Privacy Policy

This Privacy Policy explains how Soul Software Inc. (“Soul Software,” “we,” “us,” or “our”) processes information through Kruworks websites, applications, APIs, digital asset management, directory, collaboration, and support services.

For account, billing, website, security, and service-operations data, Soul Software generally determines why and how information is processed. For Customer Content placed in a workspace, the Customer generally determines the purposes and means of processing, and Soul Software processes that data on the Customer’s behalf. Privacy requests concerning Customer-controlled workspace data may need to be directed to the Customer organization.

Kruworks processes substantial amounts of company and production data. Depending on how a Customer configures and uses the Services, this may include:

• Account and identity data: names, emails, usernames, credentials, organization membership, roles, profile images, and authentication records.
• Directory and workforce data: contact details, job titles, teams, reporting relationships, location, availability, employment-related fields, and custom directory attributes.
• Company and production data: projects, briefs, issues, tasks, comments, documents, decisions, calendars, time records, reports, approvals, and workflow history.
• DAM and file data: uploaded source files, 3D assets, images, audio, video, archives, previews, versions, metadata, thumbnails, comments, and access history.
• Communications and support: messages, feedback, support requests, attachments, and related correspondence.
• Billing and commercial data: plan, seat count, transaction references, billing contact, and payment status. Full payment-card data may be handled by a payment provider rather than Soul Software.
• Technical and usage data: IP address, device and browser details, identifiers, timestamps, logs, diagnostics, feature interactions, security events, and approximate location derived from IP.
• Integration data: information received from or sent to services a Customer connects to Kruworks.

We receive information from users and Customer administrators; automatically from devices and use of the Services; from integrations and identity providers a Customer enables; from payment, infrastructure, security, and support providers; and from public or commercial sources where permitted by law.

• Provide, host, synchronize, search, preview, and support the Services.
• Authenticate users and administer organizations, seats, permissions, and subscriptions.
• Store and deliver Customer Content at the Customer’s direction.
• Secure accounts, detect abuse, investigate incidents, and maintain reliability.
• Process payments and communicate about billing, support, product changes, and service notices.
• Analyze and improve performance, usability, and product operations.
• Comply with law, respond to lawful requests, resolve disputes, and enforce agreements.

Customers may place extensive personal and employment-related information in Kruworks directories. The Customer controls the fields collected, the purpose of collection, access permissions, retention, and disclosures within its organization.

Customers are responsible for the lawfulness, accuracy, and appropriateness of directory data and for responding to their personnel’s privacy or employment requests. Soul Software does not independently verify directory information and is not responsible for a Customer’s decision to collect, expose, retain, or use it, except to the extent responsibility cannot be excluded under applicable law.

Kruworks may store large and sensitive production files. Customer administrators and users determine what is uploaded and who receives access. We process these files to provide storage, transfer, versioning, previews, search, collaboration, security, and support.

Customers must not upload unlawful, infringing, exploitative, malicious, or otherwise prohibited material. We may restrict or remove content and disclose information where reasonably necessary to comply with law, enforce our Terms, or protect users and the Services.

Information may be disclosed to Customer administrators and authorized workspace users; vendors that provide infrastructure, storage, payments, communications, analytics, security, and support; integration providers selected by the Customer; professional advisers; authorities or other parties when legally required or necessary to protect rights and safety; and a successor in a merger, financing, reorganization, or sale.

Service providers are permitted to process information only for the services they provide to us and subject to contractual or legal obligations appropriate to their role. Customer-enabled integrations operate under their own terms and privacy practices.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls and security monitoring appropriate to the Services. Enterprise security features may include end-to-end encryption and SAML authentication as specified in the applicable plan or agreement.

No security measure eliminates all risk. Information may be lost, corrupted, intercepted, or accessed without authorization due to software defects, malicious activity, compromised credentials or devices, Customer configuration, third-party services, or events outside reasonable control. Customers should configure least-privilege access, protect endpoints and credentials, review integrations, and maintain appropriate independent backups or exports.

Responsibility for security incidents and data loss is allocated under the Terms of Service and any applicable Enterprise agreement. Nothing in this Policy limits duties or rights that cannot be limited by law.

We retain information while needed to provide the Services, follow Customer instructions, secure accounts, maintain necessary business records, comply with law, resolve disputes, and enforce agreements. Retention varies by data type, workspace settings, plan, backup cycle, legal hold, and contractual requirements. Deletion from active systems may not immediately remove information from backups or records we must retain.

Depending on your location, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, restrict or object to processing, limit certain uses, opt out of certain disclosures, and receive equal service when exercising a right. Rights are subject to verification and legal exceptions.

For Customer-controlled workspace or directory data, contact your organization first. For data Soul Software controls, send a request to [email protected]. We may request information needed to verify identity and authority. Authorized agents may be required to provide proof of authorization.

Information may be processed in countries other than where it was collected. Where required, we use contractual or other lawful safeguards for international transfers. Enterprise Customers may request additional data-processing terms where available.

Kruworks is a business service and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13. A Customer that places information about minors in the Services is responsible for obtaining all permissions and complying with applicable law.

We may update this Policy as our Services, practices, or legal obligations change. We will post the revised Policy with a new effective date and provide additional notice where required.

Privacy questions and requests can be sent to [email protected].