Who and what this notice covers
Kpree Sales is a product of Amflirst LLC, offered under the Kpree Media Technologies brand. It is a broadcaster sales workspace for customer relationships, orders and proposals. This notice covers the seller workspace at sales.kpree.com and its separate platform administration at config.kpree.com, including optional AI Connections, Google Calendar, Microsoft 365 (Outlook email and calendar), QuickBooks Online and Workamajig connections, private file storage, online proposal acceptance, optional background sales agents, and business email, SMS, calling and voicemail features. It also describes optional Gmail features awaiting Google review; Gmail capture and sending are currently off. It does not adopt another application’s privacy policy or general commercial terms.
Information used to run the workspace
Workspace information includes account and team details, broadcaster CRM contacts and activity, program schedules, rate cards, inventory, and order and proposal information entered or connected by authorized users. These records may contain business contact details and confidential commercial information as well as nonpersonal data.
Depending on the features your organization uses, it can also include:
- Email and calendar information from Microsoft 365 or Google accounts that people choose to connect, such as calendar events, Outlook email subjects, dates and addresses, optional full email text, and emails sent from Kpree. Gmail capture and sending are off while Google review is pending. See Microsoft 365, Google Calendar and Gmail.
- Files people upload, email attachments they save to the CRM, and company data exports. See Files and online acceptance.
- Online proposal acceptance records, including the signer’s name, title, email address, company, typed or drawn signature, IP address and browser details, and when the proposal link was opened.
- Sign-in and security records, such as the email address and IP address used in sign-in attempts, and audit history of account and connection changes.
- Identity details from your company’s single sign-on or user provisioning (SCIM) provider, when your company sets one up.
- Imported records from files your users upload, such as a Salesforce data export. Kpree does not connect to Salesforce directly.
For the SMS program, information includes your mobile number, verification status, selected notification categories, consent wording version and acceptance record, delivery status and related security records. We use these to verify your number, document your choices, deliver requested account and workflow messages, troubleshoot delivery and protect access.
Optional AI Connections: recipients and choices
When you connect an AI application such as ChatGPT or Claude, Kpree returns information to that application within the areas you approve, your company’s policy and your current record and field permissions. Tool responses leave Kpree and may be processed by the AI service to answer your request. The selectable areas cover Accounts & campaigns; Follow-ups, inbox & reports; Avails, proposals & orders; Rate cards & pricing; Stations & programming; Revenue, billing & goals; Political; and Company settings. Permitted information can include CRM records, schedules, rates, inventory counts, revenue, billing, forecasts and imported business records. Detailed-record access can also include contacts, notes and messages when your field permissions allow them. Review those choices and the source license before connecting or requesting information.
Email and calendar information. With detailed-record access to Follow-ups, inbox & reports, an AI application can receive saved CRM activities created from accepted Outlook email and Outlook calendar items, and from emails sent from Kpree. Where the user’s notes permission allows, this includes any email text that was shared and the message text of sent emails. If you approve Stations & programming with detailed-record access, the application can also list items captured from your own connected Microsoft 365 mailbox and calendar, including email subjects, event titles and up to the first 1,000 characters of private email text waiting for your review. With change access to Accounts & campaigns, the application can also accept a captured Outlook item as a CRM activity or dismiss it, as you can; it cannot share private email text, and dismissing an email deletes its private text. AI applications never receive information from Google Calendar or, once Gmail capture is available, Gmail items captured for your review, nor CRM activities created from either. They never receive Microsoft or Google access tokens, never contact Microsoft or Google, and cannot send email.
The current AI connection excludes ratings and audience data, credentials, raw attachments, file exports, and email drafts and templates. It does not grant additional rights in TitanTV programming, WideOrbit inventory or other licensed or confidential information. Uploading a file or supplying a provider key is not proof that external AI processing is permitted.
Your separately obtained AI account is governed by that provider’s terms and your account settings, including retention and any model-training choices. Kpree does not configure those choices or promise a common deletion or no-training policy for every connected application. A no-training setting does not prevent processing or retention needed to handle a request. Confirm that the account and intended disclosure meet your organization’s requirements before approving access.
If you allow changes, the application can save permitted records directly in Kpree, including accounts and contacts, CRM activities, rate cards, avails, proposals, spot allocations, invoice drafts, correction and rebill drafts, goals, forecasts, reports and supported settings. Permitted actions can also confirm and book a manual order within Kpree from a sent proposal, subject to order permissions and approvals; do not assume all changes affect only drafts. Review instructions and results before business reliance. Designated final steps, such as buyer sends, responses confirming or rejecting buyer orders, invoice issue, cancellation or sending and publishing, wait for an authorized person to complete them in Kpree. Access records and change history help identify the user and application involved.
Revoke a connection in My account → AI applications, or through your company’s AI access controls, to stop future access through that connection. This does not undo saved changes or erase information already received by the AI provider. Use that provider’s controls for its copies. Kpree retains workspace records and access history according to their purpose and applicable obligations; see Contact us and data requests for access or deletion requests. Review the AI terms before connecting.
Kpree Assistant: private workspace chats
Kpree Assistant is optional and requires a separate company opt-in. Approving an external AI application alone does not enable the built-in assistant.
Kpree Assistant is an optional AI feature inside your seller workspace. When enabled, Kpree sends your questions and the permitted business information needed to answer them to its configured AI provider, OpenAI or Anthropic. This uses Kpree’s API account; you do not connect a personal ChatGPT or Claude account. Your company’s allowed AI reading areas and your current record and field permissions limit which workspace information can be retrieved. The source restrictions described above also apply to Kpree Assistant.
Chats are private to your user and company in Kpree. Other sellers, company administrators and platform administrators cannot browse them through Kpree’s chat or administration interfaces. Kpree stores chat content and provider credentials encrypted, and sends API requests over HTTPS. Platform administrators can configure providers, models and limits and view usage totals. Operational usage records do not include your conversation text. Authorized infrastructure operations and backups remain subject to Kpree’s data-protection controls; private chats are not end-to-end encrypted from Kpree.
You can delete your chats. Inactive chats expire after 90 days without an update; backups may retain deleted content for their normal retention period. Deleting a chat does not reset usage limits or erase information already processed by the provider. Provider processing and retention follow Kpree’s applicable provider agreement and account settings. OpenAI response storage is disabled for this feature; that setting alone is not a promise of zero provider retention.
The initial assistant is read-only. It cannot send messages, modify business records or authorize payments. Automatically retrieved data excludes ratings and audience data, credentials, raw attachments and restricted Google-origin information. These controls do not screen everything you type: do not paste passwords, licensed ratings or other information you are not authorized to disclose. AI answers may be inaccurate; review the original records before relying on them.
Background sales agents and conversation understanding
Sales Briefing, Follow-up, Renewal, Proposal & Planning, Campaign Health, Billing, Reconciliation & Collections, and Outreach are optional background agents, separate from private Kpree Assistant chats and external AI Connections. An authorized company must allow business AI, and each user selects the agents, sources and settings available to them. Enabled agents can run on schedules and eligible workspace changes while that user is offline, subject to current membership, record permissions and limits.
When conversation understanding is enabled, Kpree sends eligible email and SMS text, relevant message identifiers, dates and context to its configured OpenAI or Anthropic API provider to interpret requests, objections, promises and next steps. This is a separate choice from enabling an agent. Access is restricted to authorized CRM records and eligible accepted or sent correspondence; connecting a mailbox does not make all of its messages eligible. Structured source access excludes Google-origin email and calendar data and their derived CRM records, ratings and audience datasets, credential fields and raw attachment files. Eligible email and SMS text is not generally redacted before it is sent to the provider: it can contain personal, confidential, licensed or sensitive information embedded in the correspondence. Instructions to exclude a topic from an AI answer do not remove that text before provider processing. Do not enable conversation understanding for correspondence you lack authority to disclose. Calls and voicemail currently contribute permitted metadata and review status, not their audio or transcripts. Do not paste excluded or unauthorized information into AI inputs.
Agents can share permitted findings and reuse context within the authorized workspace scope. Depending on the agent and permissions, they can create internal tasks, notes, recommendations, draft messages and proposal or avail preparations. Those records are available to people with normal access to the relevant records; they are not private Assistant chats. Enabling an agent does not authorize automatic customer contact, payments, external trading, invoice issue or other final actions that require a person’s review and approval. Review the actual recipient, content, facts and current consent before approving a send or call. AI interpretation can be inaccurate and cannot prove delivery, a payment, an agreed commercial change or legal compliance.
Provider processing follows the applicable API agreement and account settings. Kpree does not use this feature to train a general-purpose AI model; disabling response storage is not a promise of zero provider retention. Encrypted conversation interpretations expire with their source limits and no later than 30 days; source-linked report content is also subject to expiry or removal. Created CRM tasks, notes, drafts, approval records and content-free duplicate-prevention receipts can have different retention periods. Disabling an agent stops future work by that agent, and turning off conversation understanding stops future interpretation under that setting; neither undoes saved business records or erases copies already processed by a provider. Ask support about retained data and use normal record controls to review or remove work.
Google Calendar: what you choose to connect
Connecting Google is optional. In My Account → My connections, choose calendar import, personal reminders, or both, then authorize your account with Google (Google shows this connection as Kpree Sales Calendar). We receive your Google account identifier and email address to identify that connection, plus authorization tokens to maintain it. We do not receive your Google password. Gmail messages and Google Drive files are not accessed by this calendar integration.
Calendar import reads events from your selected calendar within a rolling window from 30 days before to 90 days after today. Kpree keeps event titles, dates and times, event identifiers and update information, and organizer and attendee email addresses for matching and review. Event descriptions, locations and attachments are not imported. By default, only events involving people matched to CRM accounts you can access are kept; you may instead select every event in the import window. Calendar data is read to perform this matching even when an event is not kept.
Personal reminders create or update a calendar event only when you ask Kpree to send a dated task or meeting to your calendar and your company permits it. This sends its title, date and time, and an internal reference to the Kpree activity. It does not send CRM notes, customer contact details, attendees, invitations or email. Reminders-only mode does not import your calendar; it reads back the events it creates to check updates and avoid duplicates.
Google permissions depend on your choices: import uses read access to calendar events; reminders alone use event access on calendars you own; using both requests read and write access to calendar events. Google’s permission wording can be broader than the actions Kpree performs. Kpree uses it for the features described here. Review the Google Calendar integration before connecting.
Gmail capture and sending: optional features awaiting review
Gmail capture and sending are off while Google review is pending. Your existing Calendar connection does not enable them. If made available, each feature will require your own choice in My Account → My connections, the workspace permissions your company gives you and the corresponding Google authorization. Kpree will not request or use Gmail permissions just because you connect Calendar.
Metadata capture (Google’s gmail.metadata permission) would read message and thread identifiers, dates, labels, subjects and participant headers, including From, To, Cc and Reply-To, plus Message-ID and References for threading and replies. It does not read message bodies or attachment content. The import window defaults to 30 days; you may choose 90 days, one year or two years. Gmail’s metadata permission does not support a date-filtered message search, so the first pass may examine headers from up to 5,000 mailbox messages before applying your window and matching rules. Draft, spam, trash and chat items are skipped.
By default, capture keeps items involving external people matched to CRM contacts or account domains you can access and log activities for. You may instead choose all items within your selected window. Excluded email domains, including their subdomains, are checked against participants and Reply-To addresses. Headers are read for matching even when a message is not retained. Captured items wait in your personal review queue; they are not automatically shared with your company.
Full email text is a separate opt-in that would require Google’s read permission (gmail.readonly). Kpree would retrieve text only for an unambiguous CRM match where you have the required activity, notes and contact permissions. HTML is converted to plain text; retained text is bounded to 100,000 characters, with metadata-only fallback when content cannot be safely retained. In review, accepting an item saves its subject and date as a CRM activity. Copying its text into CRM notes requires a separate, explicit share-content choice. The saved activity then follows company CRM permissions, except that it is never provided to AI Connections or opened in Kpree support sessions (see Google data use).
Incoming attachments are not automatically saved into CRM Files. Full-message responses from Google can include attachment data, including inline parts, when Kpree retrieves email text; Kpree keeps only the message text. With full-email permission, the connection owner could separately choose Save for a supported attachment on an accepted, account-linked message. Only that explicit Save adds the file to the account’s Files area through quarantine and malware scanning; the current limit is 20 MiB per attachment. File access and retention then follow the account’s controls.
Compose and reply would require separate sending consent and Google’s send permission (gmail.send). Kpree sends only when you explicitly choose Send email after reviewing the recipients, subject, text and any attachments you select from malware-scanned files already saved to that CRM account. Drafts are private to the mailbox owner. Google receives the composed message and attachments for delivery; a successful provider submission is recorded in the CRM, including the sent text. This is not an automatic marketing or bulk-mail service, and provider submission is not a guarantee that a recipient has received or read a message.
Google data use, sharing and Limited Use
Google data is used to identify your connected account, match calendar items to your CRM, let you review and save activities, and deliver the personal reminders you request. If Gmail features become available and you authorize them, the same service will match and stage email for your review, save the content or files you select, and send the messages you explicitly submit. Captured items await your review in your personal connection. When you accept an item into the CRM, the resulting activity is available to authorized people in your organization according to their access. Information received from Google APIs, including captured Google Calendar items, Gmail items once Gmail capture is available, and CRM activities created from them, is never provided to AI applications connected through Optional AI Connections. Company administrators can manage connection access and view connection status; that does not give them access to your personal review items.
Kpree’s servers process matching, review, synchronization and requested provider actions; processing is not limited to your browser. AWS hosts the service and stores the data needed to operate these features. Google receives authorization requests, the calendar updates you request and, if Gmail sending is enabled and authorized, messages you submit. Google data is not sent to SMS, accounting or email providers merely because those providers are connected. Titles of tasks created from accepted calendar items can appear in notifications you choose to receive by email (through Amazon SES) or, once SMS is active, by text message (through Twilio). Service providers may process data only as needed to deliver and protect these features. Additional disclosure may be necessary to comply with law or investigate abuse.
We do not sell Google data or transfer it to advertising platforms, data brokers or information resellers. We do not use or transfer it for advertising, to determine credit-worthiness or for lending, or to create, train or improve any artificial intelligence or machine learning model. Kpree staff do not read Google data except with your agreement to view specific data, when necessary to investigate security or abuse, or to comply with law. Kpree support sessions do not open personal review items or CRM activities created from Google Calendar or Gmail items.
Kpree’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Calendar and Gmail data are also handled under the Google Workspace API User Data and Developer Policy.
How we protect your data, including Google user data
We use technical and organizational safeguards to protect personal and sensitive data, including Google and Microsoft account identifiers, calendar and email information (and the Gmail information described above if those features become available), authorization tokens and uploaded files:
- Encryption in transit. The production workspace uses HTTPS with TLS to protect information between your browser and Kpree. Connections to Google (including its authorization, Calendar and Gmail APIs), Microsoft, Intuit and Workamajig use HTTPS to a fixed list of their hosts; other business systems use HTTPS to the endpoints your company or Kpree configures.
- Protection of stored credentials and private email. Google OAuth access and refresh tokens are encrypted with AES-256-GCM before database storage, as are Microsoft 365 and other connection credentials, private email text and reply details you capture, and email drafts, the private copies of emails you send, and templates. The encryption key is supplied separately through protected server configuration, not stored with the encrypted token records or sent to your browser. This additional field-level encryption does not mean that all calendar and email fields are individually encrypted. CRM activities created from emails you send or share, including their message text, are ordinary CRM records and are not individually encrypted.
- Encryption at rest. All stored data, including calendar and email information, is also encrypted at rest: the database, its backups and server disks use AWS-managed AES-256 encryption, and files use Amazon S3 server-side encryption. Calendar titles and times, email subjects and dates, and the addresses used for matching have this storage encryption but not the additional field-level encryption described above.
- Private file storage. CRM files, saved email attachments and support attachments are kept in a private Amazon S3 bucket with server-side encryption (support attachments also keep a database copy). Each upload stays quarantined until a malware scan passes, and a file that fails the scan is never served.
- Restricted access. Server-side authorization checks limit access by organization, connection owner and workspace permissions. Personal calendar and email captures, including any private email text, are visible only to the connection owner, subject to workspace permissions, and, for Microsoft 365 only, in part to AI applications that owner connects (see Optional AI Connections); Google Calendar and Gmail captures never reach AI applications. Activities saved in the CRM follow CRM access permissions. Company administrators see connection status and can revoke access, but not captured content. Privileged platform administration uses separate authentication and requires multi-factor authentication.
- Data minimization and user control. Kpree does not keep event descriptions, locations and attachments from calendar imports: Google does not send them, and Kpree discards those Microsoft includes. Email import keeps subjects, dates and addresses; message text is read only if you turn on full email text, and attachment files are saved only when you choose to save one. Gmail metadata capture would omit message bodies and attachment content; text capture and saving attachments require separate choices. We limit retained matching information and remove it as described below. You can disconnect Google or Microsoft 365 to stop future access through that connection and request deletion of retained data through support.
These safeguards reduce the risk of unauthorized access, disclosure or alteration, but no system or transmission can be guaranteed secure. Report privacy or security concerns to support@kpree.com.
Google data storage, retention and disconnecting
Connection credentials are encrypted before storage and access is scoped to the organization and connection owner. Calendar organizer and attendee addresses and email participant addresses used for matching are removed from a captured item when it is accepted. Periodic cleanup removes addresses on archived items, addresses on dismissed items after 30 days, and addresses on items still waiting for review 30 days after the connection is disconnected or revoked. Other captured event or email metadata, source history and accepted CRM activities remain workspace records, with no automatic 30-day deletion promise.
If Gmail text capture or sending becomes available, private staged text and reply metadata would expire after the connection’s selected retention period: 30 days by default, configurable from 1 to 90 days. They are removed sooner when you turn off the related feature, exclude the email’s domain or your company access ends. Dismissing a captured item removes its private staged content; disconnecting or revoking the connection also purges that private staging. This period does not apply to text you shared into CRM notes, saved account files, outgoing draft or sent-message records, or retained subject, date and source history. Those are separate workspace records, not temporary capture staging.
Choose Disconnect in My Account → My connections to stop future access through that connection and remove its stored tokens. Kpree also attempts to revoke the grant at Google and reports the result. If the same grant is used by your connection in another organization, Kpree avoids revoking that other organization’s access. You can remove Kpree’s access directly in your Google Account connections; that may affect Kpree connections in other organizations too.
Disconnecting stops future connection work. It does not delete previously accepted CRM activities or shared email text, saved attachments, outgoing draft or sent-message records, retained capture metadata, or reminders already created in Google Calendar. Nor does it delete messages in your Gmail mailbox. Manage calendar events and email in Google and contact support@kpree.com for access, correction or deletion of retained Kpree data. We verify identity and organizational authority and handle requests subject to applicable retention obligations.
Microsoft 365: Outlook email and calendar
Connecting Microsoft 365 is optional and works only with work or school accounts. In My Account → My connections, tick the features you want, then sign in with Microsoft and approve the permissions it shows. We receive your Microsoft account identifier and email address or sign-in name to identify the connection, plus authorization tokens to maintain it. We do not receive your Microsoft password. Every connection asks to stay connected and read your basic profile (offline_access and User.Read); each feature you tick asks only for the Microsoft permission it needs:
- Calendar import (Calendars.Read) reads events from your calendar from 30 days before to 90 days after today and checks for changes every 15 minutes. Kpree keeps event titles, dates and times, event identifiers and update information, and organizer and attendee addresses for matching and review. Draft and declined meetings are skipped.
- Calendar reminders (Calendars.ReadWrite) create or update an event only when you ask Kpree to send a dated task or meeting to your calendar and your company allows it. They send the title, date and time, never CRM notes, contacts, attendees or invitations. Kpree reads back only the events it created and does not change events that have attendees.
- Email import (Mail.ReadBasic) reads the subject, dates, sender, To, Cc and Reply-To addresses and message identifiers of email in your Inbox and Sent Items, over the history you choose (the last 30 days by default, up to 2 years), then checks for new email every 15 minutes. This permission does not include message text or attachments. Email involving domains you exclude is skipped.
- Full email text (Mail.Read), optional and available only with email import, reads the text of an email only when it matches exactly one CRM account you can access, and keeps it privately for your review. It also lets you see an email’s attachment list and save an attachment to that CRM account when you choose.
- Sending (Mail.Send), optional, lets you send customer email through your mailbox from Kpree. While it is on, Kpree also keeps the reply details of captured email (sender, recipients and message references) so you can reply.
Microsoft’s wording for these permissions, such as reading all your mail or calendars, can be broader than the actions Kpree performs. Kpree uses them only for the features described here. By default, only email and events involving people from CRM accounts you can access are kept; you may instead choose every item in the import window. Items are read to perform this matching even when they are not kept. If your organization granted Kpree for everyone, or you approved more earlier, Microsoft may issue Kpree’s access with every approved permission. Kpree uses only the features you tick, and removing the approval is done at Microsoft (see Disconnecting Microsoft 365).
A Kpree company administrator can choose Grant for organization so that a Microsoft 365 administrator approves Kpree’s permissions, including email permissions, for everyone in the organization at once, so Microsoft no longer asks each person to approve them. That approval does not connect any mailbox or read any mail. Each person still connects their own account and ticks their own features, and full email text and sending are separate choices each person makes. Kpree has no company setting that turns on email import for a member; company administrators decide whether calendar reminders are allowed and can revoke a member’s connection.
Microsoft 365 data: access, sending and retention
- Where it is stored. Microsoft data is stored in Kpree’s database hosted by AWS. Tokens, private email text, reply details, drafts, the private copies of emails you send and templates are encrypted with AES-256-GCM before storage. Email subjects, dates, calendar titles and the addresses used for matching are protected by the database’s storage encryption but are not separately encrypted. CRM activities created from emails you send or share, including their message text, are ordinary CRM records and are not individually encrypted. Saved attachments become CRM files in private file storage after a malware scan.
- Who can see it. Items waiting for review, including any private email text, are visible only to you. Company administrators see each member’s name, whether the connection is working and when it was authorized, and how many members are connected, but never the content. When you accept an email, it becomes a CRM activity with the subject and your outcome and next step, visible to people with access to that account. Only if you choose to share it is its text added to the activity, and its sender and recipients shown to colleagues with access to that account while Kpree keeps the private copy. Saved attachments are visible to people who can read notes on that account. AI applications can receive some of this information only as described in Optional AI Connections. Kpree support sessions can show saved CRM activities but not your review items, drafts or templates; see Access, providers and mobile information.
- Sending. Kpree sends an email only when you click Send. It goes through Microsoft from your mailbox and is saved in your Sent Items. Kpree keeps an encrypted copy and records a CRM activity with the subject and message, visible to people with access to that account. Attachments can only be malware-scanned files already saved to that CRM account. There are no automatic or bulk sends, and AI applications cannot send email.
- How long it is kept. You choose how long private email text and reply details are kept, from 1 to 90 days (30 by default). They are deleted sooner when you turn off the related feature, exclude the email’s domain or disconnect, or when your company access ends or is suspended; private email text is also deleted when you dismiss its item. Addresses on review items are removed when the item is accepted or archived, 30 days after it is dismissed, 30 days after a disconnect for items still waiting for review, and right away if you leave the company. Items you never accepted, including their subjects, titles and dates, stay in Kpree after you disconnect or leave the company, and deleting an email or event in Outlook does not remove it from Kpree; email support@kpree.com to have them deleted. Copies of emails you sent and accepted CRM activities, including any email text you shared, are company records and have no automatic deletion; they are deleted with your company’s workspace (see General retention). Saved attachments follow your company’s file retention.
- No sale, advertising or marketing. We do not sell, rent, license or redistribute Microsoft data. We do not use or transfer it, or anything aggregated, anonymized or derived from it, for advertising or marketing, and Kpree does not use it to create, train or improve artificial intelligence or machine learning models. AI applications you connect receive it only as described in Optional AI Connections, under their own terms.
Disconnecting Microsoft 365
Choose Disconnect in My Account → My connections to stop future access. Kpree immediately deletes its stored Microsoft tokens and all private email text and reply details for that mailbox, stops syncing and cancels emails not yet sent. Turning off a feature also removes the stored tokens, so you reconnect to keep the remaining features. A company administrator can revoke a member’s connection with the same effect, and access ends automatically when a member leaves the company.
Kpree cannot withdraw your approval at Microsoft itself. You can revoke the permissions you approved at any time in Microsoft My Apps (myapps.microsoft.com): open the Kpree app’s menu, choose Manage your application, then Revoke permissions. If your organization approved Kpree for everyone, which you cannot revoke yourself in My Apps, a Microsoft 365 administrator removes that approval in Microsoft Entra (Enterprise applications).
Disconnecting does not delete accepted CRM activities, captured email subjects and dates or calendar titles, copies of emails you sent, saved attachments, or reminders already in your calendar. Contact support@kpree.com for access, correction or deletion of retained Kpree data. We verify identity and organizational authority and handle requests subject to applicable retention obligations.
QuickBooks Online data and use
Effective .
When an authorized workspace administrator connects a QuickBooks Online company through Intuit, Kpree stores its company identifier and authorization tokens to maintain the connection. The current connector reads invoices and credit memos and imports record identifiers, document numbers, transaction and due dates, amounts, outstanding balances, remaining credits, currencies, customer references and names, source update times and void or deletion status. The customer selector reads customer identifiers and display names to help match QuickBooks customers to workspace accounts.
We use this information to match business records, display invoice payment status, summarize receivables and unapplied credits, and support credit review and overdue account follow-up. Connection status, sync history and related audit records support operation and troubleshooting. Access follows workspace permissions. The current QuickBooks connector is read-only: it does not create or change QuickBooks records or initiate payments. QuickBooks remains the source of record. Imported information may be incomplete or out of date; review sync status and exceptions before business decisions.
QuickBooks disconnection and retention
Effective .
An authorized administrator can disconnect QuickBooks in Kpree’s connection settings. Disconnecting removes that connection’s stored credentials and stops its sync work. Kpree requests Intuit token revocation when available and reports whether it was confirmed. If revocation is not confirmed or the authorization remains in place, remove Kpree from your QuickBooks connected apps to revoke access there.
Disconnecting does not delete records in QuickBooks or automatically erase business records already imported into Kpree. Imported records and related audit history may remain for workspace history, security and applicable obligations, subject to deletion requests. Email support@kpree.com to request access, correction or deletion; identity and workspace authorization checks may be required. Retention depends on the information, its purpose and applicable obligations; no fixed deletion period is promised.
Files and online acceptance
CRM files, email attachments saved to the CRM, support attachments and company data exports are stored in a private Amazon S3 bucket in the United States with server-side encryption, versioning and daily backups. Each upload stays quarantined until a malware scan on Kpree’s servers passes, and a file that fails the scan is never served. CRM files are kept until a person with edit access deletes them or your company’s file retention period ends (365 to 3,650 days, if your company sets one). Deleted files remain as prior versions in private storage for up to 90 days and in backups for up to 35 days. Support attachments are kept until your company account is deleted. Company data exports leave out private mailbox content and personal email templates.
When a buyer or advertiser accepts a proposal online, Kpree records the signer’s name, title, email address, company, any purchase order number and typed or drawn signature, the agreement wording shown, the time, IP address and browser details, and the result of any email code check, and keeps copies of the proposal and the acceptance certificate. This evidence is kept with the proposal and cannot be changed or deleted from the workspace. Kpree also records when the link is opened and notifies the sender, and records a decline or change request with any reason the buyer gives. Acceptance links, codes and reminders are emailed through Amazon SES.
Company email, business SMS, calls and voicemail
Company-to-customer communications are separate from Kpree’s optional personal account notification SMS program. Your organization controls its business senders, recipients, purposes and notices. Depending on what it enables, Kpree processes sender and recipient contact details, email and SMS content, conversation history, attachments you choose to save, delivery and call events, voicemail, consent or opt-out evidence, and billing and troubleshooting records. Authorized colleagues may see shared CRM correspondence and call records according to their permissions; personal connection review items have the separate restrictions described above.
Business SMS registration may require the organization’s legal name, EIN or other business identifier, business type and address, contact name, email and telephone, website and policy links, sample messages and evidence describing how recipients opt in. Kpree and the configured messaging provider process these details for sender registration, verification and carrier review. Saving registration details or publishing these pages does not establish provider approval or activate a sender.
Twilio and telecommunications providers process the message or call content, numbers, media and service events needed for calling, SMS and voicemail. Recordings require company enablement and applicable participant consent; live-call recording requires an explicit user confirmation. Voicemail has its own enablement and greeting controls. Recording and voicemail retention is selected within the supported 1–30 day period. Expiry blocks normal playback and initiates provider-deletion work; outages, retries, legal obligations and provider retention can affect when every copy is removed. Call metadata, consent, billing and audit records may remain after audio expires.
Your organization must provide required notices, obtain and document appropriate consent, and honor opt-outs and contact restrictions. A CRM contact, inbound inquiry, phone verification, approved agent draft or acceptance of Seller Terms is not blanket permission for marketing, repeated contact or recording. For company messaging questions or opt-outs, contact the sender identified in the message; contact support@kpree.com if you need help identifying the organization or making a Kpree data request. Kpree’s notification SMS consent does not authorize a company to text its customers.
General retention
We retain information as needed to operate the service, maintain security, document consent and handle applicable obligations. The period depends on the information and purpose; this notice does not promise a fixed deletion schedule. Google and Microsoft 365 connection data and stored files have the specific retention and disconnection rules described above. Deleted information can remain in backups until they expire: database backups within 38 days, file backups within 35 days, and earlier versions of files deleted in the workspace within 90 days.
Scheduling company deletion suspends its workspace and starts a 30-day grace period, during which the scheduled deletion can be canceled. After that period, an authorized Kpree operator can permanently purge the workspace; this is a separate action, not an automatic deletion at day 30. Until the purge is completed, the suspended workspace can remain stored. The purge removes company workspace data and stored file versions under the deletion controls, while limited legal evidence, acceptance, billing and security records may be retained where required. It does not erase copies held by recipients or independent providers. Remaining backup copies expire under the retention rules above. Contact support to request or confirm the status of a deletion.
Your choices and questions
SMS is optional and is not a condition of purchase or use of the workspace. Verification requests one text and does not enroll you in ongoing notifications. Ongoing message frequency varies with your selected notification categories and account activity. Message and data rates may apply.
Kpree platform notification SMS is not active — activation and provider review pending.
Once messaging is active, reply STOP to stop texts through the provider or HELP for the provider’s help response. You can also disable Kpree SMS in your personal notification preferences and save your choice. Messages already in transit may still arrive. Provider STOP blocking is separate, may not appear in settings, and can block the shared sender, including verification texts. Re-enabling a preference does not override that block. See the SMS Terms.
For privacy questions or requests about access, correction or deletion, see Contact us and data requests. Review this notice for future changes before opting in.
Organization responsibilities and privacy requests
Your organization generally decides why customer and employee information is placed in its workspace and who may use it. Kpree processes those business records to provide the requested service and also handles account, billing, security and legal records for its own operational obligations. For a record controlled by your organization, start with its administrator; you may also contact Kpree for help routing a request. We verify identity and authority without asking you to send passwords or unnecessary sensitive documents.
Depending on applicable law, you may have rights to access, obtain a copy of, correct or delete personal information, or to object to or restrict certain processing. Send requests to support@kpree.com. We will explain applicable exceptions, required retention or any further review available for the request. We do not require you to accept marketing to make a request, and we do not retaliate for exercising applicable privacy rights. This notice does not claim that every jurisdiction’s privacy law applies to every record.
Browser storage, processing location and intended users
Kpree uses session cookies and browser storage for sign-in, security, preferences and workspace functionality. Browser settings can clear or restrict this storage, but doing so may sign you out or remove saved preferences. This notice does not describe advertising trackers or a consent-management service that Kpree has not implemented. Provider features and security checks may involve the provider’s own browser requests as described above.
Kpree and its service providers may process information in the United States and other places where their services operate, which may have different privacy laws. Organizations needing specific data-residency, international-transfer or regulated-data arrangements should agree the necessary terms with Kpree before enabling those uses. This notice does not promise a particular residency, certification or signed data-processing agreement.
Kpree Sales is intended for authorized business users and is not directed to children under 13. We do not knowingly solicit personal information from children under 13 through this service. Contact support@kpree.com if you believe such information was provided so we can investigate and take appropriate action.
We update this notice when practices change and identify the updated date. Material new permissions or consent-dependent uses require their applicable notices and choices; updating a public page alone does not grant a new permission or override existing consent.
Contact us and data requests
Amflirst LLC is responsible for this notice. Email support@kpree.com with privacy questions or to request access to, correction of or deletion of your information, including data from a connected Google or Microsoft 365 account. Include your name, your company and the email address you use to sign in to Kpree. We verify your identity and, for company records, your company’s authority before acting, and we handle requests subject to applicable retention obligations. To stop future access right away, disconnect the account in My Account → My connections.