Last updated: August 2026
This policy explains how QuxKit handles personal data in QuxKit CRM. For data about your account (as our customer) we are the controller. For the data you store about your own clients and contacts, you are the controller and we act as your processor, processing it only to provide the Service.
To authenticate you, isolate your workspace, operate and secure the Service, process payments, provide support, and comply with law. Where the GDPR applies, our legal bases are performance of a contract, legitimate interests (security and improvement), consent (where required), and legal obligation. For Customer Data, we act only on your documented instructions as your processor.
Each workspace’s data is isolated at the database by forced row-level security, so one tenant cannot read another’s records. Credentials are hashed with argon2id and an application-held pepper; data is encrypted in transit. No system is perfectly secure, but we apply measures appropriate to the risk.
We do not sell personal data. We share it only with sub-processors that host, secure, or support the Service under contract, to comply with law, or with your direction. A current list of sub-processors is available on request.
We keep data while your workspace is active and as needed to provide the Service, then as required for legal and accounting obligations. On termination you may request export or deletion of your workspace data.
Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
Subject to applicable law, you may access, correct, delete, export, or restrict your personal data, object to certain processing, and withdraw consent. California residents have the rights to know, delete, and opt out of the sale or sharing of personal information (we do not sell it). To exercise a right, email [email protected]. If you are an end customer of one of our customers, please contact that organization (the controller); we will assist them in responding. You may also complain to your local data protection authority.
We may update this policy and will post the new date, with additional notice for material changes. Contact [email protected]. See also our Terms of Service.