Privacy notice

Koral Digital ("Koral Digital," "we," "us" or "our") is a digital operations and systems integration consultancy based in Frisco, Texas. We help home-service businesses connect and improve the tools they use to respond to inquiries, follow up on estimates and track results.

This privacy policy explains what personal information we collect through koraldigital.com (the "website") and our client portal (the "portal"), how we use it, who we share it with and the choices you have. It does not cover the websites, software or services of other companies, including tools our clients use, which are governed by their own policies.

We collect information you give us directly, information generated when you use the website or portal, and limited technical information needed to keep our services secure.

Information you provide through our contact form may include:

• Your name, company name and email address.
• Your phone number, if you choose to provide it.
• Your industry, the approximate number of leads your business receives each month, the CRM or software you currently use and the service you are interested in, if you choose to provide them.
• A description of the problem you would like help with, and any message you include.
• Your contact preferences, including whether you agree to receive email or text messages from us.
• How you reached us: campaign (UTM) parameters in the link you followed, the referring website and the page on which you first arrived.

If you are invited to the client portal, we collect your name, email address, the organization you belong to, your role in that organization and an identifier from our authentication provider that links your sign-in to your account. We also store content you or your colleagues submit in the portal, such as support requests, messages, comments and uploaded documents, along with records of key account activity (for example, who changed a project status or invited a team member) for security and audit purposes.

When you email us, book a meeting or work with us on a project, we keep the correspondence, meeting notes and project records needed to provide our services.

When you browse the website, we record limited first-party usage events, such as the page path you viewed, clicks on calls to action (for example, a "Book a consultation" button), campaign (UTM) parameters, the domain of the referring website and a random identifier generated in your browser for the current browsing session. This identifier is not linked to your name or email address. We do not use advertising cookies or third-party advertising trackers.

To protect the website from spam and abuse, we process your IP address when you submit a form or make other requests. For rate limiting, we store only a salted hash of your IP address rather than the address itself. Our hosting and security providers may also process IP addresses and similar technical data in their own logs. Our application logs are configured to redact sensitive values such as passwords and access tokens.

We use the information described above to:

• Respond to your inquiry, schedule consultations and provide the services you request.
• Create and manage our internal record of your inquiry, including follow-up tasks and proposals.
• Notify our staff that a new inquiry has arrived, which may involve sending an internal email that contains the details you submitted.
• Operate the client portal, including authenticating users, controlling access to each organization's information and sharing project updates and documents.
• Send you messages you have agreed to receive, and service messages related to an active engagement.
• Understand, in aggregate, which pages and campaigns lead people to contact us, so we can improve the website.
• Protect the website, portal and our users, including preventing spam, abuse and unauthorized access.
• Comply with legal obligations and enforce our agreements.

We process personal information when it is necessary to respond to your request or to perform a contract with you or your organization, when we have a legitimate business interest that is not outweighed by your rights (such as keeping our services secure and understanding how the website is used), when the law requires it, or with your consent.

Our contact form asks for your contact preferences separately from your inquiry. We record those preferences with your submission. We do not send marketing text messages without your express consent, and you can withdraw consent at any time by replying STOP to a text message, using the unsubscribe link in an email or contacting us at contact@koraldigital.com. Withdrawing consent does not affect messages already sent or processing that relies on a different legal basis.

We do not send the information you submit through our contact form or portal to third-party artificial intelligence providers without disclosing it. If we introduce AI-assisted features that involve personal information, we will update this policy to describe the provider category and the data involved before those features are used, and a person will review any AI-assisted content before it is sent on our behalf.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as described below.

We use service providers that process information on our behalf to run the website and portal. They are permitted to use it only to provide services to us. The categories of providers we use or may use are:

• Website and application hosting providers.
• A cloud provider that hosts our PostgreSQL database, where contact form submissions, portal accounts and project records are stored.
• An authentication provider (Descope) that manages sign-in for client and staff portal accounts.
• An email service provider that delivers internal notification emails and service messages.
• A cloud object storage provider that stores documents shared through the client portal.
• Scheduling tools, if you choose to book a meeting through a booking link. Information you enter there is also subject to that provider's own privacy policy.
• Professional advisers, such as accountants and attorneys, where needed.

A list of the specific vendors we use in each category will be published before the website and portal launch publicly, and kept up to date afterward.

We may also disclose information when required by law or legal process, to protect the rights, safety or property of Koral Digital, our clients or others, or in connection with a merger, acquisition or sale of all or part of our business, in which case we will require the recipient to honor this policy. We will share information with other parties at your direction, for example when you ask us to connect one of your business tools.

When we work inside a client's own systems, such as their CRM, we access and process that information only on the client's instructions and under our written agreement with that client. The client's own privacy notice governs how it handles its customers' information.

We keep personal information only as long as we need it for the purposes described in this policy. As a general guide, we keep inquiry records while we are in active conversation with you and for a reasonable period afterward in case you contact us again; we keep client and project records for the duration of the engagement and as long as needed afterward for legal, accounting and dispute-resolution purposes; and we keep usage events and rate-limiting records only as long as they are useful for security and aggregate reporting.

When information is no longer needed, we delete it or de-identify it. Specific retention periods will be confirmed before public launch. Copies may persist for a limited time in backups maintained by our hosting providers before they are overwritten.

We use reasonable administrative, technical and organizational measures designed to protect personal information. These include encrypted connections (HTTPS), authentication through a dedicated identity provider, role-based access controls that limit each portal user to their own organization's information, server-side permission checks, audit logs of key changes, and expiring links for downloading shared documents.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident that affects your personal information, we will notify you as required by applicable law.

You can ask us to access, correct or delete the personal information we hold about you, and you can opt out of marketing messages at any time. Portal users can also ask their organization's account owner or us to update their account details.

Depending on where you live and whether a particular law applies to us, state privacy laws, such as the Texas Data Privacy and Security Act, may give you additional rights, such as the right to obtain a copy of your data, to correct or delete it, to opt out of certain processing, and to appeal a decision we make about your request. We will respond to requests as required by applicable law.

To make a request, email contact@koraldigital.com. We may need to verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

The website and portal are intended for businesses and are not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this policy as our services, vendors or legal obligations change. When we do, we will revise the "last updated" date on this page. If we make a material change, we will take reasonable steps to let you know, such as posting a notice on the website or emailing portal users.

If you have questions about this policy or how we handle personal information, contact Koral Digital at contact@koraldigital.com. We are based in Frisco, Texas.