Privacy Policy

1. Two roles: our customers' data, and data in the CRM

It matters whose data is involved:

• We act as controller for data about visitors to our websites, people who book demos, and the recruiters who hold Kepler accounts.
• We act as processor (data intermediary under the PDPA) for the data recruitment agencies store in Kepler — candidate profiles, CVs, client contacts, emails, notes, recordings and transcripts ("Customer Data"). The agency controls that data and decides why it is processed; we process it only to provide the Service on the agency's instructions.

If you are a candidate whose details are held in a Kepler workspace, please direct questions or rights requests to the recruitment agency you dealt with — they control your data. We will assist them in responding, and if you contact us directly we will forward your request to them where we can identify them.

2. Data we collect as controller

• Account data — name, work email, workspace details, authentication data, billing information.
• Demo and contact data — details you submit when booking a demo or contacting support.
• Usage and device data — log data such as IP address, browser type, pages viewed and actions taken in the Service, used for security, debugging and to improve the product.
• Support data — messages you send to support and related diagnostics.

Our marketing website uses our own analytics to understand site usage, and an advertising service to measure our advertising. Our analytics records pages visited, the referring site, campaign tags, country and city, device and browser type, screen size and selected interactions such as booking a demo. It counts visits without cookies, using an identifier calculated from your IP address and browser that changes every day; your IP address itself is not stored. If you allow analytics cookies, it also sets a cookie so it can recognise your browser on later visits. See Sections 5 and 10 for the providers and your choices.

3. How we use personal data

• to provide, secure and maintain the Service and authenticate users;
• to process payments, manage subscriptions and send service communications;
• to respond to support requests and demo bookings;
• to monitor errors and performance and improve the product;
• to understand how our marketing website is used and measure the effectiveness of our advertising;
• to comply with legal obligations and enforce our Terms of Service.

Where GDPR applies, we rely on performance of a contract, our legitimate interests (running and improving a secure service), consent where required, and compliance with legal obligations. Analytics and advertising cookies on our marketing website rely on consent where the law requires it (see Section 10).

4. AI features and model training

Kepler uses third-party AI models for features such as search, candidate matching, CV parsing, drafting and meeting summaries. Content processed by these features (for example a CV being parsed) is sent to the AI providers listed below to generate the result. We do not use your data or Customer Data to train AI models, and our agreements with AI providers prohibit them from using it to train theirs.

5. Who we share data with (subprocessors)

We share personal data only with service providers that help us run Kepler, under contracts that restrict their use of it:

Where you connect your own accounts — Google Workspace, Microsoft 365, Zoom, job boards — data is exchanged with those services at your instruction, under their own terms. We may update this list as our stack evolves; material changes to subprocessors handling Customer Data will be notified to account owners in advance.

We may also disclose data where required by law, or as part of a merger, acquisition or sale of assets (in which case this policy continues to apply to it). We do not sell personal data.

6. International transfers

We are a Singapore company using providers in the EU, US and elsewhere, so personal data may be transferred across borders. Where GDPR or the PDPA requires, we rely on appropriate safeguards such as the providers' standard contractual clauses and equivalent contractual protections, and require a comparable standard of protection wherever the data is processed.

7. Security

Data is encrypted in transit and at rest. Files such as CVs and recordings are served only through short-lived signed URLs. Access to Customer Data is isolated per workspace and restricted within our team to what is needed to operate and support the Service. No system is perfectly secure; we will notify affected customers of any personal data breach as required by law.

8. Retention

We keep account data for as long as you hold an account and as needed afterwards for legal, billing and security purposes. Customer Data is retained while the customer's subscription is active and deleted within a reasonable period after termination, except backups (purged on their normal cycle) and records we must keep by law. Customers can delete records from within the Service at any time.

Website analytics data is retained for up to one year. We remember your cookie preferences for up to 180 days.

9. Your rights

Depending on where you are, you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise them, email support@keplercrm.com; we will respond within the timelines required by the PDPA or GDPR, as applicable. You may also complain to your local data protection authority — in Singapore, the PDPC. Remember that for data held in an agency's workspace, your request is best made to that agency (see Section 1).

10. Cookies

Our marketing website uses essential storage to remember your preferences, plus optional analytics and advertising cookies. The analytics cookie (kp_vid, a random identifier kept for up to 180 days) lets us recognise your browser on later visits; without it we still count visits, but anonymously and without cookies. In the EU/EEA, Gibraltar, Jersey, Guernsey and the Isle of Man we ask for consent before enabling optional cookies. In the UK, Switzerland, or when we cannot tell your country, the analytics cookie is on by default and advertising cookies stay off unless you allow them. Elsewhere both are enabled by default. You can accept, reject or manage each category at any time through ‘Cookie settings’ in the footer; turning analytics off deletes the analytics cookie.

The Kepler application uses cookies and similar storage strictly for signing you in, keeping your session secure and remembering interface preferences. It does not use analytics or advertising cookies.

11. Children

Kepler is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16 as controller.

12. Changes to this policy

We may update this policy as the product and law evolve. Material changes will be notified by email or in-app notice; the "Last updated" date above always reflects the current version.

13. Contact

Teeny Capital Pte. Ltd. (Singapore), operating Kepler CRM.
Email: support@keplercrm.com

14. Kepler CRM browser extension

This section explains how the Kepler CRM browser extension handles data and supplements the provisions above.

Profile capture and CRM context. The extension reads supported LinkedIn profile, company and search pages, including page URLs, names, professional details, employment and education history, location and available contact details. While you are signed in, supported page URLs and profile information are sent to Kepler to match existing records and display CRM context. Imports and record updates you choose are saved to your selected workspace. The extension does not collect general browsing history from unrelated websites.

Sign-in and local storage. Kepler login credentials are sent over HTTPS to Supabase, our authentication provider. Session and refresh tokens, workspace selection and preferences are stored locally in the browser to keep you signed in. The extension does not save the password you enter. It retrieves CRM records, notes, tasks, activity and available communications according to your workspace permissions. Service requests can include IP address and browser information used to provide and secure the service.

AI outreach drafts. When you request a draft, relevant profile information and any job context you select are sent to Kepler and the AI providers described in Section 5. Drafts are returned for your review. The model-training restrictions in Section 4 apply.

Your controls and retention. Uninstalling the extension does not itself delete imported CRM records. Imported records remain subject to workspace deletion controls and the retention provisions in Section 8. For deletion requests or other rights, follow Section 9 or email support@keplercrm.com.

Use and sharing limits. Extension data is used to provide and secure the recruiting features described in the extension and its store listing. It is processed by Kepler and the relevant hosting, authentication and AI service providers identified in Section 5. We do not sell extension data or use it for advertising, creditworthiness or lending decisions. Transfers are limited to providing these features, purposes you authorize, and other transfers permitted by the Chrome Web Store User Data Policy. Kepler CRM's use of extension user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.