KiteHatch Privacy Policy

Effective date: November 1, 2026

This Privacy Policy explains how KiteHatch LLC ("KiteHatch," "we," "us"), an Oklahoma limited liability company, collects, uses, shares, and protects personal information when you visit kitehatch.com or use our services (the "Services"). It is part of our Terms of Service (Customer Agreement). Questions: hello@kitehatch.com.

1. What we collect

Information you give us

• Contact and account details: name, email address, and, if you choose to give it, your business name.
• Intake answers: what you tell us in our order intake form, such as your professional background, roles, goals, topics, tone preferences, and the content you want.
• LinkedIn and career information you provide: your LinkedIn profile URL, profile text or "Save to PDF" export, posts, resume, work history, skills, education, and writing samples. We use only what you give us, or public profile content you point us to and ask us to use. We do not scrape LinkedIn, and we never ask for your LinkedIn password or log into your account.
• Deliverables: the drafts we create for you, and your revision requests.
• Communications: emails and support messages you send us.

Please don't send sensitive information, such as Social Security numbers, financial account numbers, dates of birth, health information, or salary history. We don't need it.

Payment information

• Payments are processed by Stripe.
• Stripe collects your card details. KiteHatch does not receive or store your full card number.
• We receive limited billing information from Stripe: your name, email, billing country/ZIP, the last 4 digits and brand of your card, amounts, and subscription status.

Order and consent records: what you bought and when, and a record of your acceptance of our Terms and any automatic-renewal consent (date, time, the version and text shown, and IP address).

Collected automatically

• Device and usage data: IP address, browser type, pages viewed, and referring site, through server logs.
• Cookies: we use cookies that our site and Stripe checkout need to work.
• No advertising tracking: we do not use advertising cookies, advertising pixels, or cross-site trackers. If we add analytics or any other non-essential cookies, we will update this policy before we do, and we will ask for your consent where the law requires it.

2. How we use it

We use personal information to:

• provide the Services: prepare, deliver, and revise your Deliverables, and manage your Orders and subscriptions;
• process payments, renewals, cancellations, and billing questions;
• communicate with you about your Orders, the Services, renewals, price changes, and policy updates;
• if you have agreed to receive them, send you news or marketing emails, which you can unsubscribe from at any time;
• maintain quality and security, prevent fraud and abuse, and enforce our Terms; and
• meet legal, tax, and accounting obligations and keep records of your consents.

We do not use your Inputs or Deliverables to train AI models.

3. AI providers

To create Deliverables, we send your Intake answers and the materials you provide to third-party AI providers. We use their business/API services under terms that do not allow them to train their models on your data, and we send only what is needed to create your Deliverables. AI providers process the data on our behalf only to generate your drafts. They may keep data for a limited time under their own terms, for example to monitor for abuse.

4. Who we share it with

We do not sell your personal information. We do not share it for cross-context behavioral (targeted) advertising.

We share personal information only:

• With service providers that help us run KiteHatch, under contracts that limit their use of the data. These include:
  • Stripe (payments and the customer billing portal);
  • third-party AI providers;
  • website hosting and data storage providers;
  • email and communications providers; and
  • if we use them, analytics providers;
• With our corporate family: our parent company, Alliant Strategies, LLC, where needed for management, accounting, or legal purposes, under this policy;
• For legal reasons: to comply with law or valid legal process, or to protect rights, safety, or property;
• In a business transfer: such as a merger or sale of the business, subject to this policy; and
• With your consent.

5. How long we keep it

We keep personal information only as long as needed for the purposes described in this policy, then delete or de-identify it. In particular:

• Intake answers and uploaded materials (resumes, profile exports, work history) are kept only as long as needed to deliver and revise your Order or, for subscriptions, while your subscription is active, and are then deleted.
• Deliverables are kept while you are a customer and for a limited period afterward so we can answer questions about your Order, and are then deleted.
• Support emails are kept only as long as needed to handle your request and keep reasonable business records.
• Order, payment, and consent records are kept as long as needed for tax, accounting, legal, and dispute purposes.
• Backups and server logs are overwritten or deleted on a rolling basis.

You can ask us to delete your information sooner (Section 6).

6. Your choices and rights

You may ask us to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information; or
• opt out of marketing emails, using the unsubscribe link in each email.

To make a request, email hello@kitehatch.com from the email address on your account. We may need to verify your identity. We will respond within 45 days, or any shorter period required by applicable law, including the shorter periods described in Section 10 for people in the European Union, the United Kingdom, and Canada. If the law allows and we need more time, we will tell you why within that period.

Some information we may keep after a deletion request where the law requires or allows it, such as order and payment records for tax purposes, or consent records. We will tell you if that applies.

U.S. state privacy laws, including Oklahoma. Several U.S. states, such as California, Virginia, Colorado, Connecticut, Texas, and Oklahoma, have comprehensive consumer privacy laws that give residents specific privacy rights. These laws apply only to businesses that meet certain thresholds, such as the number of residents whose data they process; Oklahoma's law, for example, takes effect on January 1, 2027. Based on our size, KiteHatch may not currently be subject to these laws. We will still honor the access, correction, and deletion requests described above for every customer, wherever you live, and we will not discriminate against you for making one. Because we do not sell personal information or use it for targeted advertising, there is nothing to opt out of on that front. If we decline your request, we will explain why, and you can appeal by emailing hello@kitehatch.com with "Privacy appeal" in the subject line. We will respond to an appeal within 60 days. If a state law applies to us and gives you additional rights, you can exercise them the same way, and you may also contact your state attorney general.

7. Security

We use reasonable safeguards. These include two-factor authentication on our accounts, least-privilege access, encryption in transit, our providers' encryption at rest, and periodic access reviews. No system is completely secure. If a security incident affects your personal information, we will notify you, and any government authority that must be told, as required by applicable law, including Oklahoma's Security Breach Notification Act.

8. Children

The Services are for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

9. Where we process data

KiteHatch is based in the United States, and we and our service providers store and process information in the United States. The Services are offered globally and are available to customers worldwide, including through LinkedIn. If you use the Services from outside the U.S., your information will be transferred to and processed in the U.S. Privacy laws in the U.S. may differ from those where you live, and information held in the U.S. may be accessed by U.S. courts, law enforcement, and national security authorities under U.S. law.

Where the law requires a recognized safeguard for information that we or our service providers transfer across borders, we use one of the following:

• From the European Union or European Economic Area: the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, where the receiving provider is certified under it, or the European Commission's Standard Contractual Clauses;
• From the United Kingdom: the UK Extension to the EU-U.S. Data Privacy Framework, where the receiving provider is certified under it, or the UK International Data Transfer Agreement or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses; and
• From Canada: contracts and other measures that require our service providers to give your information a level of protection comparable to the protection it would receive with us. We remain accountable for information we transfer to service providers for processing.

You can ask us for more information about these safeguards by emailing hello@kitehatch.com.

10. Information for people in the EU, UK, and Canada

This section applies if you are in the European Union or European Economic Area (where the EU General Data Protection Regulation, or "GDPR," applies), the United Kingdom (where the UK GDPR and the Data Protection Act 2018 apply), or Canada (where the Personal Information Protection and Electronic Documents Act, or "PIPEDA," applies). It adds to the rest of this policy. If it conflicts with another section, this section controls for you.

Who is responsible. KiteHatch LLC is responsible for your personal information (the "controller" under the GDPR and UK GDPR). You can reach us about privacy at hello@kitehatch.com.

Our legal bases (EU and UK). We process your personal information on these grounds:

• To perform our contract with you: to take your Order, use your Intake answers and materials to prepare, deliver, and revise your Deliverables, send them to our AI providers for that purpose, process payments and renewals through Stripe, and communicate with you about your Orders and subscription.
• Our legitimate interests: to keep our site and Services secure, keep server logs, prevent fraud and abuse, enforce our Terms, maintain the quality of our Services, keep business records, and, where needed, share information with our parent company for management and accounting. We weigh these interests against your rights, and you can object at any time (see below).
• Your consent: to send you marketing emails and to use any non-essential cookies, if we do either. You can withdraw your consent at any time. Withdrawing does not affect processing that happened before.
• Legal obligations: to keep tax, accounting, and consent records, to respond to lawful requests from authorities, and to meet our other legal duties.

We need the information marked as required in our order and intake forms to provide the Services. If you don't give it to us, we may not be able to fulfill your Order. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Our AI providers help us write drafts; they do not make decisions about you.

Consent in Canada. In Canada, we rely on your consent, which may be implied where the law allows, to collect, use, and disclose your personal information for the purposes in this policy. You can withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. If you do, we will tell you what it means for the Services, for example that we may not be able to complete your Order.

Your rights. Depending on where you live, you have the right to:

• access your personal information and receive a copy;
• correct (rectify) inaccurate or incomplete information;
• erase your information;
• restrict how we use your information;
• data portability: receive information you gave us in a structured, commonly used, machine-readable format, or have it sent to another company where technically feasible;
• object to processing based on our legitimate interests, and to object at any time to direct marketing, in which case we will stop;
• withdraw your consent where we rely on it; and
• complain to a data protection authority (see below).

In Canada, you have the right to access your personal information, to challenge its accuracy and completeness and have it amended, to withdraw your consent, and to complain to the Office of the Privacy Commissioner of Canada.

How to make a request, and how fast we respond. Email hello@kitehatch.com. We may ask for information to confirm your identity. These deadlines apply to you instead of the 45-day period in Section 6:

• EU and UK: we will respond without undue delay and within one month of receiving your request. If your request is complex or you have made several, we may extend this by up to two more months; if so, we will tell you within the first month and explain why.
• Canada: we will respond within 30 days of receiving your request. Where PIPEDA allows, we may extend this by up to 30 more days; if so, we will tell you within the first 30 days and tell you about your right to complain to the Office of the Privacy Commissioner of Canada.

We handle requests free of charge. Under the GDPR and UK GDPR, if a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline it, and we will explain why. If we decline a request, we will tell you why and how you can complain.

Complaints. Please contact us first at hello@kitehatch.com so we can try to fix the problem. If you are in the UK, we will acknowledge your complaint within 30 days and look into it without undue delay. You also have the right to complain to a data protection authority:

• EU/EEA: the data protection supervisory authority in the country where you live or work, or where you believe the problem happened;
• UK: the Information Commissioner's Office (ICO), at ico.org.uk; and
• Canada: the Office of the Privacy Commissioner of Canada, at priv.gc.ca, or your provincial privacy regulator where applicable.

International transfers and retention. Section 9 explains how we protect information transferred to the U.S., and Section 5 explains how long we keep it.

11. Links and other platforms

Our site may link to other sites, such as LinkedIn and Stripe. Their own privacy policies govern how they handle your information. KiteHatch is not affiliated with LinkedIn.

12. Changes

We may update this policy. We will post the new version with a new effective date and, for material changes, email active customers before the changes take effect.

13. Contact

KiteHatch LLC · hello@kitehatch.com