Kite Intel Privacy Policy

1. Who We Are and How to Contact Us

Kite LLC, Georgia, United States. Kite is an online business and does not operate a public office. Privacy requests, legal notices, and questions: privacy@kiteintel.com.

2. Scope

This policy applies to information about Kite customers, business owners, agency partners and their client organizations, authorized users, prospective customers, website visitors, people who contact us, and individuals whose information reaches Kite through a customer's connected systems or website. Many of these individuals have no direct relationship with Kite: customers and leads of our customers, callers, website visitors, homeowners, technicians and employees, and vendors.

3. Kite's Role

Our own purposes. For our own account administration, website, sales and marketing, billing, support, security, fraud prevention, legal compliance, and internal operations, Kite generally acts as a business or controller.

Customer Data. When a customer connects a system or installs our attribution technology, Kite processes the resulting Personal Information on the customer's instructions as a service provider, contractor, or processor. The customer is responsible for the lawfulness of its collection and use, for legally required notices, and for consent. If your information came to Kite through a customer, requests may need to go to that customer; Kite will assist the customer as required by law and contract. Our DPA describes these terms.

4. Information We Collect

4.1 Account and business contact information: name, work email, phone, company, job title, usernames and identifiers, roles and permissions, authentication information, subscription and support communications. 4.2 Device, website, and application information: IP address, browser and device information, session and login activity, security events, logs, referring URLs, page interactions, and product usage events. Kite's marketing website (kiteintel.com) does not currently use third-party analytics or advertising tags such as Google Analytics, the Google Ads tag, or Meta Pixel; our website host may process technical information to serve the site. If we add such tags we will update this policy first. Inside the authenticated Kite application we use Mixpanel for product analytics. We collect only an allowlisted set of product events.

4.3 Connected business systems (Customer Data). Depending on what the customer connects:

• CRM and field service (ServiceTitan, Housecall Pro, Jobber): customer names, phone numbers, emails, service addresses, leads, appointments, bookings, estimates, jobs, invoices, revenue, technician and employee information, notes and free-text fields, and historical records.
• Call tracking (CallRail): caller numbers, timestamps, duration, source and campaign, outcomes, audio recordings, call transcripts, text messages (SMS) and text conversations, form submissions, and derived AI summaries, tags, scores, and classifications.
• Advertising (Meta, Microsoft, Yelp): campaigns, spend, clicks, impressions, leads, conversions, advertising identifiers, and attributed revenue.
• Google Ads (including Local Services Ads), read-only: the accounts the connecting Google login can access with their manager and client structure (account names, IDs, and time zone); campaign, ad group, keyword, search term, device, and click performance data, including spend, clicks, impressions, conversions, and click identifiers; and Local Services Ads leads and conversations, which can include a lead's name, phone number, email address, notes, and message text. See Section 10.
• Accounting (QuickBooks): revenue, invoices, transactions, expenses, and related business records.
• Analytics, search, and reviews (Yelp; and, when we add them, Google Analytics, Google Business Profile, and Google Search Console): traffic, search visibility, reviews, local performance. Kite does not currently request access to Google Analytics, Google Business Profile, or Google Search Console; see Section 10.

Free-text fields, recordings, and transcripts may contain information we cannot predict, including names, addresses, financial details, or sensitive information. Customers should not intentionally send highly sensitive information unless a feature is designed for it and the customer has legal authority.

4.4 Public and regional data. We use public weather data from the U.S. National Weather Service at a regional level to enrich analytics. This data is not about identifiable individuals.

5. Call Recordings, Transcripts, and Speaker Separation

Recordings are processed as provided by the customer's connected system and are not automatically redacted. Kite uses Deepgram to convert audio to text, including separating speaker turns ("diarization"). Diarization labels who is speaking within a call; Kite does not use it to authenticate or identify a person through a voiceprint. AI providers then summarize, classify, tag, and score calls for booking analysis, lead prioritization, sales and service analysis, attribution, and recommendations.

Customer responsibility. Customers must lawfully record calls, give required notices, obtain required consent (including all-party consent where applicable), and have authority to provide recordings and transcripts to Kite. Kite does not determine whether a customer's recording practices comply with law.

6. Website Attribution Technology

Customers may install Kite's attribution script on websites they own or control. Depending on configuration and visitor activity it may process pseudonymous visitor and session identifiers, landing and referring pages, recognized campaign parameters (UTM and Google, Meta, and Microsoft click identifiers), browser, operating system, device type, screen size, time zone, technical network information (including IP address as received by our servers), page views, engagement and scroll activity, phone-link and call-to-action clicks, and form interactions.

We store only supported marketing parameters from URLs, not unrestricted query strings, and we do not collect the content of server responses to form submissions.

Forms. Where a form is configured for tracking, information submitted (name, email, phone, address, company, messages, and other permitted fields) may be processed. Customers can exclude fields or whole forms.

Sensitive-information protections. The script is designed to detect and exclude passwords, Social Security numbers, card and bank numbers, dates of birth, passport numbers, medical and insurance information, using both field names and value patterns, before data leaves the visitor's browser. No automated detection is perfect, and free text is unpredictable.

Browser storage. The script uses local and session storage for visitor and session identifiers, attribution state, and landing-page information. If an event cannot be sent immediately it may be cached briefly in the browser for retry.

Consent. By default, attribution may begin when a page with the script loads. Kite provides functionality to hold tracking until the visitor consents through the customer's consent tool. The customer decides whether consent is required and configures its site. The attribution script honors a visitor's Global Privacy Control signal by default: when the signal is present, it does not send events or store visitor identifiers unless the customer's own consent tool records the visitor's consent. Customers can change this setting for their sites.

Linking to business outcomes. Kite may match attribution data with the customer's CRM, call, and advertising data (for example by phone number) to determine whether a visit led to a lead, call, booking, customer, job, sale, or revenue.

7. Artificial Intelligence and Automated Processing

Kite uses AI to analyze Customer Data, transcribe and analyze calls, summarize, classify, score, detect anomalies and trends, answer user questions, forecast, and recommend actions. AI outputs can be wrong or incomplete and support, rather than replace, human judgment.

Providers. Kite uses commercial APIs through its own business accounts. Speech-to-text: Deepgram. Language models: OpenRouter as a routing layer to Anthropic (Claude) for reasoning and chat, and Google (Gemini) for call tagging and classification. See our Subprocessor List. Kite uses commercial AI provider APIs through its own business accounts and does not intentionally submit Customer Data to personal AI accounts. Kite enables the zero-data-retention routing setting in its AI routing account for requests to Anthropic's Claude models (reasoning, chat, and briefs), which limits those requests to endpoints the routing provider classifies as zero-retention, and does not permit routing to endpoints that train on submitted data. Google (Gemini), which Kite uses for call tagging and classification, retains prompts for safety monitoring as Google requires for its models. Claude models are served through OpenRouter on Anthropic's platform (running on Amazon Web Services infrastructure), and Gemini is served through Google Cloud's Vertex AI.

Training. Using data to deliver a feature is different from training a general model. Kite does not use identifiable Customer Personal Information to train or fine-tune general AI models for Kite's own purposes unless the customer separately and expressly agrees. Kite never uses call recordings, call transcripts, text-message content, or summaries, tags, and classifications generated from them ("Call Content") to train or develop general models, and does not include Call Content in aggregated or deidentified data; Call Content is used only to provide the Services to the customer.

8. How We Use Personal Information

To provide and secure the Services; authenticate users; synchronize and normalize connected data; provide dashboards, attribution, call intelligence, forecasts, and AI features; provide support and communicate about Kite; administer billing; prevent fraud and abuse; monitor reliability; improve the Services; enforce agreements; comply with law and defend legal claims; and create Aggregated or Deidentified Data.

9. Aggregated and Deidentified Data; Provider-Restricted Data

This Section does not apply to Google user data or data derived from it, which is governed only by Section 10.

Excluding Call Content (Section 7), Kite may create aggregated or deidentified information, take reasonable measures to prevent it being linked to an individual or household, publicly commit to keep it deidentified, and not attempt to reidentify it except to test our deidentification or as law permits. Kite may use it for benchmarking, analytics, product and model development, research, and may license or commercialize it. This is not a sale of identifiable Personal Information.

Provider-Restricted Data. Some platform data is subject to the provider's own restrictions (for example data obtained through Google, Intuit/QuickBooks, Microsoft, Meta, or Yelp APIs). We apply those restrictions to such data and to data derived from it, and Kite's rights above do not override them.

10. Google API Services User Data

Kite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access. When a customer connects Google Ads (including Local Services Ads), Kite requests read access to the customer's Google Ads data through the Google Ads API (OAuth scope https://www.googleapis.com/auth/adwords). Kite reads this data and never creates, edits, or deletes anything in a customer's Google Ads account. The data Kite reads is: the accounts the connecting Google login can access, with their manager and client structure (account names, IDs, and time zone); campaign, ad group, keyword, search term, device, and click performance data (including spend, clicks, impressions, conversions, and click identifiers); and Local Services Ads leads and conversations, which can include a lead's name, phone number, email address, notes, and message text.

How we use it. We use this data only to provide and improve the user-facing features the customer requested in Kite: advertising and attribution dashboards, return-on-ad-spend figures, recommendations, and answers from the Kite Copilot.

AI service providers. To produce those insights, answers, and recommendations, Kite sends summaries derived from this data (for example, ad spend and return on ad spend) to its AI service providers, OpenRouter and Anthropic, solely to provide these features to the customer. Customers consent to this when they connect Google Ads.

What we do not do. Kite does not sell Google user data. Kite does not use or transfer it for personalized, retargeted, or interest-based advertising, to determine creditworthiness or for lending, or to data brokers or information resellers. Kite does not use Google user data, or data derived from it, to develop, improve, or train generalized AI or machine-learning models. Google user data, and data derived from it, is excluded from the uses described in Section 9 (including benchmarking, licensing, commercialization, and model development).

Who can see it. Kite personnel do not read Google user data unless (a) the customer gives affirmative agreement for specific data, (b) it is necessary for security purposes, such as investigating abuse, (c) it is necessary to comply with applicable law, or (d) the data is aggregated and anonymized and used for Kite's internal operations in accordance with applicable law.

Transfers. Kite transfers Google user data only (a) to provide or improve the user-facing features described above with the customer's consent, including to the service providers listed in Section 11, (b) for security purposes, (c) to comply with applicable law, or (d) as part of a merger, acquisition, or sale of assets after obtaining the customer's explicit prior consent.

Disconnecting and deletion. Disconnecting Google Ads stops Kite from accessing it and deletes the stored credential. Data already imported is retained until the organization is deleted or you ask us to delete it (Section 19). You can also remove Kite's access at any time in your Google Account permissions (https://myaccount.google.com/permissions).

Scope. Kite currently requests access to Google Ads only. We will update this policy before requesting access to any other Google service.

11. How We Disclose Personal Information

To service providers and subprocessors (listed at kiteintel.com/subprocessors/): cloud and infrastructure (Google Cloud, Firebase Authentication, MongoDB Atlas), speech and AI providers (Deepgram; OpenRouter; Anthropic, whose Claude models are served on its own platform running on Amazon Web Services infrastructure; and Google Gemini, served through Google Cloud's Vertex AI), email (Twilio SendGrid), product analytics (Mixpanel), and our website host. Kite currently bills by invoice and ACH and does not use a card payment processor; if that changes we will update this policy. We may also disclose to professional advisers, in corporate transactions, and for legal and safety purposes. These disclosures do not apply to Google user data, which is disclosed only as described in Section 10.

Advertising. Kite does not currently disclose Personal Information to advertising partners for cross-context behavioral or targeted advertising. If we begin to, for example by adding advertising pixels to our website, we will update this policy and provide the opt-out described in Section 14 before doing so.

12. Agency and Multi-Organization Accounts

Agencies may administer multiple client organizations and access client information according to the permissions set up in the account. Roles of Kite, the agency, and the client depend on their contracts. Agencies and customers are responsible for ensuring access is authorized.

13. Security

Kite uses administrative, technical, and organizational safeguards including encryption in transit, encryption at rest where appropriate, access controls, role-based permissions, tenant isolation, authentication controls, logging and monitoring, backups, secure development practices, and authenticated data submission. No system is completely secure. If we learn of a security incident affecting Personal Information, we will investigate and notify as required by law and, for Customer Data, as provided in the DPA.

14. Your Privacy Choices (including Do Not Sell or Share)

Kite does not sell Personal Information or share it for cross-context behavioral advertising, and does not knowingly do so for anyone under 16. Residents of some states nonetheless have the right to opt out; you may do so by emailing privacy@kiteintel.com, and Kite treats a browser's Global Privacy Control signal as a valid opt-out for that browser or device. You may opt out of Kite's in-app product analytics in your account settings.

15. U.S. State Privacy Rights

Depending on your state, you may have the right to confirm whether we process your information; access and receive a copy; correct; delete; port; opt out of sale, sharing, targeted advertising, and certain profiling; limit use of sensitive Personal Information; and appeal a refusal. We will not discriminate against you for exercising rights. Submit requests to privacy@kiteintel.com. We will confirm receipt within 10 business days and generally respond within 45 calendar days; if we extend the period we will tell you why. We may need to verify identity and authority; authorized agents may submit requests with proof of authority. If you disagree with a decision you may appeal by emailing privacy@kiteintel.com within 60 days of our response, stating that you are appealing; we will answer in writing within 60 days of receiving the appeal and explain the reasons for our decision. If you remain dissatisfied you may contact your state attorney general. If we process your information only for a customer, we may refer you to that customer.

16. California Notice

For California residents under the CCPA, the table summarizes categories we may process, sources, purposes, and retention criteria. Sources: individuals, Kite customers, agencies, customer websites, connected systems, advertising and analytics platforms, and service providers. Purposes: those in Section 8. Disclosures for business purposes: to the providers in Section 11. We do not sell Personal Information or share it for cross-context behavioral advertising (Section 14).

17. Payments

Kite may accept payment by invoice, ACH, or third-party processors. A processor may collect card or bank information under its own terms. Kite retains billing contacts, invoices, transaction records, payment status, and related records for billing, tax, accounting, fraud-prevention, and legal purposes.

18. Cookies and Similar Technologies on Kite's Website

Our marketing website is hosted on Hostinger, which may use cookies and similar technologies needed to operate and secure the site; Hostinger processes this under its own terms. We do not currently place third-party analytics or advertising tags on the site. The Kite application uses browser storage needed for sign-in and settings, and Mixpanel for product analytics (Section 4.2). If we add advertising or analytics tags to the website we will update this section first.

19. Data Retention and Deletion

Kite generally keeps Customer Data for the life of the customer's account because history supports attribution, trend analysis, and forecasting. We do not apply a universal automatic deletion period based only on data age.

When a customer disconnects an integration. Disconnecting stops Kite from accessing that system and deletes the stored credential. Data already imported is retained until the organization is deleted or you ask us to delete it. For Google Ads, you can also remove Kite's access in your Google Account permissions (https://myaccount.google.com/permissions).

When an organization is deleted. A request starts a 48-hour grace period; a daily job then carries out deletion, so execution can occur up to about 24 hours after the grace period ends. By default ("full deletion"), Kite deletes the organization's data from our analytics warehouse (raw, staging, and reporting data), deletes stored integration credentials, and deletes the organization's database records. Users' accounts are deleted only when the deleted organization is the account's last organization. In a limited "anonymized retention" mode that applies only where there is a lawful basis, Personal Information fields are redacted and non-identifying records are kept.

Archive copy. Before deleting, Kite writes an archive copy to access-restricted cloud storage so that an erroneous deletion can be corrected and for audit and legal purposes. The archive copy is kept for 30 days and then permanently deleted. Call audio is not included in it. Copies in database backups are deleted on a rolling schedule, so deleted information is removed from backups within 90 days; backups are not used for any purpose other than disaster recovery. We also keep compliance records, such as deletion records and audit logs, for 6 years; these record that a deletion happened without storing the deleted content. If a legal claim is pending or reasonably foreseeable, we may suspend deletion of the information relevant to it until the matter is resolved.

Call audio. Voice cannot be anonymized. When deletion applies to call audio, the audio files are deleted, not redacted.

Kite may retain limited information longer for security, fraud prevention, legal obligations, tax and accounting, disputes, and legal claims. Aggregated or Deidentified Data may be retained longer. Trial-only data may be deleted after the trial.

20. Children's Privacy

Kite's Services are for businesses and professionals and are not directed to children under 13. User accounts are for adults (18 and over) unless Kite expressly authorizes otherwise and the law permits. Customer Data may incidentally contain information about minors; Kite processes it for the customer. If we learn we collected information directly from a child under 13, we will delete it.

21. Third-Party Services and International Use

Connected services have their own terms and privacy practices; Kite is not responsible for them. The Services are offered to customers in the United States, and Kite stores Customer Data in the United States (Google Cloud and MongoDB Atlas, us-central1). Some AI and speech providers may process data in other locations as described in our Subprocessor List. Kite does not currently offer the Services to customers in the European Economic Area, the United Kingdom, or Switzerland; if that changes, required transfer mechanisms will be in place first.

22. Business Transfers

Personal Information may be transferred in a merger, acquisition, financing, asset sale, restructuring, or bankruptcy, subject to law and confidentiality obligations. Google user data is transferred in a merger, acquisition, or sale of assets only after we obtain the customer's explicit prior consent.

23. Changes to This Policy

We will update the "Last Updated" date and keep prior versions available on request at privacy@kiteintel.com. For material changes we will give additional notice where law requires, and we will not rely only on a retroactive policy update to materially expand use of previously collected Personal Information where law requires notice, choice, or consent. We will review this policy before adding an integration, AI provider, or subprocessor.

24. Contact

Kite LLC d/b/a Kite Intel, Georgia, United States. privacy@kiteintel.com · kiteintel.com

Version history

• 1.2 (effective date above): Google Ads read-only access and Google Limited Use detail (Section 10), AI provider retention and hosting disclosure (Sections 7 and 11), Google user data excluded from aggregated-data uses (Section 9) and business transfers (Section 22), disconnect behavior (Section 19), removal of links to unpublished request pages.
• 1.1 October 16, 2026: provider and subprocessor corrections (Deepgram, OpenRouter, Anthropic, Google), Google Limited Use, SMS, Mixpanel in-app, weather data, retention and deletion detail, state-rights process, children's and international sections.
• 1.0 September 1, 2026: initial version.