KickSplit, LLC ("KickSplit", "we", "us") provides this Privacy Policy to explain how we collect, use, and process data for our CRM and Commission platform (the "Service").
Who This Policy Applies To: This policy primarily applies to the Customer / Billing Owner (the company subscribing to the Service). If you are an employee of the Customer ("Tier 3") or a consumer/client of the Customer whose data is stored in our CRM ("Tier 4"), your data is controlled by the Customer. KickSplit processes this data solely at the direction of the Customer.
1. Data We Collect and Process
- Account & Billing Data: We collect names, emails, and payment details from the Billing Owner. (Payment processing is securely handled by Stripe; we do not store full credit card numbers on our servers).
- Employee Compensation Data (Tier 3): We process employee names, phone numbers, commission rates, and payout histories as configured by the Customer.
- Consumer Data (Tier 4): We process names, addresses, project details, and unstructured free-text notes regarding the Customer's clients.
- Analytics: We use Vercel Analytics to collect basic system performance and engagement metrics to improve the Service.
2. How We Use the Data
We use the data to:
- Operate and maintain the Service (e.g., executing commission calculations).
- Provide customer support. (Note: Authorized support personnel may access customer information when reasonably necessary to diagnose technical issues or provide requested support).
- Create anonymized, aggregated, and de-identified datasets for product improvements, marketing case studies, industry benchmarking, and training artificial intelligence (AI) or machine learning models.
3. Data Storage and Subprocessors
Your data is securely processed and hosted in the United States (specifically utilizing AWS infrastructure in the East US region). As a Data Processor, we utilize the following subprocessor vendors to provide the Service:
- Supabase: For primary database hosting and encrypted authentication.
- Vercel: For application hosting and serverless computing functions.
- Stripe: For secure subscription billing and payment processing. (We do not store full credit card numbers on KickSplit servers).
- Resend: For transactional email delivery.
- Vercel Analytics: For frontend performance monitoring and analytics.
Additional subprocessors may be added over time. A current list will be maintained on our website.
4. Data Deletion and Your Rights
Because KickSplit operates as a Data Processor for the Customer:
- Employees and Consumers: If you wish to request the deletion or modification of your personal data, you must contact the employer (the KickSplit Customer) directly. We cannot delete your data without explicit instruction from the Billing Owner.
- Data Lifecycle: If a Customer cancels their account, access to the Service is retained for 30 days and data is retained for 60 days. Export is available during the first 30 days. After 60 days, tenant data is eligible for permanent deletion and is deleted from our primary production systems in the ordinary course. Data may persist in encrypted backups until those backups cycle out of retention.
5. Security Disclosures
We employ industry-standard security measures, including row-level database security, hashed passwords, and data encryption in transit via TLS. However, no system is entirely impenetrable. We do not currently hold independent security certifications (such as SOC 2). We continually improve our security controls as the platform matures. In the event of a data breach, we will notify the Customer in accordance with applicable state laws.
6. Changes to this Privacy Policy
We may update our Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify the Billing Owner of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top. Continued use of the Service following notice of such changes constitutes your acceptance of the revised Privacy Policy.