Privacy Policy

1. Who we are

Kiyo Cloud is a brand operated by ClientFlow Systems Ltd. ClientFlow Systems Ltd is the data controller for personal information processed for Kiyo Cloud unless another role is specifically explained.

2. Information we collect

3. How we collect information

We receive information directly from you when you create an account, place an order, submit support or contact forms, provide billing information or change settings.

Some information is generated automatically through service and security logs, website or device requests and cookies or similar technologies where permitted. We may also receive necessary information from payment providers, domain registrars or registries, support and infrastructure providers, and authentication providers where applicable.

When personal information comes from another source, we handle it in accordance with applicable privacy law.

4. Why we use personal information

5. Lawful bases

We select the lawful basis that fits each use rather than relying on one basis for everything:

Contract

When processing is necessary to provide a service you request or purchase, or to take steps at your request before a contract.

Legal obligation

When information must be processed or retained to comply with applicable law.

Legitimate interests

For purposes such as service security, fraud prevention, platform improvement and protecting our systems or customers, after balancing those interests against your rights and interests.

Consent

Where consent is required, such as for certain non-essential cookies or marketing. You can withdraw consent at any time where processing relies on it.

6. Cookies and similar technologies

Kiyo uses cookies, local storage and similar technologies for essential functionality, sessions or authentication where available, preferences, security, support features and analytics where consented or otherwise permitted.

Non-essential cookies are subject to applicable consent requirements. Learn more in our Cookie Policy.

7. Who we share information with

Where needed to operate Kiyo, information may be shared with hosting and infrastructure providers, payment processors, domain registrars and registries, support providers, email delivery providers, security or monitoring providers, professional advisers, and authorities where legally required.

Our currently configured providers include:

• Vercel — website and application infrastructure
• Cloudflare — DNS and infrastructure protection services
• tawk.to — live chat and support ticket infrastructure
• Resend — transactional email delivery

Providers should receive only the information reasonably required to perform their function. We do not sell personal information. A domain registrar will be added to this list when the live registrar integration is selected and processing begins.

8. Domain registration data

Registering or managing a domain may require personal or contact information to be provided to the registrar, registry and other necessary domain ecosystem providers.

Some information may be disclosed or published where registry policy or law requires it. Privacy or proxy protection may be available for some domain extensions but not all; the rules depend on the extension and registry.

9. International data transfers

Some providers may process information outside the UK. Where personal information is transferred internationally, Kiyo uses safeguards required by applicable law. Depending on the destination and provider, these may include UK adequacy regulations, contractual safeguards or another lawful transfer mechanism.

We do not claim that all information remains in the UK.

10. How long we keep information

11. How we protect information

We use reasonable technical and organisational measures appropriate to the service and risk. These include encrypted connections, access controls, security logging, infrastructure protections, limited staff access and careful selection of providers. MFA or security keys may be available for relevant account features.

No system can guarantee complete security.

12. Account security

Protect your password, use MFA or a security key where available, keep recovery and contact details current, and report suspicious activity promptly.

Kiyo will never ask you to send your password, full payment card details, two-factor authentication code or recovery codes through normal support communications.

13. Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to be informed, access your information, correct it, request erasure or restriction, object to processing, receive portable data, and obtain safeguards relating to certain automated decisions.

Not every right applies in every situation. To make a request, email privacy@kiyocloud.com. You do not need to navigate a complicated process, although we may need enough information to verify your identity and locate the relevant data.

14. Right to object

You may have the right to object when we process personal information on the basis of legitimate interests. We will consider the circumstances and stop processing where the law requires.

You can object to direct marketing at any time. Any marketing message will provide an appropriate way to opt out, and service-critical communications will remain separate.

15. Automated decision-making and AI

Kiyo may use automated systems or AI to answer support questions, categorize or summarize tickets, generate Website Score insights, detect technical patterns and make contextual tool recommendations.

Kiyo AI does not block access to human support. Website Score and tool recommendations are informational and diagnostic. Kiyo does not use these systems to make decisions producing significant legal or similarly significant effects without appropriate safeguards. This policy will be updated before any more significant automated decision-making begins.

16. Kiyo Website Score

Website Score may analyze a URL you submit, publicly accessible page and performance information, responsiveness results, SEO and accessibility signals, security-related technical signals, scan results and recommendations.

When linked to an account, results may be stored in that Kiyo account. We do not analyze private or non-public website data unless you explicitly authorize the required access.

17. Kiyo Monitor

Monitor periodically checks configured website or service endpoints for availability. It may store the URL, status, limited response information needed for the check, incident timestamps and monitoring history.

18. Support and tawk.to

Live chat and ticket support use external support infrastructure provided by tawk.to. Information submitted may include your name and email, chat messages, ticket content, attachments and technical session information.

We use this information to respond, investigate service issues and maintain case history. A Kiyo account is not required to contact support.

19. Email and Resend

Resend processes email addresses and message delivery metadata where needed to deliver account messages, security notices, ticket confirmations, billing information and other service communications. Transactional service email is not treated as marketing simply because it is sent by email.

20. Payments

When card payments are enabled, a hosted payment processor such as Stripe may collect and process payment and anti-fraud information. Kiyo will typically receive the payment status, transaction reference and limited payment-method details such as card brand or last digits where available.

Kiyo does not normally receive or store the complete card number when the payment provider hosts the card-entry process. The active payment provider will be identified when the production payment flow is connected.

21. Children

Kiyo services are primarily intended for businesses and adults. We do not knowingly target children. If we learn that personal information has been provided by a child in circumstances where it should not have been collected, we will take appropriate steps under applicable law.

22. Business customers

We may hold personal information about employees and representatives of business customers, including account administrators, billing contacts and support users. This remains protected as personal information even when it is connected to a business account.

23. Data breaches

Kiyo has procedures for assessing and investigating personal-data incidents. Where the law requires it, we will notify affected individuals, the Information Commissioner's Office, or both. Not every security event legally requires individual notification.

24. Complaints

Please contact privacy@kiyocloud.com first so we can investigate your concern. You also have the right to complain to the Information Commissioner's Office.

25. Changes to this policy

We may update this Privacy Policy when products, providers, law or data practices change. Material changes will be brought to users' attention where appropriate. The current version and last-updated date will remain on this page.

26. Contact