Privacy policy
Last updated: 4 November 2026
This policy explains what personal data Kelo CRM ("Kelo", provided by The Code Smith) handles and why.
Two kinds of data
- Your account data: the names, emails and sign-in details of the people at your company who use Kelo. We are responsible for this data.
- Your business data: the customers, properties, tenancies and other records your company puts into Kelo. Your company controls this data; we process it only to provide Kelo to you.
What we use data for
- To run your account: signing in, sending sign-in codes, invitations and password links, and the emails you ask Kelo to send.
- To keep Kelo safe: limiting sign-in attempts, recording important changes in your activity log, and nightly backups.
- To bill you and to answer your questions.
We don't sell data, and we don't use your business data for advertising.
Who helps us
- Our hosting and email provider, which runs our servers and sends Kelo's emails.
- Cloudflare, which protects and speeds up our websites.
- Google Fonts, which provides the typefaces our pages use.
- If you switch on AI features: the AI provider, which receives only the text needed for the request you made.
- When payments go live: our payment provider, which handles card details. Kelo itself never sees card numbers.
Security
- Passwords are stored hashed.
- Sign-in and reset codes and links are stored only in a form that can't be read back.
- Each company's records are kept apart by the database itself.
- Two-step sign-in is available to everyone.
- Every page is served over HTTPS.
How long we keep data
While your account is active. After an account ends, we keep its data for 30 days so it can be downloaded, then delete it. Backups are kept for 14 days.
Your choices
Company owners can download all their data from Administration. To ask about, correct or delete personal data, email [email protected]. If you are a customer of one of our clients (for example, a tenant), please contact that company first — they control their records.
Cookies
Kelo uses only the cookies it needs to work: your sign-in session and short-lived messages between pages. No advertising or tracking cookies.
Changes
If we change this policy in a way that matters, we'll tell account owners by email.