This notice supplements the Privacy Policy and details the rights granted to you by the General Data Protection Regulation (EU) 2016/679 and the California Consumer Privacy Act as amended by the CPRA, as well as the processing framework applied by Klinworks, LLC.
Klinworks is a Delaware (United States) limited liability company, File No. 10704723, with its registered office at 131 Continental Drive, Suite 305, Newark, Delaware 19713.
Contact for exercising your rights: privacidad@klinworks.com
Part I · GDPR (European Economic Area, United Kingdom and Switzerland)
1. Who Is the Controller and Who Is the Processor
Klinworks is the controller of the data of the people who use the Service: account, billing, support and use of the platform.
Klinworks is a processor of the data you enter about your customers, contacts and suppliers. For that data, you are the controller, and we process it solely on your documented instructions, which are those arising from your use of the Service and from these legal documents.
2. Legal Bases
| Purpose | Legal basis |
|---|---|
| Provision of the Service | Performance of a contract (Art. 6(1)(b)) |
| Invoicing and payment collection | Performance of a contract (Art. 6(1)(b)) |
| Security and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Improving the Service with aggregated data | Legitimate interest (Art. 6(1)(f)) |
| Tax and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interest, we have balanced that interest against your rights and freedoms. You may request the outcome of that balancing test from us.
3. Your Rights (Arts. 15 to 22)
- Access (Art. 15): obtain confirmation and a copy of your data.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure (Art. 17): the "right to be forgotten," where applicable.
- Restriction (Art. 18): restrict processing in certain cases.
- Portability (Art. 20): receive your data in a structured, commonly used format, and transmit it to another controller.
- Objection (Art. 21): object to processing based on legitimate interest.
- Automated decision-making (Art. 22): not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
- Withdrawal of consent (Art. 7(3)): at any time, without affecting the lawfulness of prior processing.
How to exercise them: write to privacidad@klinworks.com stating the right you are exercising. We will respond within one month, extendable by two further months if the request is complex, in which case we will inform you within the first month. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.
Complaints: you may lodge a complaint with the supervisory authority in your country of residence. In Spain, this is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).
4. International Transfers (Arts. 44 to 49)
Klinworks processes data in the United States. Transfers from the EEA, the United Kingdom or Switzerland are covered by the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, supplemented by additional technical and organizational measures: encryption in transit and at rest, role-based access control and minimization of the data transferred.
You may request information about these safeguards at privacidad@klinworks.com.
5. Subprocessors (Arts. 28(2) and 28(4))
The current, complete list, with the status of each entry, is at Subprocessors (the same list shown in the Privacy Policy):
| Provider | Purpose | Data location |
|---|---|---|
| Cloudflare | Hosting of this website, delivery network, protection and the waitlist database | Global (distributed network) |
| Supabase | App database, authentication and storage | United States |
| Stripe | Payment processing | United States |
| Resend | Transactional email delivery (sender agentceo.io) | United States |
| OpenRouter | Routing requests to the language models that run the agents | United States |
| OpenAI | Language models | United States |
| Google (Gemini) | Language models | United States |
| Anthropic | Language models | United States |
| xAI | Language models | United States |
| Deepgram | Speech-to-text transcription | United States |
| ElevenLabs | Voice synthesis | United States / European Union [PENDIENTE verify] |
| Meta (WhatsApp Business Platform) | WhatsApp messaging your agents use with your customers | United States / European Union [PENDIENTE verify] |
All of them are subject to data protection obligations equivalent to ours. When we add a new one that processes personal data, we will update that list and the date of the policy.
6. Security Measures (Art. 32)
Encryption in transit and at rest, isolation between organizations enforced in the database, role-based access control, available two-factor authentication, audit logging of sensitive operations, and backups. The details are in the Security Policy.
7. Personal Data Breaches (Arts. 33 and 34)
In the event of a breach that poses a risk to individuals' rights, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and the affected individuals without undue delay where the risk is high.
Where we act as a processor on your behalf, we will inform you without undue delay so that you can meet your own notification obligations.
8. Return and Deletion upon Termination (Art. 28(3)(g))
Upon termination of the relationship, you have 30 days to export your content. After that period, we will delete it, except for what we must retain under a legal obligation. Backups follow their rotation cycle and are overwritten within the period stated in the Privacy Policy.
9. Audits (Art. 28(3)(h))
We will make available to you the information reasonably necessary to demonstrate compliance with our obligations as a processor. If you need a signed data processing agreement, write to us at legal@klinworks.com.
Part II · CCPA / CPRA (California)
10. Categories of Personal Information
In the last twelve months, we have collected the following categories, as classified under California Civil Code §1798.140:
| Category | Do we collect it? | Examples |
|---|---|---|
| Identifiers | Yes | Name, email address, phone number, IP address, account identifier |
| Commercial information | Yes | Subscribed plan, credit and transaction history |
| Internet activity | Yes | Use of the Service, access logs, errors |
| Professional information | Yes | Company, role within the organization |
| Precise geolocation data | No | — |
| Protected classifications | No | — |
| Biometric information | No | — |
| Contents of communications | Yes | Conversations with the agents and content you upload |
| Inferences for profiling | No | — |
| Sensitive personal information | Not deliberately | See Privacy Policy, Section 2 |
Sources: the data is provided by you, generated by your use of the Service, or comes from systems you connect.
Purposes: those described in Section 3 of the Privacy Policy.
11. No Sale or Sharing
We do not sell personal information, nor do we "share" it for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. We have not done so in the last twelve months, including with respect to consumers under 16 years of age.
12. Your Rights in California
The full notice for California is in the Notice to California Residents. Summary:
- Know: what categories we collect, from where, for what purposes and with whom we share them.
- Access: obtain a copy of your personal information.
- Delete: request its deletion, subject to applicable legal exceptions.
- Correct: rectify inaccurate information.
- Opt out: of sale or sharing — not applicable, because we do not engage in them.
- Limit the use of sensitive information: not applicable, because we do not use it for purposes that require this limitation.
- Non-discrimination: we will not give you a worse service or a different price for exercising your rights.
How to exercise them: write to privacidad@klinworks.com. We will verify your identity through the account associated with the request. We will respond within 45 days, extendable by another 45 days with notice to you.
Authorized agent: you may designate someone to act on your behalf, with written proof of their authorization.
13. Other U.S. States
Details in Privacy Rights in Other U.S. States. Summary:
If you reside in Virginia, Colorado, Connecticut, Utah, Texas or another state with consumer privacy legislation, we grant you equivalent rights of access, correction, deletion, portability and opt-out. Use the same contact address.
Contact
Klinworks, LLC 131 Continental Drive, Suite 305 Newark, Delaware 19713, United States Delaware File No. 10704723 · Formed on July 20, 2026 Registered agent: Legalinc Corporate Services Inc.
- Exercising your rights: privacidad@klinworks.com
- Legal matters: legal@klinworks.com