Privacy policy

Who we are

Kitso builds and runs websites for small businesses, with a portal and apps for the work those websites bring in. This policy covers kitso.co.uk, the portal you sign in to, our apps, and the websites we build.

We are Kitso Ltd, trading as Kitso, a company registered in England and Wales with company number 17371967, with its registered office at 74 Lanehouse Road, Stockton-on-Tees, TS17 8EA. We are registered with the Information Commissioner's Office under number ZC263453.

Write to privacy@kitso.co.uk about anything in this policy, including any request about your own data. We answer within one month.

The free website checker

The first check reads the public website address you supply and up to three linked pages, returning findings in your browser. If you request a detailed audit, we read up to 20 public pages and save your name, email, website address, any business details supplied, request time, permission and a summary of the result. We use these to provide the audit and respond about its findings. This does not create a customer account or subscribe you to unrelated marketing.

We send the website address to Google PageSpeed Insights for a mobile speed test. If you add a business name and town or postcode, we send those details to Google Maps Platform to find public listings. We read further listing details only after you select a business. Google handles these requests under its own privacy policy at https://policies.google.com/privacy.

We use these details to carry out the check you request. Our legitimate interests are providing the free checker and preventing misuse. Short-lived request counters use your network address to limit excessive checks; normal hosting and security logs may also record requests. Google listing results are not stored by the checker.

We hold two different roles

For your own account and business details we are the controller. We decide what they are used for, and this policy is our account of that.

For the enquiries and bookings your customers send, the details of your customers you keep in the portal, and the records of your team, we are only the processor. You are the controller of those. The data processing agreement covers that side and forms part of our terms.

What we collect, why, and on what basis

Everything below is collected because you gave it to us, because you asked for a feature that needs it, or because it is created by using the service. We ask for no special category data at any point.

You do not have to give us any of it. Without your name, your email address and your business details we cannot open an account or build your website, because our contract with you depends on them. Everything else is optional, and leaving it out only means the feature that needs it stays off.

Details we get from somewhere other than you

Most of what we hold comes from you. Some comes from elsewhere, and each of these is explained further down:

• The Facebook page you choose and the website you already have, if you ask us to read them.
• Public business listings and the Companies House register, to check and fill in your business details.
• Your Google Business Profile, where you add us as a manager: its details, reviews and figures.
• Stripe, which tells us whether a payment went through, the state of your subscription, and the state of your own Stripe account if you take payments.
• The business that invited you, if you are a member of its team: your name and email address.
• The person whose referral link you followed: that you came through it.
• Your customers, who send enquiries and bookings through your website, or message your Facebook page or Instagram account once you connect them. Those are yours, and we hold them for you.

Connecting your Facebook page

You can sign in with Facebook and choose one of your Facebook pages, so we can fill in your details from what is already on it. It is optional, and everything it fills in can be typed instead. Facebook asks you to approve what we may see, and we ask for the least that makes it work:

• pages_show_list: the names and ids of the pages you manage, so you can pick the right one.
• pages_read_engagement: the details, photographs, recent posts and recommendations of the page you pick.
• public_profile: your name and profile picture, which Facebook includes with any sign in. We do not put it on your website.

What we do with what Facebook gives us

We read the page you chose once, and put what we find in front of you as suggestions to confirm or correct. That includes your business details, photographs, the words of your recent posts, any recommendations and any review you posted as a picture, which our AI provider reads to make the suggestions. Recommendations and reviews may name other people, and those names are used only to offer you the review. Nothing reaches a live website without you agreeing to it, and a review reaches it only once you confirm it is genuine.

We do not keep the access token Facebook issues. It sits in a cookie no script can read, is deleted the moment the page has been read, and lapses within the hour if the page never is. Nothing of ours runs against your page afterwards.

To stop the same page being read over and over, we count reads from one connection using a one way hash of the day and your network address rather than the address itself.

• We never post anything to Facebook, to your page or to your profile.
• We never read your own private messages, your friends, or a page you did not choose.
• We never sell, share or advertise with anything Facebook gives us, and none of it is used to train any model.

Facebook and Instagram messages

Once you are a customer you can connect your Facebook page, and the Instagram account linked to it, so the messages people send them arrive in your portal as enquiries and you can reply from there. It is optional and separate from reading your page at sign up. For it Facebook asks you to approve more:

• pages_show_list and business_management: the pages you manage, so you can pick the right one.
• pages_read_engagement: which Instagram account is linked to the page you pick.
• pages_manage_metadata: to ask Facebook to send us the messages your page receives.
• pages_messaging: to show you messages sent to your page and send the replies you write.
• instagram_basic and instagram_manage_messages: the same for the Instagram account linked to your page.

What we do with your messages

We keep each message, the sender's name as Facebook or Instagram shows it to your page, and the replies you send, as an enquiry in your portal. They are your records, kept for you like an enquiry from your website, shown only to you and the people on your team who can see enquiries. A photo or file somebody sends is not copied to us: your portal says one was sent.

To keep the connection working we hold the access token Facebook issues for your page, encrypted, until you disconnect or delete your account. It is used only to receive your messages, read the sender's name and send the replies you write. We never send a message you did not write.

Disconnecting Facebook, and deleting what came from it

Reading your page at sign up leaves nothing standing. A messages connection is disconnected from Connected apps in Business details, which tells Facebook to stop sending us your messages and deletes our access token. The messages already in your portal stay as your enquiries until you delete them or your account. If you would rather remove us at Facebook's end as well, open Settings and privacy, then Settings, then Apps and Websites, find Kitso and remove it.

That does not by itself remove the business details you already confirmed, because those are now the content of your website. Ask us and we will remove them. The data deletion page explains how.

Reading your existing website, and public records

If you give us the address of a website you already have, we read its public pages once for your business details, logo, colours, photographs and any reviews, as suggestions for you to confirm, and keep the logo and some photographs for your new site.

We may also look your business up in public business listings and on the Companies House register. What we find arrives as suggestions you confirm or correct.

How we use AI with your details

We use AI providers in parts of the service. They act as our processors, on terms that limit them to returning an answer to us and do not let them train their models on what we send. Nothing an AI writes reaches your live website until you or a person here has approved it, and no AI makes a decision about you with a legal or similarly significant effect.

The phone app asks you first: once before you first use Kit, and once before the first photograph or receipt you add in it, because a photograph you add is checked by AI and a receipt is read by AI. Those screens name the companies. If you say no, nothing is sent. You can take your agreement back in the app under More, then Sign in and alerts, then AI on this phone (a team member finds it on More itself), and the app forgets it when you sign out. In a browser, Kit asks the same question the first time you use it there, and clearing this site's data in your browser makes it ask again. Taking it back stops anything more being sent. It does not undo what was already checked or answered.

We use AI to:

• Suggest your business details from what you give us at sign up.
• Plan your website, and help our team design and write it from what you give us.
• Check photographs and logos before they can be shown.
• Read a receipt you photograph, to fill in a cost.
• Prepare material for approval before anything is published, such as a blog post or a description of a photograph.
• Sort the feedback you send us about your preview.
• Run Kit on the Kitted plan.

Kit

Kit is the assistant in your portal on the Kitted plan. What you type to it, and the parts of your website and portal records it needs to answer you, which can include your customers' names and contact details, are sent to our AI provider. If you talk to Kit, your voice is sent to a speech provider to be turned into words, and we keep the words, not the sound. Kit asks before you use it the first time.

Kit never acts on its own: everything it prepares happens only when you press the button. Your conversations are kept so you can see what was asked and done, and you can ask us to delete them.

Reviews and your Google profile

Where you add us as a manager of your Google Business Profile, we read its details, reviews and figures, keep its details in step with your website, and make the changes or replies you ask for. Those reviews are already public.

You can also add a review somebody gave you directly. It carries the reviewer's name, roughly when it was, and your confirmation that it is genuine and unedited, which we keep, timestamped, as the record that you attested it. We never write, reword, shorten or invent a review.

Your customers, your team and your work

When you keep customer records, take bookings, run jobs, send quotes and invoices, ask for reviews or invite your team, the details you and they enter are yours. We store them, show them to you and send what you ask us to send, and the data processing agreement covers them.

Emails to your customers go in your business's name, with replies going to you. When a quote or invoice link is opened, downloaded, answered or paid we record that and when, so we can tell you. We record no address or device details about the person opening it.

Where a job shows how far away it is, the phone's location is used on the phone to work that out and is not sent to us. Only the job's postcode is looked up.

If you connect accounting software, we send it your invoices and the customers on them.

People who visit the website we build for you

We count visits without cookies. There is no consent banner on your site because nothing we run on it needs one.

We record the page, where the visitor came from, whether they tapped your phone number or a booking button or used your form, and a visitor value that changes every day, so one day's visits cannot be matched to the next and we cannot use it to pick anybody out. The value is worked out from the visitor's network address and browser details, which are used for that moment and not stored.

Where your site shows a map of your premises, the map is loaded from Google. Google then receives the visitor's network address and may set its own cookies, under Google's own terms and not ours.

Enquiries your customers send you

When somebody fills in the form on your website, their details are yours rather than ours. We store the enquiry, check it for content we cannot accept, email it to you, notify you in the other ways you have asked for, send them an automatic reply if you have switched that on, and show it to you in your portal and the app. Any photographs they attach are emailed to you and not kept by us.

We do not sell enquiries, mine them, advertise with them or use them to train anything. The data processing agreement is the full account of this.

Payments

Payments to us are taken by Stripe. We never see, hold or store your card number: it is entered on Stripe's own page and stays with them. What we keep is a reference to your Stripe customer and subscription, what you are paying, when, your invoices, and any refund, credit or free month.

Where you take payments from your own customers, your business has its own Stripe account. Stripe asks you for identity and business details to open it, under Stripe's own privacy notice. We receive the account's status and a record of each payment, so we can show them in your portal and take our fee of 0.2% of each payment.

Team members

If you are a member of a business's team, that business gave us your name and email address to invite you, and it decides what you see and what is recorded, such as the jobs you are on and the hours you clock. It is the controller of those records and we hold them for it. We are the controller of your login, and use your name and email address only to run it. If you delete your login, it is removed straight away.

Our apps and notifications

The portal is available in a browser, on your phone's home screen, and where we offer one as an app from an app store. The app shows the same account and the same records as the portal, and this policy covers it in the same way.

If you allow notifications, we keep a registration for your device so we can tell you when something happens, such as an enquiry, a booking or a payment. A browser notification goes through your browser maker's push service, encrypted so they cannot read it. An app notification goes through a notification service to the company that makes your phone's software, and shows what it is about, such as an enquirer's name and number. You can turn notifications off at any time.

To work without signal, the app can keep a copy of your recent records on your phone. It stays on your device and is removed when you sign out.

The app carries no advertising and no analytics or tracking software, and we do not track you across other companies' apps or websites.

The app asks your phone for a few things, each only when you use the feature that needs it:

• The camera and your photographs, when you add a photograph, a logo or a receipt. It sees only the ones you pick.
• The microphone, when you talk to Kit.
• Your location, while the app is open, to show how far away a job is. It is worked out on the phone and is not sent to us.
• Notifications, if you allow them.
• Saving to your photographs, when you save a design we made for you.

If we got in touch with you first

Sometimes we build an example website for a business that has not signed up with us, from what that business has made public, and get in touch to show it. Where the business is a person, such as a sole trader, those details are personal data. We rely on our legitimate interest in showing our work to a business it may suit, and we keep the example until it is taken up or taken down.

The example is kept out of search engines. If it is about your business and you would rather it was gone, or you do not want to hear from us again, tell us at privacy@kitso.co.uk and we will take it down, delete what we hold and not contact you again.

Who else touches your data

These are the kinds of company that handle personal data on our behalf. Each is bound by a contract that limits it to what we instruct and requires it to protect your data to at least the standard in this policy. If you ask, we will tell you which companies we use today.

• Companies House is a public register we look your company up in. It receives only the name or number we search for.
• Your domain's details are also passed to the registry for its ending, which publishes what the law requires and withholds the rest.
• Accounting software you connect receives your invoices on your instruction, under your own agreement with it.
• Where a website we build shows a Google map, the visitor's browser fetches it from Google directly.
• The data processing agreement names the companies that handle your customers' details.

Where your data is

Our database, our backups and the sites we serve are hosted in the United Kingdom or the European Economic Area.

Some of the companies above are based in the United States and will process data there. Where that happens, the transfer is made under a safeguard UK data protection law recognises: the UK extension to the EU-US Data Privacy Framework where the company is certified under it, or otherwise the UK International Data Transfer Addendum to the European Commission's standard contractual clauses.

How long we keep things

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

How we look after it

Data is encrypted in transit. Passwords are stored so that nobody here can read yours, and the keys to accounts you connect are stored encrypted. Access to the systems that hold your data is limited to the people who need it, and each time a person here opens your portal as you see it, that is recorded.

If there is a breach affecting your personal data we will tell you without undue delay, and report it to the Information Commissioner's Office where the law requires.

No automated decisions about you

Nothing here makes a decision about you that has a legal or similarly significant effect without a person involved. Moderation can hold content back, and when it does it goes to a person to look at and you are told.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to it, or ask for it in a portable form. Where we rely on your consent, such as notifications, tips by email, analytics on our marketing site or what you agreed to about AI in the app, you can withdraw it at any time, and this policy and the cookie policy say how for each. You can object to anything we do on the basis of legitimate interest.

You can download your own data from Sign in and alerts in your portal straight away. You can also delete your account yourself, there or in the app. It happens at once, it takes your website down and it cannot be undone. The data deletion page sets out exactly what is removed and what is kept.

For anything else, write to privacy@kitso.co.uk. We answer within one month. If you are one of our customers' own customers, ask that business first, because it decides what happens to your details.

Children

This is a service for businesses and it is not directed at children. We do not knowingly collect personal data from anybody under 18. If you think we have, tell us and we will delete it.

Changes to this policy

If we change this policy we update the date at the top. Where a change materially affects you, we will tell you rather than expecting you to notice.

Complaining

If you are unhappy with how we have handled your data, tell us first at privacy@kitso.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk or on 0303 123 1113.