Privacy Policy

Last Updated: May 29, 2026

At Kernalite, operated by Dunn-Carabali, LLC ("we," "us," or "our"), we respect your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information across our two product models — the Self-Hosted Lifetime appliance and the Fully Managed Cloud service — and across our marketing website at kernalite.com.

The way we handle your data differs significantly between the two models. Please read Sections 2 and 3 carefully to understand which applies to you.

1. Who Is the Data Controller

For information about your purchase, account, and our website, Dunn-Carabali, LLC is the data controller. For the lead, contact, and business data you put into the CRM, the controller is: you (Self-Hosted), or you, with Dunn-Carabali, LLC acting as your data processor (Managed Cloud). In the Managed Cloud model we process that data only to operate the service on your behalf and under your instructions.

2. Self-Hosted Lifetime — Data Sovereignty

The Self-Hosted product runs on your own server. Once installed, all lead data, contact information, messages, and business intelligence are stored directly on your infrastructure. We do not have access to your database, your credentials, or your lead data unless you explicitly share it with us for support.

The appliance periodically contacts our central licensing service ("Brain") to validate your license key and enforce the EULA. These calls transmit your license key, installation domain, and a hardware/installation fingerprint — not your lead data.

3. Fully Managed Cloud — Hosted Data

The Managed Cloud product runs on infrastructure we operate. To deliver the service, we necessarily store and process the data you and your team enter into the CRM, including lead and contact records, communications, and account settings. We process this data:

  • To host, maintain, back up, secure, and support your account;
  • Under your direction, as your processor — we do not sell it, and we do not use it for our own marketing;
  • With access limited to authorized personnel for operations, support, and abuse-prevention purposes.

You may request an export of your data, or its deletion, at any time (see Section 8). Deletion may be delayed where retention is required by law or to resolve disputes.

4. Information We Collect (Both Models)

  • Account & billing information: name, email address, and the order/subscription identifiers and billing details needed to process your purchase. Card numbers are handled by our payment processors, not stored by us.
  • License & provisioning data: license keys, installation domains, subscription status, and provisioning tokens.
  • Support communications: messages, logs, or screenshots you voluntarily provide.
  • Website & usage data: standard server logs, cookies, and analytics from your visits to kernalite.com (see Section 6).
  • Managed Cloud application data: as described in Section 3.

5. Payment Processing

We use PayPal and Stripe to process payments. When you pay, your payment details are collected and processed directly by these providers under their own privacy policies. We receive only confirmation of payment, the transaction/subscription identifier, and the email associated with the transaction. We do not store full card numbers.

6. Cookies & Website Analytics

Our website uses cookies and similar technologies for essential functionality, preference storage (such as light/dark theme), and aggregate analytics. A cookie-consent banner is presented where required. You can control cookies through your browser settings; disabling some cookies may affect site functionality.

7. Third-Party Integrations You Enable

Kernalite lets you connect third-party services (e.g., Twilio, SendGrid, PostGrid, OpenAI, Gemini, IDI, BatchService, Google). When you enable these, data flows to those providers under their respective privacy policies and your agreements with them. In the Self-Hosted model, Kernalite acts as a conduit on your private server; in the Managed Cloud model, these calls are made from our infrastructure at your direction. You are responsible for your lawful basis to send data to any integration you enable.

8. Your Privacy Rights (GDPR / CCPA / CPRA)

Depending on where you live, you may have the right to access, correct, port, restrict, or delete your personal information, to object to certain processing, and to not be discriminated against for exercising these rights. We do not sell your personal information.

  • Account/billing data: contact us to exercise these rights and we will respond within the time required by applicable law.
  • Managed Cloud application data: because we act as your processor, requests from data subjects (e.g., the leads in your CRM) should be directed to you as the controller; we will assist you in fulfilling them.
  • Self-Hosted application data: this data lives on your server and is solely under your control; we cannot access or delete it for you.

9. Data Retention

We retain account, billing, and license records for as long as needed to provide the service, comply with legal and tax obligations, resolve disputes, and enforce our agreements. Managed Cloud application data is retained for the life of your subscription and for a limited wind-down period after cancellation, after which it is deleted or anonymized unless law requires otherwise.

10. Data Security

For Managed Cloud, we apply administrative, technical, and physical safeguards including managed SSL/TLS, access controls, patching, and routine backups. For Self-Hosted, security of the data is primarily your responsibility; we provide secure-coding practices and tooling (such as LicenseGuard) and recommend industry-standard server hardening. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

Kernalite is a business product not directed to children, and we do not knowingly collect personal information from anyone under 18.

12. International Transfers

We operate from the United States, and your information may be processed there. Where required, we rely on appropriate safeguards for cross-border transfers.

13. Changes to This Policy

We may update this Policy from time to time. The "Last Updated" date reflects the latest revision, and we will notify account holders of material changes via the email associated with their account.

14. Contact Us

Questions or privacy requests: legal@kernalite.com, or via the contact form on our homepage. Dunn-Carabali, LLC is governed by the laws of the State of Florida. See also our Terms of Service, Refund Policy, and EULA.