Privacy Policy

This Privacy Policy applies to:

• KM Consulting websites
• KM Execution System web application
• future KM Execution System mobile applications
• demo environments
• account registration
• customer support
• product communications
• related online services

KM Consulting may collect the following categories of information.

Account information:

• name
• email address
• company or organization name
• job title or role
• login and authentication information
• account settings
• communication preferences

Workspace and product information:

• workspace name
• organization name
• project names
• task details
• risk and issue records
• owner and manager assignments
• reports
• comments
• notes
• workflow information
• product activity
• uploaded files or attachments if that feature is enabled

AI feature information, when Assisted AI is enabled and used:

• text an authorized user deliberately submits for AI Intake
• limited organization context needed to generate a draft, such as existing project names and organization member names
• AI-generated draft suggestions
• AI feature settings, request timestamps, model identifier, usage information, request outcome, and a cryptographic hash and length of the submitted text

KM Consulting's AI audit records are designed to retain request metadata rather than the submitted source text itself. If a user approves a draft, the resulting projects, tasks, risks, and other records become Customer Data in the workspace.

Billing information:

• billing contact
• subscription plan
• invoice history
• payment status
• transaction records
• tax information if needed

Payment card or bank details, if used, are generally processed by third-party payment providers and are not intended to be stored directly by KM Consulting.

Technical information:

• IP address
• browser type
• device type
• operating system
• approximate location from IP address
• session information
• log data
• referral source
• pages viewed
• actions taken in the Service
• error reports
• performance data
• security logs

Communication information:

• emails sent to KM Consulting
• support requests
• implementation discussions
• product feedback
• survey responses
• meeting notes related to onboarding or customer support

KM Consulting uses information to:

• provide the Service
• create and manage accounts
• authenticate users
• maintain customer workspaces
• provide optional Assisted AI draft-generation features when enabled by the customer
• process subscriptions and billing
• provide customer support
• troubleshoot issues
• improve product functionality
• monitor performance
• protect the Service from fraud, abuse, and security threats
• communicate administrative notices
• send product updates where appropriate
• enforce agreements and policies
• comply with legal obligations

Customer Data belongs to the customer.

KM Consulting processes Customer Data to provide, support, secure, maintain, and improve the Service.

KM Consulting does not sell Customer Data.

KM Consulting does not use Customer Data for third-party advertising.

KM Consulting may share information with trusted third-party service providers and advisors as needed for business, operational, security, legal, or service-related purposes.

These may include providers that support hosting, database operations, authentication, email delivery, payments, analytics, monitoring, logging, customer support, legal services, accounting, business operations, and AI processing.

When an authorized user uses Assisted AI, KM Consulting transmits the AI Input and the limited workspace context described in this Policy to OpenAI's API to generate the requested draft. KM Consulting does not use a consumer ChatGPT account for this feature.

KM Consulting may also share information when required by law, legal process, government request, policy enforcement, security investigation, protection of rights, or business transaction such as merger, acquisition, financing, restructuring, or sale of assets.

Assisted AI is optional and is controlled at the organization level. If Assisted AI is off, the Service does not send workspace text to the AI provider through the AI Intake feature.

For AI Intake, KM Consulting uses the OpenAI API and requests that the Responses API does not store application response state for the request. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in to data sharing. OpenAI may nevertheless retain limited content in abuse-monitoring logs under its applicable data controls and legal obligations.

Customers should review OpenAI's then-current API data controls and should not submit information that is prohibited by these policies, applicable law, a customer contract, or their own internal data-handling rules.

KM Consulting may use cookies and similar technologies for login sessions, security, preferences, analytics, performance monitoring, and product improvement.

More information is available in the Cookie Policy.

KM Consulting keeps information as long as reasonably needed to provide the Service, support customers, maintain business records, comply with legal obligations, resolve disputes, enforce agreements, and protect the Service.

Customer Data may be deleted after cancellation or termination according to KM Consulting’s retention practices and technical limitations.

Some information may remain for a limited period in backups, logs, security records, billing records, tax records, legal records, or archives.

Users may request account deletion through the public Account Deletion page at app.consultingkm.org/account-deletion or by contacting info@consultingkm.org.

KM Consulting may require identity, admin, billing, or ownership verification before processing requests. We aim to complete verified requests within 30 days.

Account credentials, profile information, active sessions, and device or push identifiers associated with the account are deleted. Shared organization records may remain where they are needed for the organization's collaboration history. Billing and tax records may be retained for up to seven years; security and fraud-prevention records for up to 90 days; and backup copies for up to 30 days, unless a longer period is required by law.

If a requester is the sole owner of an organization workspace, KM Consulting may require ownership transfer or confirmation to delete the organization workspace before completing the individual account deletion.

KM Consulting uses reasonable administrative, technical, and organizational measures to protect information.

No system is completely secure, and KM Consulting cannot guarantee that unauthorized access, loss, misuse, or disclosure will never occur.

Customers are responsible for managing users, passwords, workspace access, devices, and the types of information entered into the Service.

If KM Consulting becomes aware of a security incident involving personal information, KM Consulting will review the incident and provide notices when required by applicable law or contractual obligation.

If you access the Service from outside the United States, information may be processed in the United States or other countries where KM Consulting or its service providers operate.

KM Execution System is intended for business use and is not directed to children.

KM Consulting does not knowingly collect personal information from children.

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or request a copy of certain personal information.

To make a request, contact info@consultingkm.org.

KM Consulting may update this Privacy Policy from time to time.

If material changes are made, KM Consulting will update the “Last updated” date and may notify active customers by email, in-app notice, or another reasonable method.

Questions may be sent to info@consultingkm.org.