for it. We also hold the role that matched a customer’s target, the evidence for that match, and the history of any conversation a customer has with you through KiteGTM. KiteGTM does not look up personal email addresses.

Where it comes from

KiteGTM compiles business-contact information from public professional and business sources, including company websites, and business-contact sourcing and verification services. Customers can also upload contacts they already hold. The source depends on the record; you can ask us where your details came from. Customers are responsible for having obtained their uploads lawfully.

Why we hold it and who receives it

We use these details so that KiteGTM customers can find and contact the business decision-makers most relevant to what they offer, and so that we can stop anyone who should not be contacted from being contacted. A customer receives the details of the people KiteGTM matches to its market, and messages them through KiteGTM by email, LinkedIn or text.

• UK and EEA: where these laws apply, we rely on legitimate interests (Article 6(1)(f) of the GDPR and UK GDPR) for professional contact discovery and relevant business introductions. These interests are balanced against your rights and reasonable expectations. You can object to this processing, including direct marketing, by contacting us. Channel-specific consent requirements, including consent for SMS, apply separately.
• Canada: we use the business-contact-information exception only for information used solely to communicate with you about your employment, business or profession. Other personal information is handled under the applicable privacy requirements.
• California: the categories are identifiers and professional or employment-related information, from the sources and for the purposes described above. Providing contact details to paying customers may constitute a sale under the CCPA/CPRA. You can request access, correction, deletion, and an opt-out of this disclosure at the address below. We offer the removal process regardless of where you live, do not discriminate for exercising privacy rights, and do not use this data for cross-context behavioural advertising.

Having yourself removed

Email privacy@kitegtm.com to request removal from KiteGTM’s business-contact dataset. You do not need a KiteGTM account or a relationship with any of our customers. Include enough information to locate your record, such as your work email, LinkedIn profile address or phone number. We may ask for proportionate information to verify a deletion or access request when necessary.

Our team handles requests manually. We apply a suppression entry across KiteGTM workspaces to prevent future sourcing and outreach, and manually remove your business-contact details from our active dataset and saved sourced-contact copies. We keep only the minimum information needed to honour your request and prevent reintroduction, and any records we are legally required to retain. We explain any applicable retention exception. Opt-outs are applied promptly; we respond to requests within one month or any shorter applicable legal deadline and confirm what we have done.

If details have already been disclosed, we notify relevant recipients when required by applicable law. A customer may have independently collected information or have a separate lawful reason to retain a conversation; we assess those records as part of the request rather than treating every conversation as exempt from deletion.

This dataset-removal route is separate from a customer’s outreach opt-out. Replying “stop” to a message, or STOP to a text, stops that customer’s outreach on the channels we can link to your identity. An email unsubscribe stops that customer’s emails.

Customers remain responsible for the lawfulness of the targeting they define and of contacts they upload, as set out in our Terms of Service.

Why we are allowed to hold it

We handle personal information under Canada’s Personal Information Protection and Electronic Documents Act. We collect it to provide the product you asked for, to keep the service secure, and to understand aggregate usage. Where a law that applies to you requires consent, we ask for it, and you can withdraw it at any time.

We keep the activity record and sign-in details to keep your account secure, to show you and us exactly what happened in your workspace and who or what did it, and to support you. We keep page and press records, and where you came from, to understand how the product is used, to improve it, and to understand which channels bring customers.

Who else sees it

The recipients below receive data for the purposes described in this policy, limited to what is needed for those purposes:

• Vercel, for hosting and delivery
• Google, when you choose to sign in with it or connect a Google calendar
• OpenAI, our AI provider, which reads what KiteGTM needs to write and read messages, including the times you are free when you connect a calendar. It does not train on this data
• Microsoft or Zoom, when you connect them: the details of a meeting KiteGTM books (its time, title, and who it is with) go to the calendar or Zoom account you connected
• The AI app you connect, such as Claude, ChatGPT or Codex: the records it asks KiteGTM for, which can include your prospects' names, email addresses and messages
• Stripe, to process payments if you take a paid plan. We never see or store your full card details.
• Communication and data providers used to run outreach and verify contacts on paid plans, including email, SMS, and business-contact sourcing and verification services
• KiteGTM customers, who receive the business contact details of the people matched to their markets, as described under “People in KiteGTM’s business-contact data”
• Infrastructure providers that store your workspace data and send service email such as sign-in links, password resets, and account notices
• Your teammates. In your workspace, owners and admins can see the whole activity record, including their teammates' sign-ins. Members see their own actions and what KiteGTM did. Ask Kite reads the record to answer your questions about what happened.
• KiteGTM support staff, who can see the activity record to support you and keep the service secure. Actions our staff take in your workspace are recorded too.

We do not sell account sign-in, billing or website-visit information. Disclosures of business-contact information to customers are described above. We do not share personal information for cross-context behavioural advertising.

Where it goes

We are a Canadian company and our providers operate in Canada and the United States, so your information may be processed outside the country you live in and may be accessible to law enforcement there under local law. Where information leaves the UK or EEA we rely on Standard Contractual Clauses.

How long we keep it

• Account data, for as long as your account is open
• Markets, people, introductions and conversation history, for as long as your account is open
• Billing records, audit logs, and communication records, for longer where we are required to keep them for legal, tax, or compliance reasons
• Access to a connected Google or Microsoft calendar or Zoom account, until you disconnect it, remove KiteGTM from that account, or close your account
• An AI app's access, until you disconnect it or close your account
• Server logs, for a limited period for security, troubleshooting, and abuse prevention, then deleted on a rolling basis
• The activity record, available in the app for 90 days. Each day is then kept in a sealed archive for two years, so it can still be shown, unaltered, if a question about it comes up, and is then deleted.
• Sign-in history, for 180 days

Cancelling a paid plan does not delete anything. Closing your account removes your workspace. Ask at support@kitegtm.com and we will action it within 30 days.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw a consent you previously gave. Email support@kitegtm.com and we will respond within 30 days.

Depending on where you live you may have further rights. California residents can ask what we collected, ask us to delete it, and are protected from discrimination for exercising those rights. Residents of the UK or EEA have rights of access, rectification, erasure, restriction, objection, and portability. If you are unhappy with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to your local data protection authority.

If you are in KiteGTM’s business-contact data rather than a customer, write to privacy@kitegtm.com, as described above.

Children

KiteGTM is a business product and is not directed at anyone under 18. We do not knowingly collect their information.

Changes

If we change this policy materially we will update the date above and tell account holders by email before it takes effect.