Privacy policy

Cloudlit Tech Inc. is the data controller for personal data collected through this website and the Karos Cloud platform. We are incorporated in Alberta, Canada, and operate from Calgary.

Privacy enquiries: [email protected]. Legal notices: [email protected].

We collect data in three ways:

• Account and identity data — name, work email, job title and organisation, collected when you register or request a demo. Used to provision your tenant, configure your role, and correspond with you about your account.
• Platform usage data — actions taken inside Karos Cloud portals, recorded in the audit trail. Used to maintain the integrity of the Capability × Role access model and to provide the platform service.
• Website and marketing data — email address and sector captured via the demo request form, and standard server logs. Used to respond to your enquiry and, with consent, to send onboarding communications.

Where your organisation is an enterprise customer, Cloudlit acts as a data processor for the personal data your employees enter into Karos Cloud portals. Your organisation is the data controller for that data and is responsible for obtaining any necessary consents from its employees.

For website visitors, demo requesters, and contacts at prospective customers, Cloudlit is the data controller.

We rely on the following legal bases under PIPEDA and, where applicable, GDPR:

• Contract performance — processing necessary to deliver the platform service under a customer agreement.
• Legitimate interests — security monitoring, fraud prevention, product improvement, and responding to sales enquiries.
• Consent — marketing communications. You may withdraw consent at any time via the unsubscribe link in any email.
• Legal obligation — where we are required to process data to comply with applicable law.

Karos AI processes requests on behalf of the person who asks. It holds no service account of its own and resolves every action through the same Capability × Role matrix as the user interface. Your data is not used to train AI models operated by third parties unless you explicitly instruct us otherwise.

AI credit usage is logged per user and per organisation. These logs are treated as platform usage data under clause 2.

This website uses strictly necessary cookies to maintain session state. We do not use third-party advertising trackers. Analytics, if enabled, use a privacy-preserving, cookieless method that does not fingerprint individual visitors.

You can manage browser cookies through your browser settings. Disabling session cookies will prevent you from signing in.

We share personal data only with:

• Infrastructure providers — Canadian-based cloud hosting providers under data processing agreements.
• Email delivery — for transactional and onboarding communications. Email addresses only; no other profile data.
• Legal and regulatory authorities — where required by law or to protect our legal rights.

We do not sell personal data. We do not share personal data with advertisers.

Karos Cloud is built and hosted in Canada. We do not routinely transfer personal data outside Canada or the European Economic Area. Where a sub-processor operates outside those jurisdictions, we apply standard contractual clauses or equivalent safeguards before transfer.

We apply encryption in transit (TLS 1.2+) and at rest, access controls enforced by the Capability × Role matrix, and regular penetration testing. The platform's permission model is described in detail at /security.

Security incidents should be reported to [email protected]. We operate a responsible disclosure programme.

We retain personal data for as long as your account is active plus a period sufficient to meet our legal obligations, resolve disputes, and enforce our agreements:

• Platform audit logs — 7 years from the date of the action, to support regulatory audit requirements.
• Account data — for the duration of the customer agreement plus 2 years, then deleted or anonymised.
• Marketing data — until you unsubscribe or request deletion, or 3 years of inactivity, whichever is earlier.
• Website server logs — 90 days.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Object to or restrict certain processing
• Port your data in a machine-readable format
• Withdraw consent for marketing at any time

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Karos Cloud is an enterprise platform. We do not knowingly collect personal data from persons under 18. If you believe a minor has submitted data to us, contact [email protected] and we will delete it promptly.

This website may link to external sites. We are not responsible for the privacy practices of those sites and recommend you read their policies before submitting personal data.

We will update this policy as our practices evolve or regulation requires. Material changes will be announced via in-platform notification and, where required by law, your prior consent will be sought. The "last updated" date at the top of this page reflects the most recent revision.

If you are located in Canada, you may lodge a complaint with the Office of the Privacy Commissioner of Canada. If you are in the European Economic Area, you may complain to your local data protection authority.

We would prefer to resolve any concerns directly — please contact us first at [email protected].

All privacy matters: [email protected]
Legal notices: [email protected]
Security disclosures: [email protected]
Mailing address: Cloudlit Tech Inc., 407 9 Ave SE, Calgary, Alberta, Canada