Privacy Policy

At Kernalite, operated by Dunn-Carabali, LLC ("we," "us," or "our"), we respect your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information across the Fully Managed Cloud service and our marketing website at kernalite.com.

The way we handle your data differs significantly between the two models. Please read Sections 2 and 3 carefully to understand which applies to you.

1. Who Is the Data Controller

For information about your purchase, account, and our website, Dunn-Carabali, LLC is the data controller. For the lead, contact, and business data you put into the CRM, the controller is you, with Dunn-Carabali, LLC acting as your data processor. We process that data only to operate the service on your behalf and under your instructions.

2. Fully Managed Cloud — Hosted Data

The Managed Cloud product runs on infrastructure we operate. To deliver the service, we necessarily store and process the data you and your team enter into the CRM, including lead and contact records, communications, and account settings. We process this data:

• To host, maintain, back up, secure, and support your account;
• Under your direction, as your processor — we do not sell it, and we do not use it for our own marketing;
• With access limited to authorized personnel for operations, support, and abuse-prevention purposes.

You may request an export of your data, or its deletion, at any time (see Section 10). Deletion may be delayed where retention is required by law or to resolve disputes.

3. Information We Collect

• Account & billing information: name, email address, and the order/subscription identifiers and billing details needed to process your purchase. Card numbers are handled by our payment processors, not stored by us.
• Account & provisioning data: subscription status and provisioning tokens.
• Support communications: messages, logs, or screenshots you voluntarily provide.
• Website & usage data: standard server logs, cookies, and analytics from your visits to kernalite.com (see Section 6).
• Managed Cloud application data: as described in Section 3.
• Signup IP address: the IP address used to start a free trial, retained to enforce the one-trial-per-customer limit and prevent abuse.

We do not collect or store full payment card numbers at any point — see Section 5.

4. Payment Processing

We use PayPal and Stripe to process payments. When you pay, your payment details are collected and processed directly by these providers under their own privacy policies. We receive only confirmation of payment, the transaction/subscription identifier, and the email associated with the transaction. We do not store full card numbers.

5. Cookies & Website Analytics

Our website uses cookies and similar technologies for essential functionality, preference storage (such as light/dark theme), and aggregate analytics. A cookie-consent banner is presented where required. You can control cookies through your browser settings; disabling some cookies may affect site functionality.

6. Third-Party Integrations You Enable

Kernalite lets you connect third-party services (e.g., Twilio, SendGrid, PostGrid, OpenAI, Gemini, IDI, BatchService, Google). When you enable these, data flows to those providers under their respective privacy policies and your agreements with them. These calls are made from our infrastructure at your direction. You are responsible for your lawful basis to send data to any integration you enable.

7. Mobile App & Device Permissions

Our iOS and Android app ("Kernalite Mobile") is a thin client for your CRM and holds no business data of its own. It requests device permissions only to power features you actively use, and only after you invoke the relevant feature. If you decline a permission the app keeps working and simply skips that feature; we do not show messages asking you to reconsider a denial. You can change any permission at any time in your device Settings.

• Camera — take property photos and scan business cards you choose to add to your CRM.
• Photo Library — attach photos you select to properties and contacts.
• Location (while in use only) — trace your "Driving for Dollars" route and find leads near you. We do not access your location in the background.
• Calendar — import events you choose from your device calendar into the CRM.
• Contacts — when you tap "Import from device," the app reads your device contacts on the device and shows them so you can pick who to add. Only the individual contacts you select are saved, and they are written to your own private Managed Cloud workspace. The app does not upload your address book in bulk, does not use your contacts for any other purpose, and does not share contact data with any third party. We, the developer, do not collect or receive your device contacts.

Any data the app sends travels only to your CRM — your account on our infrastructure, processed under Section 2. We do not sell device data, and the app contains no third-party advertising or data-broker SDKs.

8. SMS & Text Messaging

Kernalite can send and receive SMS/MMS text messages on your behalf through telephony providers you connect, such as Twilio. When you use this feature you are the message sender and the party responsible for obtaining each recipient's prior express consent to be contacted, and for honoring opt-out requests, as required by the TCPA, CTIA guidelines, and carrier A2P 10DLC rules.

• Consent: you must collect and retain proof of consent before texting a contact. Kernalite provides opt-in capture and per-contact opt-out tracking to help you comply.
• Opt-out & help: recipients may reply STOP to unsubscribe and HELP for assistance at any time; suppression is honored automatically. Message frequency varies by your campaigns, and message and data rates may apply.
• No sharing of opt-in data: phone numbers and SMS consent are used only to deliver the messages you send. We do not sell phone numbers, and mobile opt-in information is never shared with third parties or affiliates for their own marketing or promotional purposes.
• Carrier handling: message content and phone numbers are transmitted to your messaging provider (e.g., Twilio) and the destination carriers solely to deliver the message, under their respective privacy terms.

These messages are sent from our infrastructure at your direction. You are the sender of record.

9. Your Privacy Rights (GDPR / CCPA / CPRA)

Depending on where you live, you may have the right to access, correct, port, restrict, or delete your personal information, to object to certain processing, and to not be discriminated against for exercising these rights. We do not sell your personal information.

• Account/billing data: contact us to exercise these rights and we will respond within the time required by applicable law.
• Managed Cloud application data: because we act as your processor, requests from data subjects (e.g., the leads in your CRM) should be directed to you as the controller; we will assist you in fulfilling them.

10. Data Retention & Deletion

We retain account, billing, and license records for as long as needed to provide the service, comply with legal and tax obligations, resolve disputes, and enforce our agreements.

11.1 We do not delete your workspace for non-payment

If your free trial ends without a purchase, or you cancel a subscription, your Managed Cloud workspace is locked, not erased. We retain that data indefinitely so you can return to it, and subscribing at any point restores access to everything exactly as you left it.

There is one exception. Where a workspace is locked because a payment method failed and the failure is not resolved, we may permanently delete the workspace and its contents after forty-five (45) days. We notify the account owner before that happens.

11.2 Requesting deletion

The workspace owner may request deletion at any time from Settings, or by emailing privacy@kernalite.com. On deletion we permanently remove every record associated with that workspace — contacts, leads, messages, documents, activity history, and any stored third-party integration credentials.

Deletion is permanent and cannot be reversed. Residual copies may persist briefly in encrypted backups and are overwritten on our normal backup rotation. We may retain a minimal transaction record (such as an invoice) where law requires it.

One exception, stated plainly. The free trial is limited to one per customer. To enforce that after a workspace has been deleted, we keep a one-way cryptographic hash of the email address that started the trial — not the address itself. A hash cannot be reversed into an email address. It is never used to contact you, is never shared, and exists only to answer whether a given address has already had a trial. Without it, anyone could delete their workspace and immediately claim another free trial.

11. Data Security

We apply administrative, technical, and physical safeguards including managed SSL/TLS, access controls, patching, and routine backups. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. Children's Privacy

Kernalite is a business product not directed to children, and we do not knowingly collect personal information from anyone under 18.

13. International Transfers

We operate from the United States, and your information may be processed there. Where required, we rely on appropriate safeguards for cross-border transfers.

14. Changes to This Policy

We may update this Policy from time to time. The "Last Updated" date reflects the latest revision, and we will notify account holders of material changes via the email associated with their account.

15. Contact Us

Questions or privacy requests: legal@kernalite.com, or via the contact form on our homepage. Dunn-Carabali, LLC is governed by the laws of the State of Florida. See also our Terms of Service, Refund Policy, and EULA.