Privacy Policy

Kayson OS is operated by Blue Moon OS LLC. This policy applies to the Kayson OS app, and to anyone who visits a page we host — including the public quotes, invoices, change orders and portfolios our customers send to their own clients.

When this policy says "you", it means a Kayson OS user, and also a person whose details a user has entered: a client, a homeowner, an employee, a subcontractor, a vendor. If you are one of those people, the business that entered your details is responsible for them, and we handle them on that business’s behalf.

• We collect what we need to run the product, and no more.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
• We do not use your content to train generalised AI models.
• You can export your data, and you can delete your account.
• The rest of this document is the detail.

• Account: your name, email address, password (stored hashed), profile photo and phone number.
• Company: name, address, phone, email, website, trade, licence and insurance details, and logo.
• Team: employee and subcontractor names, contact details, roles, pay rates, hours worked, and any notes you add.
• Clients and contacts: names, contact details, addresses, billing details, notes and pipeline information.
• Projects and work: project details, addresses, descriptions, schedules, tasks, milestones, daily logs, notes, measurements and takeoffs.
• Money: quotes, invoices, change orders, recorded payments, expenses, receipts, vendor names, and the payment method details you enter.
• Files: photographs, videos, drawings and plans, contracts, permits, receipts, and any other document you upload.
• Support: whatever you send us when you contact us.

Some of this is information about other people. If you enter someone else’s details, you are responsible for having a lawful reason to do so and, where the law requires it, for telling them.

• Device and connection: IP address, browser and device type, operating system, and the approximate location derived from IP.
• Usage: the pages and features you use, the actions you take, timestamps, and errors.
• Session recordings: where enabled, a recording of how a screen was used, to diagnose problems and improve the product.
• Cookies and local storage: identifiers that keep you signed in and remember your preferences.

We use this to run and secure the Service, to fix problems, and to understand which parts of the product are actually used.

• We do not receive or store your full card number, your CVC, or your bank credentials. Card details are entered directly with Stripe and never reach our systems.
• We do not buy personal information from data brokers.
• We do not track you across other companies’ websites or apps.

• to provide, operate and maintain the Service, including creating your account and your workspace;
• to process payments for your subscription and, where you use them, payments between you and your clients through Stripe;
• to generate the documents, reports, calculations and AI output you ask for;
• to send service messages, security alerts, receipts, and — where you have not opted out — product updates;
• to provide support and respond to your requests;
• to monitor, secure and debug the Service, including detecting fraud and abuse;
• to meet our legal, tax, accounting and record-keeping obligations;
• to enforce our agreements.

We rely on performing our contract with you, on our legitimate interests in operating and securing the Service, on your consent where we ask for it, and on legal obligations. We do not use your information for automated decisions that produce a legal or similarly significant effect on you.

When you use an AI feature, the content needed to answer is sent to a model provider to generate a response: your prompt, the text or image you attach, and the relevant context from the record you are working on.

We do not use your content to train generalised AI models, and we do not permit our providers to use it for that purpose. Where a provider retains data briefly for abuse monitoring, that retention is limited and does not involve training on your content.

AI output is stored in your account as part of your records. AI usage is metered so that we can apply your plan allowance.

Do not put anything into an AI feature that you would not want processed by a third-party model provider, and do not upload another person’s sensitive information without a lawful reason to do so.

We share personal information with service providers who process it on our instructions, under contract, and only to provide their service to us.

• Base44 — application hosting, database, authentication, file storage, and the AI gateway through which model requests are made.
• Stripe — subscription billing, and payments between our customers and their clients through Stripe Connect.
• Resend — transactional email delivery.

These providers may change as the Service evolves. We keep this list current, and we will tell you before adding a provider that processes personal information in a materially different way.

We may also disclose information: to comply with law, legal process or a lawful government request; to enforce our Terms; to protect the rights, safety or property of us, our customers or others; and in connection with a merger, acquisition, financing or sale of assets, where the recipient remains bound by this policy.

We do not sell personal information.

Kayson OS is built for collaboration between companies. When a customer shares a project, document, photograph, note, contact or plan with another company, that company and its users can see it. That disclosure is made by our customer under their own instructions — but it happens inside our product, so you should know it happens.

A customer can also publish a Company Network profile and a public portfolio. Information published there is visible to other users, and portfolio content is visible to anyone with the link.

Our customers send quotes, invoices and change orders to their clients through public links. If you open one of those links, we process your IP address, your device information, and whether you viewed, signed or paid, so that the contractor can see the document was received and acted on. You do not need an account to open one.

If you sign a document through one of those links, we record the name you typed, the time, and technical information about the device used, so that the contractor has a record of the acceptance.

We use a small number of technologies in your browser. Our Cookie Policy lists every one of them, what it does and how long it lasts. In summary:

• Essential: keep you signed in and secure your session. The Service cannot work without these.
• Preferences: remember settings such as your theme, your list views, and the last drawing sheet you had open.

We do not set advertising cookies, we do not run third-party tracking pixels, and we do not allow anyone to track you across other sites through the Service. We do not currently run optional product analytics; if we add it, it will be switched off until you agree and this policy will say so first.

You can clear or block cookies in your browser at any time. Blocking the sign-in session will stop you being able to sign in; blocking preference storage only resets your settings.

We keep your information while your workspace is active. After your subscription ends or you cancel, this is what happens:

1. Read-only: your workspace becomes read-only and you keep viewing access for 30 days.
2. Retention: your workspace then enters a final 30-day retention window before deletion. The app shows you the exact deletion date.
3. Data Vault: if you subscribe to Data Vault, your data is preserved without active access for as long as that subscription is paid, and the deletion countdown is paused.
4. Deletion: at the end of the retention window your data is permanently deleted on a scheduled basis. This cannot be undone.
5. Deletion on request: if you ask us to delete your account, we action it and delete your data within 30 days, except where we must keep something for legal, tax or accounting reasons, or where it sits in backups that roll off on their own schedule.

Some records are kept longer because the law requires it — billing and tax records in particular. De-identified and aggregated information may be kept indefinitely, because it no longer identifies anyone.

• Encryption of data in transit using TLS, and encryption at rest.
• Passwords stored hashed. Access to production systems is limited and logged.
• Files are stored privately by default and reached only through signed, time-limited links.
• Access to customer data inside our own team is limited to what a support or engineering task actually requires.
• We review and patch dependencies, and we run security scans against the application.

No system is perfectly secure. We cannot guarantee that unauthorised access will never occur, and we cannot guarantee that data will never be lost.

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal information, we will investigate, act to contain it, and notify affected customers and any regulator where the law requires it, without undue delay.

We keep a written incident-response plan setting out who is responsible, how an incident is assessed and contained, how it is communicated, and what is done afterwards.

• Access and export: view and export your data from inside the app.
• Correction: update your details at any time.
• Deletion: delete your account from Settings, or ask us.
• Marketing: opt out of product emails. We will still send service and security messages.
• Objection: contact us if you object to a particular use of your information.

To make a request, contact us at privacy@kaysonos.com. We will verify your identity before acting, and we will respond within the time the applicable law allows.

If you are a California resident, you may have rights under the California Consumer Privacy Act as amended — to know what personal information we collect and how we use it, to access and delete it, to correct it, and to opt out of its sale or sharing.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that front. We do not use or disclose sensitive personal information for purposes beyond providing the Service.

We honour Global Privacy Control signals and comparable browser or extension opt-out signals, and we do not attempt to detect or work around them. Because we do not sell or share personal information, there is currently nothing for such a signal to switch off; we treat the signal as binding regardless.

We will not discriminate against you for exercising a privacy right.

To exercise a right, contact us at privacy@kaysonos.com. You may use an authorised agent; we may ask for proof that the agent is authorised.

Whether the CCPA applies to a particular business depends on its size and its data practices. We honour these rights for everyone who asks, whether or not a threshold applies to us.

The Service is a business tool for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

We may update this policy. We will publish the new version, update the effective date and version number, and tell you about material changes in the app or by email. Where a change would use information you have already given us in a materially different way, we will ask for your consent first.

Privacy requests and questions: privacy@kaysonos.com. General support: support@kaysonos.com. Postal mail: Blue Moon OS LLC — mailing address to be added.

We take complaints seriously. If you are not satisfied with our response, you may have the right to complain to your state attorney general or another supervisory authority.