1. Scope and controller

This Privacy Policy explains how KROSFY LLC ("Krosfy", "we", "us") processes personal data when you visit www.krosfyllc.com, create or use an account, use a client portal or workspace, communicate with us, purchase services, or otherwise use our software and services (the "Services"). KROSFY LLC, located at 4851 W HILLSBORO BLVD A3, COCONUT CREEK, FL 33073, is the controller for account administration, platform security, commercial relationships, billing of its own services and direct communications.

2. Workspace data and GDPR roles

A customer organization that operates a workspace generally determines why and how the personal data of its clients, personnel and contacts is used. For that data, the workspace customer is normally the controller and Krosfy acts as processor, handling data only to provide, secure, support and maintain the Services and according to documented instructions. Each workspace customer is responsible for providing its own notices, choosing a lawful basis, obtaining any required authorizations and managing requests from its data subjects. Where applicable, this processing is also governed by the parties' data processing terms.

3. Data we collect and sources

Depending on how the Services are used, we may process: identity and contact details; account credentials and roles; company, tax and billing information; subscriptions, invoices, payment status and transaction references; client records; support tickets and messages; notes, tasks and calendar activities; communications and notification preferences; files, images, document requests and payment evidence uploaded by users; branding settings; IP address, browser, device, approximate location, session and security information; activity, audit and error logs; and information received from a workspace administrator, an invited user, payment providers or other integrations selected by the customer. Payment card details may be collected directly by the payment provider and are not necessarily stored by Krosfy.

4. Purposes and legal bases

We process personal data to create and administer accounts and workspaces; perform contracts and provide requested features; authenticate users and control access; manage support, documents, communications, billing and payments; send service messages; prevent fraud, malware and misuse; maintain security, auditability, availability and backups; improve and diagnose the Services; comply with tax, accounting and legal duties; establish or defend legal claims; and, where permitted, communicate about related services. Depending on the context, the legal basis is performance of a contract, steps requested before a contract, compliance with law, our legitimate interests in operating and protecting the Services, or consent where the law requires it. Consent may be withdrawn without affecting earlier lawful processing.

5. User content and sensitive data

Users and workspace customers control the content they upload and are responsible for ensuring that they have the rights, authority and lawful basis to process it. Documents may contain information about third parties or sensitive information. Such information should be uploaded only when necessary and legally authorized. Krosfy does not use workspace content for unrelated advertising and does not claim ownership of it. We may technically process, copy, transmit, back up, scan, quarantine or delete content only as needed to provide and protect the Services, follow customer instructions, enforce the Terms or comply with law.

6. Recipients and service providers

We may disclose data to authorized members of the relevant workspace; hosting, database, storage, security, email and workflow providers; payment and billing providers such as Stripe; anti-abuse and network providers such as Cloudflare; professional advisers and public authorities when legally required; and a successor in a lawful corporate transaction. Providers receive only the information reasonably necessary for their function and are subject to contractual or legal duties. We do not sell workspace documents or client records.

7. International transfers

Krosfy is based in the United States and the Services may use providers in other countries. Where the GDPR or similar law applies, international transfers are made using an applicable adequacy decision, standard contractual clauses or another lawful safeguard. Information about the relevant safeguard may be requested using the contact details below.

8. Retention and deletion

We keep data for as long as needed to provide the Services and maintain the workspace, and afterward only for legitimate business, security, dispute-resolution or legal purposes. Retention depends on the type of record, workspace instructions, contractual status and tax or accounting obligations. Deleted items may remain temporarily in a recycle bin, security record or backup until the applicable retention cycle expires. Data subject to a legal hold may be retained longer. When Krosfy acts as processor, return or deletion also follows the controller's documented instructions and applicable law.

9. Security and incidents

We apply reasonable administrative, technical and organizational measures, including access controls, encrypted transmission, tenant separation, audit logging and file-security controls where available. No system, transmission or malware scan is completely secure. Users must protect credentials, configure permissions carefully and promptly report suspected misuse. If a personal-data incident requires notification, Krosfy will notify the affected controller, users or authorities as required by applicable law.

10. Cookies and similar technologies

The Services use essential cookies or similar storage for sessions, authentication, security, language and user preferences. These are necessary to provide requested functionality. Non-essential analytics or marketing technologies, if introduced, will be described and used with consent where required. Browser settings may block cookies, but essential features may then stop working correctly.

11. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data and may object to certain processing. You may withdraw consent and lodge a complaint with your competent supervisory authority. If your data is controlled by a workspace customer, contact that organization first; Krosfy will assist it as required. We may verify identity and retain information where an exception or legal obligation applies. Requests may be sent to the contact below.

12. Children

The Services are intended for businesses and authorized adult users and are not directed to children. Do not upload children's data unless the relevant workspace has a valid legal basis, appropriate authority and safeguards. If we learn that data was collected contrary to applicable law, we will work with the controller to restrict or delete it.

13. Changes to this Policy

We may update this Policy when the Services, providers or legal requirements change. The current version and effective date will be published here. Material changes may also be communicated through the Services or by email when appropriate.

14. Contact

Contact Krosfy with privacy questions or requests using the details below. If a data protection officer or representative is formally required and appointed, the relevant contact information will be made available in this Policy.

KROSFY LLC
4851 W HILLSBORO BLVD A3, COCONUT CREEK, FL 33073
[email protected]
+1 305 692 0617