Privacy Policy

This policy describes how Kierland IT LLC (“Kierland IT,” “we,” “us”) collects, uses, and protects information through our website, our client portal, and the IT, hosting and email services we provide. It works alongside our Terms of Service, which controls where the two overlap.

Information about you that we collect for our own business, like your contact and billing details, is covered in full here. Information that belongs to our clients and that we only handle while supporting them, like the files and email on their systems, is covered separately under “Data we access while supporting you.”

When you contact us or request a quote: your name, email address, phone number, business name, and whatever you write in the message field.

When you create a client portal account: your name, email address, and a securely hashed password (we never store your actual password; see “How we protect your information” below). If you choose to add a phone number and check the SMS consent box, we store the number and a record of when you consented.

Through your use of the portal and our services: the tickets you open and our replies, your invoices, the hosting sites and mailboxes we’ve set up for you, and the names and contact details of the people at your business we support.

If you pay an invoice online: payment is processed directly by Stripe. We never see or store your full card number. Stripe gives us back a reference to your saved payment method, not the card details themselves, and that saved method is what recurring invoices are charged to.

Automatically: like most websites, our servers record your IP address, browser type, the pages you request and when, in standard server logs. We also keep IP addresses for up to a day to protect forms and logins from abuse. We don’t use any of this for tracking or advertising.

We use the information we collect to:

• Answer your questions and prepare quotes.
• Provide, monitor and support the IT, hosting and email services you’ve engaged us for.
• Run your client portal account, including signing in and resetting your password.
• Send invoices, take payments, and keep the records tax law requires.
• Send account, service and security notices by email, and by text only if you’ve opted in.
• Protect our site, portal and servers from abuse, fraud and attacks.
• Meet our legal obligations and enforce our terms.

We don’t use your information for advertising, and we don’t sell it.

Supporting your business means we can see and work with data on your systems: files, email, user accounts, device details, and the visitor logs of websites we host for you. That data is yours. We act on your behalf and on your instructions, and we access it only as needed to provide the services you’ve engaged us for, such as fixing a problem, keeping systems updated, or investigating a security alert. Our monitoring and security tools collect device and event information only to support and protect your systems.

We never use your data for our own purposes, share it with another client, or sell it. Access is limited to the people on our team working on your account. If your business handles regulated data, such as health or payment card information, tell us so we can agree on any extra safeguards or a separate data agreement the law requires.

When our service ends, we return or hand over your data as described in our Terms of Service, remove our access, and delete the copies we hold within 30 days, unless you ask us to keep them or the law requires otherwise.

If you provide a phone number and check the consent box, we use it only to send the account and invoice texts described in our Terms of Service. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are excluded from every kind of sharing described in this policy, and are never shared with any third party. You can remove your number at any time from the client portal, or reply STOP to any text to opt out.

The client portal sets one cookie to keep you signed in: a secure, HTTP-only session cookie that isn’t readable by scripts on the page and isn’t used for tracking or advertising. We don’t run third-party analytics, ad-tracking pixels or social media trackers on this site, and our fonts are served from our own server.

Because we don’t track you across sites, there’s nothing for a browser’s “Do Not Track” or Global Privacy Control signal to switch off. We treat both as a request not to sell or share your information, which we already don’t do.

We share information only with the providers that make our services work, and only what each one needs:

• Stripe processes card payments and stores saved cards.
• Linode (Akamai) provides the servers our site, portal, hosting and email run on, in the United States.
• Twilio delivers account and invoice texts, once text messaging is turned on, to people who’ve opted in.
• Software vendors whose tools we use to support you, such as Microsoft or Google for accounts we manage on your behalf, under your own agreements with them.

Our email is sent from our own mail server, not a third-party marketing service. We may also disclose information when the law requires it, to protect our rights or someone’s safety, or to a buyer if our business is sold, in which case this policy continues to apply to it. Our affiliate Replug Media sees your information only if you’re also its client. We don’t sell your information or share it with anyone for their own marketing.

We keep information only as long as we need it:

• Contact and quote requests: as long as needed to respond and follow up, or until you ask us to delete them.
• Portal accounts and tickets: while your account is active, and for a reasonable time afterward in case questions come up.
• Invoices and payment records: for as long as tax and accounting rules require, which is several years.
• IP addresses used for abuse protection: up to 24 hours.
• Server logs: a limited time, after which they’re rotated out.
• Your business’s data and hosted sites, including backups: deleted within 30 days after our service ends, as described above.

The whole site and portal are served over encrypted HTTPS connections. Portal passwords are stored as salted, one-way cryptographic hashes, so we can’t look up or recover your actual password, and neither can anyone who gained access to our database. Your sign-in cookie is signed so it can’t be forged, sign-in and form attempts are rate limited, and access to client data and server administration is limited to the people who need it. Website backups are stored where the website software itself can’t read them.

No method of storing or sending information is completely secure, so we can’t guarantee absolute security, but we work to protect your information and fix weaknesses as soon as we find them.

If a breach exposes your personal information, we’ll notify you as Arizona law requires, no later than 45 days after we determine it happened, and notify the authorities and consumer reporting agencies where the law requires that too. If an incident affects systems we manage for your business, we’ll tell your named contacts promptly and help you meet your own notification duties.

You can ask us to show you the personal information we hold about you, correct it, give you a copy, or delete it. You can update your name, email and phone number yourself in the client portal. To make any other request, contact us using the details below. We’ll confirm the request comes from you, then respond within 30 days.

We’ll honor these requests wherever you live, subject to what we’re required to keep for billing or legal reasons. We don’t sell or share personal information for advertising, and we won’t treat you differently for using your privacy rights.

We’re based in Arizona, our services are for businesses in the United States, and the information we hold is stored on servers in the United States.

We email you about your account, tickets, invoices, services and security. These messages are part of the service, so they don’t have an unsubscribe link. If we ever send newsletters or promotional email, we’ll send them only to people who’ve agreed to receive them, and each one will include a way to unsubscribe.

Our site and services are intended for businesses and aren’t directed at anyone under 18. We don’t knowingly collect information from children under 13. If you think a child has given us information, contact us and we’ll delete it.

We may update this policy from time to time; the “last updated” date above reflects the most recent change. If a change materially affects how we use information we already hold, we’ll email current clients before it takes effect.

Questions about this policy, or a request about your data? contact@kierlandit.com or (480) 360-4362. Kierland IT LLC, Scottsdale, Arizona.

Back to home