Privacy Policy

← Back to Home

1. Data Controller

The data controller responsible for the processing of your personal data is:

KJXX Systems Corp.
274 South 600 East, Suite 210
Salt Lake City, UT 84102, United States
Email: privacy@kjxx.com
Phone: +1 (801) 436-7182

For data protection inquiries specifically, contact our Privacy Officer at privacy@kjxx.com.

2. Data We Collect

We collect and process the following categories of personal data:

Account Data

• Name, job title, and employer organization
• Business email address and phone number
• Account credentials (password stored as salted hash)
• Role and permission assignments within the platform

Usage Data

• Feature interactions, session duration, and navigation patterns
• Project data entered into the platform (schedules, inspection records, delivery logs)
• Notification preferences and delivery history

Technical Data

• IP address, browser type, operating system, and device identifier
• Access timestamps and referral source
• Error logs and performance diagnostics

3. How We Use Data

We process personal data exclusively for the following purposes:

• Service delivery: Operating the KJXX platform, processing project data, and facilitating coordination between project stakeholders
• Transactional notifications: Sending safety alerts, delivery confirmations, schedule updates, inspection results, and billing receipts triggered by operational events
• Billing & invoicing: Processing subscription payments and generating financial records
• Security: Detecting unauthorized access, preventing fraud, and maintaining platform integrity
• Legal compliance: Fulfilling regulatory obligations and responding to lawful requests from authorities
• Service improvement: Analyzing aggregate usage patterns to enhance platform performance and reliability (no personal profiling)

4. Legal Bases for Processing (GDPR)

For individuals in the European Economic Area (EEA) and United Kingdom, we rely on the following legal bases:

Purpose	Legal Basis
Platform operation & service delivery	Performance of contract (Art. 6(1)(b))
Transactional notifications	Performance of contract (Art. 6(1)(b))
Billing & payments	Performance of contract (Art. 6(1)(b))
Security & fraud prevention	Legitimate interest (Art. 6(1)(f))
Legal compliance	Legal obligation (Art. 6(1)(c))
Service improvement (aggregated)	Legitimate interest (Art. 6(1)(f))

5. No Data Selling

KJXX Systems Corp. does not sell, rent, lease, or trade your personal data to any third party. We do not participate in data broker networks. We do not monetize user data through advertising or profiling. Your data is processed solely to deliver and maintain the Service.

6. Sub-Processors

We engage the following categories of sub-processors to operate the Service:

Sub-Processor	Purpose	Location
Amazon Web Services (AWS)	Cloud infrastructure, compute, storage, and database hosting	US-West-2 (Oregon)
Mailgun (Sinch)	Transactional email delivery (SMTP relay)	United States
Stripe	Payment processing and billing	United States

Each sub-processor is contractually bound to process data solely on our instructions and to maintain appropriate security measures.

7. International Data Transfers

KJXX primarily processes data within the United States. When personal data originating from the EEA, UK, or Switzerland is transferred to the U.S., we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• The EU-U.S. Data Privacy Framework, where applicable;
• Supplementary technical measures including encryption in transit (TLS 1.3) and at rest (AES-256).

8. Data Retention

We retain personal data only as long as necessary to fulfill the purposes described in this Policy:

Data Category	Retention Period
Account data	Duration of account + 30 days post-deletion
Project data (inspections, schedules, deliveries)	Duration of account + 90 days for export
Email delivery logs	90 days
Access & authentication logs	12 months
Billing & payment records	7 years (tax and legal requirements)
Support tickets & communications	3 years
Consent records	Duration of relationship + 5 years

9. Your Rights — GDPR

If you are located in the EEA or UK, you have the following rights under the General Data Protection Regulation:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restriction: Request that we restrict processing under certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Where processing is based on consent, withdraw at any time

To exercise any of these rights, email privacy@kjxx.com. We will respond within 30 days. You also have the right to lodge a complaint with your local Data Protection Authority.

10. Your Rights — CCPA

California residents have the following rights under the California Consumer Privacy Act (as amended by the CPRA):

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected
• Right to delete: Request deletion of personal information, subject to certain exceptions
• Right to opt-out of sale: We do not sell personal data; therefore, no opt-out mechanism is necessary
• Right to non-discrimination: Exercising your privacy rights will not result in discriminatory treatment

To submit a CCPA request, email privacy@kjxx.com or call +1 (801) 436-7182. We will verify your identity and respond within 45 days.

11. Cookies

KJXX uses strictly necessary cookies only:

• Session cookie: Maintains your authenticated session while using the platform. Expires when you close your browser or after 24 hours of inactivity.
• CSRF token cookie: Protects against cross-site request forgery attacks. Session-scoped.

We do not use advertising cookies, tracking pixels, analytics cookies, or any third-party cookies. No consent mechanism beyond session cookies is required as these cookies are essential for platform security.

12. Data Security

We implement comprehensive technical and organizational measures to protect your data:

• Encryption in transit: All connections secured with TLS 1.3
• Encryption at rest: AES-256 encryption for databases and object storage
• Access controls: Role-Based Access Control (RBAC) enforced across all systems
• Multi-factor authentication: Required for all administrative and employee accounts
• Vulnerability management: Regular security assessments and patch management
• Incident response: Documented incident response plan with 72-hour GDPR breach notification
• Employee training: Annual security awareness training for all staff

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When material changes are made:

• We will provide at least 30 days' advance notice via email to registered account holders;
• The "Last Updated" date at the top of this page will be revised;
• Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

14. Contact

For any privacy-related questions, requests, or concerns:

Privacy Officer
KJXX Systems Corp.
274 South 600 East, Suite 210
Salt Lake City, UT 84102, United States
Email: privacy@kjxx.com
Phone: +1 (801) 436-7182