Effective Date / Last Updated: October 16, 2026
Kresynt, LLC ("Kresynt," "we," "us," or "our") provides online safety, compliance, training, and operational-management software and related features, including any mobile applications we offer (the "Service"), and kresynt.com and its subdomains (the "Websites"). This Privacy Policy explains how we collect, use, disclose, and retain information that identifies or can reasonably be linked to a person ("personal information"), and how to contact us or exercise applicable privacy rights.
An organization or individual that orders the Service is a "Customer." People the Customer authorizes to use its account are "Authorized Users." This Policy applies to our handling of personal information, including information supplied by a Customer about employees or other recipients. It does not replace the Customer's own workplace privacy notice or an independent third party's privacy policy.
This Policy describes data practices; it is not blanket consent to processing. Where consent is required, we obtain it separately. The Terms and Conditions at https://kresynt.com/terms and any applicable data processing addendum ("DPA") govern the contractual relationship. This Policy does not expand the license to Customer content, authorize prohibited model training, or waive privacy rights.
1. Children's Privacy
The Service is intended for workplace use, not for children. Account representatives and Authorized Users must generally be at least 18. Access, training assignments, or worker records involving people aged 13 to 17 require an expressly authorized arrangement under a signed Customer Agreement and the applicable consent, privacy, and employment safeguards. A stricter local age or consent requirement still applies.
Children under 13 may not use the Service, and Customers must not submit their personal information. We do not knowingly solicit it. If we learn that prohibited child information has been collected, we will take steps to remove it, subject to any legally required preservation. Contact [email protected] to report a concern.
2. Types of Users and Our Privacy Role
2.1 Customer-managed accounts
For personal information in documents, employee records, inspections, training, incidents, alerts, and other content we handle on a Customer's instructions, the Customer generally determines why it is processed and who may access it. Kresynt acts as a processor or service provider on that Customer's behalf, subject to applicable law and the agreement. This applies to paid subscriptions, Free Plans, and Trials; payment status alone does not determine our privacy role.
Account administrators and other authorized recipients may access, correct, export, share, or delete information within their permissions. This may include your submissions, assignments, training results, activity records, and alert acknowledgments. Contact your employer or the Customer about its workplace decisions and privacy practices. Kresynt also has its own duties under law and its agreements.
2.2 Information Kresynt manages for its own purposes
Kresynt determines the purposes of processing for its own customer relationships, billing, support inquiries, Website operations, permitted marketing, security administration, and legal compliance. For that information, we act as a controller or business where those legal terms apply. Our role depends on the particular activity, not a label applied to an entire account.
3. Information We Collect
The information depends on the features used and what you or the Customer provide. Sources include you, your employer or account administrator, authorized colleagues, connected services you enable, payment and communications providers, and automatic collection when you use the Service or Websites.
3.1 Account, contact, and billing information
Names, business and contact details, organization, job role, account identifiers, authentication information, permissions, subscription and Trial details, invoices, payments, and transaction records. Payment providers process payment information; we receive the transaction and payment-method information needed to administer billing. Do not send full payment-card details through ordinary support messages or content uploads.
3.2 Workplace content and AI outputs
Employee and contractor records; qualifications, certifications, training assignments and results; inspections, incidents, corrective actions, equipment restrictions, signatures, and audit records; and uploaded documents, photographs, recordings, transcripts, messages, prompts, and other materials. We also process generated reports, analyses, translations, and other outputs. Content may include personal information about people who do not have Kresynt accounts.
3.3 Device, usage, and communication records
IP addresses, device type, operating system, browser, session or application identifiers, request and event times, pages or features used, diagnostic and security logs, and cookie information. For supported alerts and messages, records may include recipients, contact details, configured rules, message content, provider identifiers, delivery or failure reports, acknowledgments, and consent or opt-out records. A delivery report does not by itself establish that a person read or understood a message.
3.4 Worksite and location information
Approximate location may be inferred from an IP address. Customers may also supply worksite addresses, coordinates, project locations, and assignments used for weather information, alerts, or other location-related features. These records can associate a person with a worksite. Photos, files, and recordings can contain location information or other identifying details supplied with that content.
3.5 Integrations, support, and optional information
When you or your administrator enable an available integration, we process the information and permissions needed for its authorized functions. We also receive support correspondence, feedback, survey responses, and other information you choose to provide, including optional profile or demographic details. An integration is not enabled merely by being mentioned in this Policy.
3.6 Sensitive information and verification
Workplace incident records may contain injury or illness information. Customers must limit sensitive information to lawful, necessary, supported uses and provide required notices and permissions. The Terms restrict unrelated medical histories, government identification, financial-account details, biometric identifiers, and other unsupported information. A use requiring Kresynt to act as a HIPAA business associate requires a separate signed arrangement before that use begins.
We may request proportionate identity or authority evidence when handling account-access, export, or privacy requests. Government identification is not routine. If less intrusive checks are insufficient, we provide a secure method, permit unnecessary details to be redacted where feasible, and limit the evidence to verification and required recordkeeping. Do not email identity documents or place them in general account folders.
4. How We Use Your Information
4.1 Service delivery and administration
We use information to create and administer accounts, authenticate users, apply permissions, manage subscriptions and payments, respond to inquiries, and provide configured workflows. This includes storing and retrieving content, managing inspections and training, generating reports, translating materials, and processing weather or equipment alerts and their delivery records.
4.2 Security, support, and improvement
We use relevant information to diagnose errors, support users, protect accounts and systems, investigate suspected misuse or unlawful content, respond to incidents, and enforce our agreements or legal rights. Authorized personnel and providers may access information as needed for these purposes under applicable restrictions. Service improvement involving Customer content remains limited to the permitted service-processing purposes; it is not an unrestricted right to reuse private records.
4.3 AI processing and automated features
When AI features are used, relevant content, prompts, and context are processed by Kresynt and its AI providers to produce the requested output. This can involve documents, images, audio, transcripts, search or retrieval, and translation. Outputs can contain personal information and are subject to applicable content protections.
We will not use Customer content, including prompts, uploaded materials, and generated outputs, to train or fine-tune AI or machine-learning models, or authorize our providers to do so, without the Customer's separate express written opt-in describing that use. Additional individual notices or permissions required by law must also be obtained. General acceptance of this Policy or the Terms, use of a free account, or a change to this Policy is not that opt-in. Processing a request, producing an output, or performing Customer-directed search, retrieval, or indexing is not model training.
Where a Customer enables an available automated-action or AI-agent feature, configured records, permissions, and instructions are processed to perform the authorized actions and record their results. This does not promise that any particular feature is available. The Terms require appropriate supervision and prohibit sole reliance on AI outputs for significant employment or similar decisions. Customers must arrange required human review and explain their own decision-making practices to affected people.
4.4 Service and marketing communications
We use contact details and communication records for authentication, security, assignments, reminders, operational alerts, billing, support, and legally required notices. Optional SMS messages are governed by the consent and opt-out arrangements in the Terms. A Customer entering an employee's number does not itself establish the employee's consent.
We may send Kresynt product news, offers, or other promotional communications where permitted and with consent where required. These are separate from required service messages. Private Customer content is not used for independent advertising or unapproved testimonials. Section 9 explains communication choices.
4.5 Aggregated or de-identified metrics
We may use aggregated or de-identified operational metrics to improve reliability, capacity, and usability where they do not identify Customers or individuals, disclose private Customer content, or bypass the model-training restriction. We maintain applicable safeguards and will not attempt re-identification except as law permits to verify or maintain de-identification.
4.6 Legal bases where applicable
Where European or UK data-protection law requires a legal basis for processing for our own purposes, we rely on: performance of a contract with you for account and service administration when you are the contracting party; legitimate interests in operating, securing, supporting, and improving our business and managing Customer relationships, where not overridden by your rights; compliance with legal obligations; and consent for activities requiring it, such as certain optional tracking or marketing. The Customer determines the lawful basis for workplace content processed on its behalf. Sensitive information requires any additional legal condition that applies.
5. How We Share Your Information
5.1 Service providers
We disclose the information needed for providers to perform hosting, storage, content delivery, AI processing, communications, payments, security, diagnostics, support, and permitted marketing functions. Providers acting on our behalf are subject to appropriate confidentiality, security, and use restrictions. They do not receive permission to use private Customer content for independent advertising or model training contrary to Section 4.3. Information identifying material subprocessors and their functions is available on request.
5.2 Customers, users, and integrations
Information is available to the Customer and recipients it authorizes through account permissions, assignments, reports, shared links, downloads, or enabled integrations. A connected provider may also process information under its own terms when you or the Customer choose its independent service. Copies already delivered outside Kresynt may remain with recipients after a link expires or an account is disabled; deleting our copy does not automatically delete theirs.
5.3 Affiliates and business transfers
Information may be disclosed to an affiliate involved in the described operations under corresponding restrictions, or to advisers and parties involved in a proposed or completed merger, acquisition, financing, reorganization, or asset transfer, subject to lawful confidentiality and use restrictions. A transaction does not itself authorize materially different uses without the notices and permissions required by law.
5.4 Legal purposes and requested disclosures
We may disclose information as described in Section 11, to establish or defend legal claims, or at your or the Customer's lawful direction. These provisions do not authorize sale of personal information or expand the processing license in the Terms. Section 12 addresses sale, advertising-related sharing, and regional rights.
6. Cookies and Similar Technologies
6.1 Purposes and choices
Cookies, local storage, and similar technologies support sign-in, session continuity, preferences, security, and the Website performance and usage analysis described in this Policy. You can control many of these technologies through your browser or device; blocking those needed for a requested feature may prevent it from functioning. Optional technologies requiring consent must not operate before that consent is obtained. Changing browser settings does not necessarily withdraw information already collected.
6.2 Website tracking disclosure
On our public informational and marketing website, we use analytics and behavior-analysis tools such as Google Analytics, Microsoft Clarity, or comparable services to understand how visitors find and use the website, identify usability problems, and improve its content, design, and performance.
6.3 Browser preference signals
Where required by applicable law, we honor recognized opt-out preference signals, including Global Privacy Control, for the browser or device transmitting them and any linked account as legally required. Such a signal does not require signing in. A browser's older Do Not Track setting is not the same as Global Privacy Control; its treatment is described in the tracking disclosure above. You may also contact us using Section 14's privacy-request method.
7. International Data Transfers
Kresynt operates in the United States. Information may be processed in the United States and other countries where our relevant providers operate, which may have different privacy laws. Applicable agreements may specify additional location restrictions. This Policy does not promise that every copy, support access, or processing operation remains in one country.
For restricted transfers from the EEA, United Kingdom, or Switzerland, we use the legally required safeguards. Depending on the transfer, these may include approved Standard Contractual Clauses with the necessary UK or Swiss adaptations, or another valid transfer mechanism. You may contact us for information about the safeguards applicable to your data and a copy where required, subject to necessary redactions. This Policy is not a transfer agreement and does not represent that Kresynt holds a privacy-framework certification.
8. Data Retention
8.1 Customer content and account closure
During service, we retain Customer content for the authorized purposes, subject to permitted deletion instructions and applicable agreements. Under Section 14 of the Terms, stored content associated with an ended Service, including saved AI outputs and attachments, is generally retained for 90 days after its Service End Date and deleted from live production systems on day 91, unless an allowed hold or earlier lawful deletion applies. Shared records still legitimately needed for another active Service are retained for that Service; their post-service period begins when the last Service needing them ends.
Ordinary application access ends with the affected Service. During the retention period, an authorized administrator may request a verified export. The standard format is JSON structured data, not attachment files; limited assisted attachment retrieval is available after an unexpected cutoff as specified in the Terms. A timely request can preserve needed data while verification or export is completed. These account-export procedures do not restrict an individual's statutory privacy rights or deadlines.
8.2 Backups and limited holds
Residual copies, including attachments, may remain in protected backups until rotated under our documented retention schedule, available on request. They are not used as ordinary production records. Restoration is limited to recovery, security, or legal purposes, and previously deleted data restored for recovery is re-deleted as appropriate. Applicable law or a binding DPA may require shorter retention.
We may retain only the information and for only the duration reasonably needed for legal duties, legal claims or holds, security or abuse investigations, or timely exports. After a hold ends, production deletion and protected backup rotation apply as described in the Terms.
8.3 Other records
Billing, transaction, support, security, privacy-request, and consent records may follow different schedules from Customer content. We determine retention by the purpose, sensitivity, required accounting or legal periods, dispute and security needs, and the need to demonstrate or honor privacy choices. Verification evidence is limited to what is reasonably needed. We may retain minimal suppression information to avoid resuming communications you declined. We delete or de-identify information when no continuing lawful purpose remains.
9. Your Rights and Choices
9.1 Access and privacy requests
Depending on the law that applies, you may have rights to know whether and how information is processed; obtain access or a portable copy; correct or delete information; restrict or object to processing; withdraw consent; limit certain uses of sensitive information; and opt out of sale, targeted advertising, or specified profiling. Section 12 explains regional rights. Rights can have legal exceptions, including protection of others' information and required recordkeeping.
Email [email protected] with your request and enough information to identify the relevant account or interaction. You do not need to create an account. For Customer-controlled workplace records, contact the Customer first; if you contact us, we will direct or assist the request as appropriate under our agreement and legal duties. We respond directly for information we control. We may verify identity or authority proportionately for requests requiring verification; we do not impose verification on opt-outs where prohibited. Do not include passwords or sensitive identity documents in an initial request.
9.2 Communication and device choices
Unsubscribe from promotional emails using the message's link or by contacting us. This does not stop necessary account, billing, security, or legal notices. For optional SMS, reply STOP where replies are supported, use an alternative stated in the message, or contact [email protected]. Other legally required revocation methods remain available. We honor revocation within applicable deadlines. Customers must arrange an alternative for required workplace communications. Browser or device settings may also control cookies and supported notification permissions.
Withdrawing consent does not affect processing already carried out lawfully or processing supported by another lawful basis. We may retain the minimum record needed to honor your choice. Removing information necessary for a requested feature may prevent that feature from operating.
9.3 Responses, appeals, and complaints
We respond within applicable legal deadlines and explain any permitted extension, denial, or lawful fee. To appeal a decision where an appeal right applies, reply to our response or email [email protected] with "Privacy Appeal," identifying the request and why you disagree. We explain the outcome within the applicable appeal deadline and provide regulator-contact information where required. You may complain directly to an appropriate regulator without first completing this process. We do not unlawfully discriminate or retaliate for exercising privacy rights. We accept authorized-agent requests where law permits, subject to appropriate authorization.
10. Data Security
We maintain reasonable administrative, technical, and physical safeguards appropriate to the information and associated risks. Customers remain responsible for their own devices, credentials, permissions, and lawful handling of content. No system or method of transmission or storage is completely secure. This Policy does not promise a particular certification, architecture, or complete recovery of lost data.
For a security incident involving Customer content in systems controlled by Kresynt or its processors, we provide notice and take reasonable containment, investigation, mitigation, and cooperation steps as required by applicable law, the Terms, and any binding DPA. We give direct individual or regulatory notice where we are legally responsible for doing so. Customer notice does not replace those duties. An ordinary service outage is not necessarily a personal-data security incident.
11. Responding to Law Enforcement and Legal Requests
We may disclose information when required by applicable law or valid legal process, and when otherwise lawfully necessary to protect rights or safety, prevent or investigate unlawful conduct, or establish or defend claims. We assess the request and limit disclosure to the lawful purpose. Where required or appropriate and legally permitted, we notify the affected Customer. Notice may be restricted by law, an investigation, or an emergency. Our legal-disclosure practices do not authorize unrelated use of Customer content.
12. California, Nevada, and Other Jurisdictions
12.1 Sale, sharing, and regional disclosures
We do not sell personal information. Sale, cross-context behavioral advertising "sharing," and targeted advertising can have different meanings under privacy laws. Section 6.2 addresses website tracking and related advertising choices. We do not sell or share mobile numbers, SMS opt-in information, or consent records for third-party or affiliate marketing. Providers may process them only for the restricted purposes described in this Policy and the Terms.
Sections 3 through 5 describe information categories, sources, purposes, and recipients; Section 8 explains retention. The categories handled or disclosed vary by feature: hosting and security providers process relevant account, content, location, and technical data; AI providers process content and context for requested AI features; communications providers process recipient, message, delivery, and consent information; and payment providers process relevant billing and payment information. Customer-directed recipients receive the content and related records the Customer authorizes.
12.2 California
Where the California Consumer Privacy Act applies to our processing, California residents may request access, correction, deletion, portability, information about collection and disclosure, opt-out of sale or cross-context behavioral advertising sharing, and limitation of qualifying uses of sensitive information, without unlawful discrimination. These protections may apply to employment and business-contact information where the law covers it. Requests use Section 9; any required advertising opt-out control is identified in Section 6.2. A statutory request is not limited to the contractual account-export format or retention window.
12.3 Maryland and other U.S. states
Where the Maryland Online Data Privacy Act applies, Maryland consumers may confirm and access processing, correct inaccuracies, delete data, obtain a portable copy, obtain a list of the categories of third parties receiving their data, and opt out of sale, targeted advertising, or profiling in furtherance of solely automated decisions with legal or similarly significant effects. Section 9 provides request, appeal, and complaint methods. Maryland's consumer law does not generally cover employment or commercial-context data; other laws or contractual protections may still apply.
Residents of other states may exercise the corresponding rights available under their applicable laws using the same contact method. Nevada residents may submit a verified request to opt out of a sale covered by Nevada law at [email protected], notwithstanding our no-sale policy.
12.4 EEA, United Kingdom, and Switzerland
Where applicable law grants them, rights include access, correction, erasure, restriction, portability, consent withdrawal, and objection. You may object to direct marketing at any time. You may also object to processing based on legitimate interests, subject to applicable legal grounds for continuing it. You may complain to the supervisory authority where you live, work, or believe an infringement occurred, including the UK Information Commissioner's Office where appropriate. Sections 4.6 and 7 address legal bases and transfers. Required representative or data-protection-officer details will be supplied in an applicable regional notice; no appointment or certification is implied by this Policy.
13. Changes to This Policy
We may update this Policy as our practices, services, or legal obligations change. We will update the date and provide notice of material changes as required by law, such as an email or prominent in-product notice. We obtain new consent before a changed use where required. Posting an update or continued use does not itself authorize model training, waive privacy rights, or expand the Customer-content license. An ownership or entity change does not remove existing legal restrictions on previously collected information.
14. Contact Us
Kresynt, LLC
Privacy questions, requests, and appeals: [email protected]
Website: https://kresynt.com
Privacy Policy: https://kresynt.com/privacy
Mailing address:
Kresynt LLC
P.O. Box 5051
Vienna, WV 26105
You may use "Privacy Request" or "Privacy Appeal" as the email subject to help route your message, but a particular subject line is not required to exercise a legal right. Include your country or state and the relevant account or interaction when helpful. An accessible copy of this Policy is available on request.