Privacy policy

1. Who we are

Kithwork is a client portal for creative studios and freelancers. This policy explains how we handle personal data about the people who use it: studio owners and their teams, and the clients they invite. It follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Our two roles

We are the controller for your account, sign-in, billing, support conversations and the security records about how Kithwork is used. We decide why and how that data is used.

We are a processor for what a studio puts in its workspace: its clients' details, projects, files, messages, approvals and feedback. The studio is the controller of that content and decides how it is used; we only handle it to provide the service, under our data processing agreement. If you are a studio's client and have a question about your data in their portal, ask the studio first. We'll help them answer it.

3. What we collect

• Account details: name, email address, a hashed password (never the password itself), and whether you've verified your email.
• Two-step verification: if you turn it on, an encrypted authenticator secret and encrypted backup codes.
• Sessions and security: a session cookie, and the IP address and browser that created each session. Short-lived counters of sign-in attempts protect against password guessing.
• Workspace content: clients, projects, milestones, files, approvals, feedback, comments, messages and branding added by you, your team or your clients.
• Activity records: who did what and when in a workspace (for example, who approved a design), so teams can see what happened.
• Billing: if a workspace pays, Stripe collects the card and billing details. We keep only Stripe's customer and subscription identifiers, the plan and its status.
• Support and requests: what you write to us, and records of any data protection request you make.
• Email delivery: whether an email to you bounced or was reported as spam, so we stop sending to that address.
• Errors: if error monitoring is enabled, technical details of crashes (browser, device type, the error). We set it up not to collect names, email addresses, cookies or what you typed.

We don't use advertising or analytics trackers, and we don't sell or rent personal data. We don't make decisions about you by purely automated means that have legal or similarly significant effects.

4. Why we use it, and our lawful basis

• To provide Kithwork (your account, sign-in, workspaces, portal access, the emails the service needs to send): performance of our contract with you, Article 6(1)(b).
• To keep it secure (sessions, rate limits, audit logs, investigating misuse and incidents): our legitimate interest in protecting the service and its users, Article 6(1)(f).
• To take payment and keep accounts: contract, and our legal obligation to keep tax records, Article 6(1)(c).
• To help when you ask (support, data requests): contract, legitimate interests, and our legal obligations under UK GDPR.
• To fix bugs (error monitoring): our legitimate interest in a working product.
• To tell you about the service: service and security emails are part of the contract. We'll only send marketing emails if you've agreed to them, and you can stop them at any time.

Where we rely on legitimate interests we have weighed them against your rights, and you can object (see section 8).

5. Who we share it with

We use a small number of providers to run Kithwork. They process data only on our instructions, under written contracts with confidentiality and security terms. The current list, with what each one does and where it's based, is on our sub-processors page.

Inside a workspace, what you add is visible to the people the studio gives access to: its team, and clients only for their own projects. Studios can't see other studios' data.

We may disclose data if the law requires it (for example, a court order), to protect people from harm, or as part of selling or restructuring the business, in which case this policy continues to apply to your data.

6. International transfers

Some of our providers are based in, or use staff in, the United States or other countries outside the UK. When personal data leaves the UK we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified), or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with the provider's security measures. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

We keep data only as long as we need it. Items marked "deleted automatically" are removed by a daily job; the rest are deleted when the event described happens.

When you delete your account, it is deleted straight away along with any workspace you own alone. Copies in our providers' backups are removed as those backups expire. Messages you wrote in other studios' workspaces stay there, no longer linked to your account, because they are part of that studio's records.

8. Your rights

Under UK GDPR you have the right to:

• access your data and get a copy. You can download your account data yourself from Settings at any time;
• correct inaccurate data, most of which you can edit in Settings;
• erase your data. You can delete your account in Settings;
• restrict or object to how we use it, including any use based on legitimate interests;
• portability: receive data you gave us in a machine-readable format (the export is JSON);
• withdraw consent where we rely on it, without affecting what we did before.

To use any right, email the contact address shown in the app. We'll confirm who you are before acting, and reply within one month (we may extend that by two months for complex requests and will tell you if we do). It's free unless a request is clearly unfounded or excessive.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Files are private by default and only reachable through short-lived links issued after checking access. Every request checks who you are and what you're allowed to see on the server. Our staff need two-step verification, can only see what their role allows, and every staff action is recorded in a log that can't be edited. Erasing data and changing staff access need a second staff member's approval.

If a breach puts your data at risk we'll tell the ICO within 72 hours where the law requires it, and tell you without undue delay if the risk to you is high.

10. Children

Kithwork is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's data; if you think we have, contact us and we'll delete it.

11. Cookies

We only use cookies that are strictly necessary to sign you in and keep your account secure, so we don't ask for consent. See our cookie policy.

12. Changes

We'll update this page when how we handle data changes, and email account holders about significant changes before they take effect. The date at the top shows the latest version.