KRO5 Privacy Policy

KRO5 is software for virtual-assistant agencies: tasks, time tracking, HR and payroll, client billing, a client portal, and lead intake. This policy explains what personal information KRO5 handles, why, and the choices you have. KRO5 is operated by Cedric Oruga in General Trias, Cavite, Philippines. Questions: cedric.oruga@gmail.com.

Our role

When an agency uses KRO5, the agency decides what information about its team and its clients goes in and why. For that information the agency is the personal information controller, and KRO5 processes it on the agency's instructions, as its processor under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). For our own website visitors and account holders, KRO5 is the controller.

What we collect

• Account details: name, email address, role and the agency or client company you belong to.
• Work information an agency enters or creates in KRO5: tasks, notes and files, time entries, daily reports, employee and pay records, payslips, invoices, incidents and leads.
• Messages you send us through the website contact form.
• Anonymous website counts (pages opened, demo opened). We don't use advertising or tracking cookies; visits are counted with a code that changes every day and can't be traced back to you.

Connected Google accounts (Gmail)

An agency user can connect a Gmail inbox so that KRO5 turns specific notification emails (for example, "New Client Account Created" emails from a client's software) into leads. For this KRO5 asks Google for read-only access to Gmail. KRO5:

• searches only for the notification emails the feature is set up to find, and copies the details in them (company and contact name, email, address, plan and fees) into that agency's lead list;
• never sends, deletes or changes email through this connection;
• doesn't use Gmail data for advertising, doesn't sell it, and doesn't use it to train AI or machine-learning models;
• doesn't let people read it, except with your permission, where needed for security or to fix a problem you report, or where the law requires.

KRO5's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove KRO5's access at any time in your Google Account under Security → Third-party apps with account access.

Connected Xero organisations

An agency user can connect a client's Xero organisation so KRO5 can create draft invoices for a lead or a renewal and read back whether they were sent or paid. KRO5 uses Xero data only for this and doesn't sell it. Access can be removed in KRO5 or in Xero at any time.

Who helps us run KRO5

We use these service providers, each only for the service named:

• Supabase: database, sign-in and file storage (stored in Tokyo, Japan).
• Vercel: hosting the application (Tokyo, Japan).
• Resend: delivering account emails such as invitations and password resets.
• Google and Xero: only when an agency connects a Gmail inbox or a Xero organisation, as described above.

We don't sell personal information to anyone.

How we protect it

Data travels encrypted. Each agency's data is kept separate by database access rules. Passwords for connected mailboxes, connection tokens, and government ID numbers are stored encrypted, and staff screens show each role only what it needs.

How long we keep it

We keep an agency's data while its account is active and delete it when the agency asks us to or closes its account, except where the law requires us to keep records longer. Demo workspaces are deleted 24 hours after they are opened. Connection tokens are deleted when a connection is removed.

Your rights

Under the Data Privacy Act you may ask to be informed, to access, correct, object to, block or erase your personal information, to receive a copy of it, and to complain to the National Privacy Commission. If your information is in KRO5 because of an agency you work with or for, please contact that agency first; we'll help them respond. You can also write to us at cedric.oruga@gmail.com.

Changes

If we change this policy, we'll update the date above and tell agency owners about important changes.