Kilo is provided by Nerdy Consultants LLC ("we", "us", "our"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have.
This policy covers Kilo (the "Service") and the kilobuild.ai marketing site. It does not cover the practices of our customers, who are separately responsible for the personal information they handle in their own accounts.
1. Who is the controller
- For information about our customers (business account holders and their users), Nerdy Consultants LLC is the controller.
- For information about homeowners and end customers that our business customers manage through Kilo, our business customer is the controller and Nerdy Consultants LLC is the processor. Our handling of that data is governed by our Terms and, where applicable, a Data Processing Agreement.
2. Information we collect
2.1 From account holders and users
- Account information — name, email address, phone number, business name, role, password (hashed).
- Billing information — billing name, address, and payment identifiers (card numbers are handled by our payment processor; we do not store full card numbers).
- Support communications — the content of emails and messages you send us.
2.2 From use of the Service
- Tenant Customer Data — records our customers enter or generate in the Service, including client/homeowner names, addresses, phone numbers, email addresses, photos, project details, insurance claim information, notes, and communications.
- Usage data — actions taken in the Service, timestamps, feature usage, error logs, IP address, browser and device type. We use Plausible Analytics, a privacy-focused analytics tool that does not use cookies to track individual users or build cross-site profiles.
- Location data — for features that log a door-knock or job-site visit, we record the coordinates you submit. GPS is not collected in the background.
2.3 From third parties
- Integrations you connect (for example, CompanyCam, calendars, e-signature) share data with the Service on your instruction. We only receive what those integrations pass to us.
3. How we use information
We use personal information to:
- Provide, secure, and improve the Service.
- Authenticate users and prevent fraud and abuse.
- Bill you and collect payment.
- Respond to support requests.
- Send service-related notices (these you cannot opt out of while you have an account).
- Send product news and marketing (you can opt out of these at any time).
- Comply with law and enforce our Terms.
We do not sell personal information. We do not use Tenant Customer Data to train third-party AI models. We do not use customer data to build cross-customer profiles.
4. AI features
Some features use AI models (currently Anthropic Claude) to draft text, summarize records, or suggest actions. When these features run:
- Only the specific inputs needed for the request are sent to the AI provider.
- Providers act as subprocessors under contract and are not permitted to train their models on the data.
- A human at your business reviews and approves any AI-drafted communication before it is sent to a homeowner, insurer, or third party.
5. Subprocessors we use
We rely on the following categories of subprocessors. The current list is maintained at kilobuild.ai/legal/subprocessors and includes:
- Cloud hosting and databases — Microsoft Azure (United States regions).
- AI drafting — Anthropic.
- Photo storage and project data source — CompanyCam (when connected by the customer).
- Payments — our payment processor (Stripe or equivalent).
- Email delivery — our transactional email provider.
- SMS delivery — our SMS provider.
- Analytics — Plausible Analytics (privacy-focused, no cross-site tracking).
- Error and performance monitoring — the observability vendor we use at the time.
We require subprocessors to protect personal information under contract and to process it only for the services they provide to us.
6. Sharing
We share personal information with:
- Subprocessors as described above.
- Your users within your tenant — data in a tenant is visible to the users you authorize.
- Legal and safety recipients — when required by law, court order, or to protect rights, safety, or the integrity of the Service.
- A successor — if we go through a merger, acquisition, or asset sale, personal information may transfer, subject to this policy.
We do not share personal information with advertising networks.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your personal information.
- Receive a portable copy of your information.
- Object to or restrict certain processing.
- Withdraw consent.
- Not be discriminated against for exercising these rights.
To exercise a right, email [email protected]. We will verify your identity and respond within the timeframes required by law.
For personal information we process on behalf of a business customer (for example, homeowner records inside a customer's tenant), we will refer your request to that customer, who is the controller.
8. GDPR (EEA/UK) and CCPA (California)
GDPR. Our lawful bases for processing include: performance of a contract (providing the Service), legitimate interests (securing the Service, improving it, and marketing where permitted), consent (where required), and legal obligation.
CCPA / CPRA. We do not sell or share (as those terms are defined) personal information. California residents may exercise the rights listed in Section 7 and may designate an authorized agent to do so.
International transfers: where personal information moves out of the EEA or UK, we rely on Standard Contractual Clauses or an equivalent mechanism.
9. Data retention
- Account and billing information: while your account is active and up to 7 years after termination for tax and legal purposes.
- Tenant Customer Data: while your account is active. After termination, we make it available for export for 30 days and then delete it, subject to backup rotation.
- Support communications: up to 3 years.
- Security and audit logs: up to 2 years.
We keep information longer where required by law or reasonably necessary to resolve disputes.
10. Security
We take reasonable technical and organizational steps to protect personal information, including encryption in transit, encryption at rest for stored records, access controls, audit logs, and background checks on personnel with production access. No system is perfectly secure, and we cannot guarantee absolute security.
11. Data breach notification
If we experience a breach that affects your personal information, we will notify affected customers without undue delay and no later than 72 hours after we determine a reportable breach has occurred, and we will comply with applicable state and federal notification requirements.
12. International transfers
The Service is hosted in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. under the safeguards described in Section 8.
13. Cookies and tracking
See our Cookie Policy.
14. Children
The Service is not intended for children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, email [email protected] and we will delete it.
15. Changes to this policy
We may update this policy. For material changes, we will notify account holders at least 30 days in advance by email or in-product notice. The "Last updated" date at the top always reflects the most recent version.
16. Contact
Nerdy Consultants LLC
Louisville, Kentucky
[email protected]