Privacy policy

Grace Technology operates GateKipas, a visitor, workforce, and business-management service. This policy describes the personal information GateKipas collects and processes through its website, applications, and business integrations, why it is used, whom it may be shared with, and how to contact us. When a business uses GateKipas to manage visitors, employees, students, or customer contacts, that business generally decides why and how those records are used, and GateKipas processes them to provide the service under its instructions. GateKipas is responsible for its own account, website, support, and advertising activities. The exact legal roles may depend on the activity and applicable law.

We collect business account and administrator details such as name, email, phone, business name, location, role, language, and settings. Stripe handles payment-card processing; GateKipas receives billing and subscription records but does not store full card numbers. We collect support messages and any information you choose to submit. Our website also records a browser identifier, pages and actions visited, referral and campaign information, device/browser data, approximate network information, and timestamps for site analytics and security. When configured, Google Analytics receives site-usage events. If you accept optional Meta marketing tracking, the Meta Pixel may receive eligible public-page visits and a confirmed new-business registration event; Meta may also receive standard browser and network data through its technology. We do not deliberately include names, email addresses, phone numbers, or business IDs in Pixel event parameters.

A business may collect visitor names, contact details, host, visit purpose, check-in and check-out times, answers to its custom fields, and signatures or acknowledgments through GateKipas. The business determines its collection settings and is responsible for giving appropriate notices and obtaining any required permissions. Some fields may be necessary for a business's entry process; providing them is not always optional. If a business later enables CRM messaging, contact details and permission records may be processed under the separate channel, purpose, location, and suppression controls. That sending capability is currently inactive.

For employee and workforce features, a business may enter names, contact and department details, schedules, time entries, attendance records, leave requests, payroll-related information, and authentication credentials or identifiers. The business controls its use of these records and access by assigned roles. We process them to deliver the requested features, maintain security, and meet applicable obligations. Employees should contact their business administrator about their workplace records and may also contact GateKipas for assistance.

Where WebAuthn-based employee authentication is offered, GateKipas may store credential identifiers and public keys used to verify sign-in. Fingerprint or face matching, if used, occurs through the employee's device or authenticator; GateKipas does not receive the raw fingerprint or face image from that process. Businesses must assess and provide any notices or obtain any permissions required for their use of employee authentication. Contact the business administrator to remove an enrollment or ask us for assistance.

A school or other education customer may enter student names, class or identifier, guardian and authorized-pickup details, and notes, which could include sensitive information. The customer controls what it enters and who may access it through assigned roles. Student and guardian information is used to provide the requested school workflow, not to advertise GateKipas. The school and GateKipas each have responsibilities under applicable student and children's privacy laws; use of the service alone does not establish compliance with FERPA, COPPA, or other requirements. Customers should avoid entering unnecessary sensitive information.

We process information to provide and secure the service; perform check-in, timekeeping, notifications, reporting, billing, support, and account administration; respond to requests; prevent misuse; and comply with law. We use first-party website analytics and, when configured, Google Analytics to understand site use. With affirmative marketing-tracking consent, the Meta Pixel measures eligible public-page visits and confirmed new-business registrations for GateKipas advertising. The Pixel is excluded from dashboards, kiosks, and employee portals. We do not use business-managed visitor, employee, or student records to advertise GateKipas. Business-directed CRM campaigns are a separate disabled-by-default capability requiring applicable permission and sending controls before activation. Meta WhatsApp onboarding, if later enabled, would verify a business's portfolio, WhatsApp account, number, and status; WhatsApp sending is not active.

We use administrative, technical, and organizational measures intended to protect information, including access controls, encryption in transit and at rest where provided by our infrastructure, separation by role and by business, and monitoring. Authorized service processes may access data beyond ordinary user permissions to perform limited operational tasks. No system can be guaranteed completely secure. Please contact us promptly if you believe information has been accessed improperly.

We use vendors to provide the service, including Supabase for database and authentication infrastructure, Vercel for application hosting, Stripe for payments, Resend for email, Twilio for SMS functions, and Google Analytics where configured. Anthropic provides the AI model behind our AI features. When a feature runs, we send Anthropic only what it needs: Smart Alerts and AI Insights send staff and employee names, departments, clock-in and clock-out times and hours, host and location names, and activity counts; visitor features (host and purpose suggestions at the kiosk and when pre-registering, the visit history in host notifications, and the visitor search bar) send visitor names, past visit purposes and dates, host names, and the search text typed; the weekly digest and setup suggestions send the business name, type, country, location names, and counts; our contact form sends the name, email address, and message you submit; and our staff tools send a business's name, type, plan, administrator email address, and usage counts when our team reviews an account or drafts a reply. Visitor email addresses and phone numbers are not sent, and we do not keep a copy of the text we send to Anthropic. With your optional Meta marketing-tracking consent, Meta may receive limited website and conversion events through the Meta Pixel, including browser/network information inherent in that technology. If a business later starts Meta WhatsApp onboarding, its authorized representative interacts with Meta and GateKipas verifies relevant Meta business, WhatsApp-account, and phone-number references and status. Onboarding does not itself activate sending. We may disclose information to a business customer and its authorized users, professional advisers, or authorities where appropriate and lawful. We do not sell customer contact lists. Whether a particular analytics disclosure counts as a 'share' or 'sale' under a privacy law depends on that law; applicable opt-out rights are described below.

We retain information for as long as reasonably needed for the service, the business's selected settings, security, dispute handling, and legal obligations. Retention periods differ by record type. Businesses may have configurable retention controls for some visitor records; those controls do not necessarily govern employee, payment, audit, consent, suppression, or legal-hold records. When a record is deleted from active systems, copies may remain temporarily in backups or logs until their normal deletion cycles, and some records may be preserved where law or a legal hold requires. A business administrator can request export or deletion of business-managed data; individuals should normally contact that business first. Contact privacy@gatekipas.com for help with a request.

An emergency roster may display currently checked-in visitors and on-site employees, including relevant contact and location information, to authorized business users. The business may use or disclose a roster to respond to an emergency, subject to its policies and applicable law. The roster is drawn from operational records; related exports or audit records may be retained according to applicable settings and obligations.

Businesses may operate more than one location. Access to location-specific information is controlled by membership, role, and the relevant feature's scope; authorized headquarters personnel may have broader access where configured. Records can retain the location where an event occurred after a person changes locations. Businesses are responsible for assigning and reviewing their users' access.

We may send service and product communications to business account contacts. Nonessential GateKipas marketing emails include an opt-out route. Separate business-directed messages to that business's own contacts are subject to the applicable channel, purpose, location, permission, and suppression controls when such features are activated; current campaign sending is inactive. We do not use business-managed visitor, employee, or student records to advertise GateKipas, and we do not send customer lists to Meta for this Pixel integration. The Meta Pixel's optional measurement of GateKipas advertising can be declined or withdrawn using the public site's Marketing cookies control.

Depending on your location and the role GateKipas plays, you may have rights to access, correct, delete, export, or object to certain uses of your information. For records controlled by a business using GateKipas, contact that business first; we assist it as appropriate. For GateKipas account, site, or support data, contact privacy@gatekipas.com. We may need to verify your request and may retain information where permitted or required by law. You can change Meta marketing-tracking consent through the public-site footer and unsubscribe from nonessential GateKipas marketing emails.

We use essential cookies and browser storage for authentication, security, and service operation, and a first-party browser identifier for website analytics. Google Analytics may also load when configured and may use cookies or similar technology to measure website usage; it is separate from the Meta marketing-consent control. The optional Meta Pixel is limited to eligible public and onboarding-conversion pages and loads only after an affirmative marketing-tracking choice. We store that choice in local browser storage. You may change it through the Marketing cookies link in the public-site footer; Global Privacy Control or Do Not Track signals suppress the Meta Pixel regardless of a stored choice. Browser settings can restrict cookies, though doing so may affect service functions. We are reviewing whether additional controls are needed for Google Analytics in particular jurisdictions.

GateKipas is not designed for direct use by children under 13 on its public site. Education customers may use business-managed student features involving children, subject to their and our respective obligations under applicable law. Schools should provide required notices and obtain appropriate authorization or consent before entering children's information, and should not use student information for advertising. If you believe a child's information was entered improperly, contact the school and privacy@gatekipas.com.

GateKipas operates from the United States and may use service providers or personnel in other countries. Information may therefore be processed outside the country where it was collected. Where applicable law requires it, we use appropriate measures for international transfers. Contact privacy@gatekipas.com for information about a particular transfer. Using the service does not waive rights provided by local privacy law.

California residents may have rights under the CCPA/CPRA, where applicable, to know, access, correct, delete, and obtain information about use and disclosure of their personal information, and to opt out of sale or sharing for cross-context behavioral advertising. We do not sell customer contact lists. Meta Pixel disclosures for GateKipas advertising may be treated as 'sharing' under California law; the Pixel is suppressed by Global Privacy Control and can be declined or withdrawn through the Marketing cookies control. Submit other requests to privacy@gatekipas.com. We will verify and respond as required by applicable law and will not discriminate for exercising a protected right. If GateKipas processes information solely for a business customer, we may direct you to that customer.

We may revise this policy as our practices and legal requirements change. We will post the revised version and its update date here and provide additional notice or seek consent when required by law or when a material change warrants it. A new policy does not authorize us to use previously collected information for a materially different purpose without any notice or permission required by applicable law.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us. For privacy-specific inquiries: privacy@gatekipas.com. For general support: support@gatekipas.com. Grace Technology is the legal entity operating the GateKipas service.