We keep this simple: we collect what we need to answer you, run your services, and bill you — and nothing gets sold to anyone.
The quote form collects what you type into it. The portal holds your account, your sites, and your invoices. We don't build advertising profiles and we don't run ad trackers.
We use Google Analytics and Cloudflare's analytics to see how our sites are used — page views, traffic sources, rough location by city. It helps us make the site better. You can opt out, and we explain how below.
We have never sold, rented, or traded contact details, and we don't plan to start. Your information is used to answer you and to do the work you hired us for.
Khual Web Service LLC — an Oklahoma limited liability company, also going by Khual Web Service, KhualWS, and KWS — is a web design, hosting, and maintenance business based in Tulsa, Oklahoma. It is the business responsible for the information described on this page.
This policy covers every site we operate under the KWS name: khual.net, the client portal at kwsportal.khual.net, and any other subdomain or site we run for our own business. It does not cover websites we build or host for clients — those belong to the client, and section 09 explains that.
You can reach a human about anything on this page at [email protected] or (918) 888-5508.
Browsing our sites. Our sites use Google Analytics and Cloudflare analytics, which record page views, the page you came from, your browser and device type, and your approximate location (city level, from your IP address). Cloudflare, which sits in front of our sites for security, also processes IP addresses to filter bots and attacks. Our host keeps standard server logs.
The quote form on khual.net collects what you type into it — name, email, business name, current website, what you need, and your message — plus your IP address and submission time, for spam prevention.
A portal account holds more, because it is where we run your services:
| What | Why |
|---|---|
| Name, email, phone, company details | Your account, and reaching you |
| Login credentials | Securing your account — passwords are stored hashed, never readable |
| Your sites, domains, DNS, SSL, and uptime records | The services we manage for you, shown in your dashboard |
| Invoices, payments, and order records | Billing you, and keeping the books |
| Support messages and requests | Answering you, and keeping history so you never re-explain |
| Activity logs — who did what, when, from which IP address and browser | Security: spotting break-in attempts and investigating incidents |
Site monitoring records — uptime checks, response times, SSL expiry — track your website's technical health, not you. They contain no personal data.
Password-reset and invitation links are single-use and short-lived (an hour for resets, a week for invites), and we store only a cryptographic hash of them, never the link itself — so even a database leak could not replay one.
Payments. Card and subscription payments are processed by Whop, our payment provider — your card number goes to them, not to us, and their privacy policy covers what they hold. If you pay by Zelle, check, or cash, we record the payment against your invoice in our accounting records, the same as any business does.
Don't send us secrets. Forms and support messages are for describing work. Please don't put passwords, card numbers, or anything similarly sensitive in a message field — if we need credentials to do a job, we will arrange a safe way to hand them over.
Everything above is used to do the job and nothing else:
We do not use your details for advertising, we don't build profiles, and we don't run automated decision-making about you. You will not be added to a marketing list because you asked for a quote.
Our sites set three kinds of cookies:
Opting out of analytics is straightforward: use Google's opt-out browser add-on (available at tools.google.com/dlpage/gaoptout), enable blocking in your browser or a content blocker, or browse with any common privacy extension — the site works fine without analytics loading. Cloudflare's analytics are cookieless and aggregate by design.
There are no advertising cookies and no cross-site trackers on any of our sites.
On khual.net:
In the portal, deletion works in two steps, and we would rather explain it than hide it:
When an account, client record, site, or domain is deleted, it is archived immediately — access is revoked on the spot and it disappears from every dashboard. The archived data is held for 90 days, as a safety net against mistakes and for any legal hold, and then permanently purged.
A few categories are kept longer, on purpose:
Ask us to delete your data sooner and we will expedite what the law allows us to purge; the categories above are the ones we are required or need to keep, and we will tell you plainly which is which.
Every page and form on our sites is served over HTTPS, so what you type is encrypted in transit. Portal passwords are stored hashed and cannot be read back by anyone, including us; reset and invite links are single-use, short-lived, and stored only as hashes. Every sensitive action in the portal is logged to an append-only audit trail, so unusual activity gets noticed. Access to our systems is limited to us and protected by strong, unique credentials with two-factor authentication, with Cloudflare filtering hostile traffic before it reaches anything.
No system is perfectly secure, and we won't pretend otherwise. If a breach ever affected your information, we would tell you promptly and tell you what to do about it.
Whatever your state or country grants you, our answer is the same: email [email protected] and ask. You can ask us to:
We will respond within 30 days and we will not charge you or treat you differently for asking. We may need to confirm you are who you say you are before handing over records — usually by replying from the address on your account.
We do not sell or share personal information for advertising, so there is nothing there to opt out of. Analytics opt-outs are covered in section 04.
Do Not Track and Global Privacy Control. Our sites do not respond to browser Do Not Track or GPC signals, because there is no ad tracking or data selling for those signals to switch off. The one thing they could apply to — analytics — is opted out of the ways described in section 04, and any content blocker that strips analytics works exactly as you would expect.
California residents. We are a small business below the thresholds of the California Consumer Privacy Act, but the rights above — access, copy, correction, deletion — are honored for everyone, Californians included, on the same one-email basis.
If you are a client, two things are worth separating out.
Your website is yours. The site we build for you needs its own privacy policy, covering whatever it collects — its contact forms, its store, any analytics or chat widget you asked us to install. This policy does not cover it. We are happy to help you get one in place, but the content and the obligations are yours as the site's owner. Where we host or maintain a client site, we handle the data on it on your instructions and do nothing else with it.
Your customers' data is yours too. If your site collects orders, enquiries, or accounts, that data belongs to you and your business. We touch it only to run and support your site, and it is handed over with everything else if you leave.
Our sites are business-to-business. They are not directed at children under 13, and we do not knowingly collect anything from them. If you believe a child has sent us information, email us and we will delete it.
We may update these terms as the business changes. The current version always lives at this URL with its date at the top, and the version in force for your project is the one that applied when you accepted your quote — we do not apply changes backwards to work already agreed. For ongoing plans, material changes get at least 30 days' notice by email.
Questions, corrections, or a deletion request — all of it goes to the same place:
Our terms of service cover the working relationship itself — quotes, care plans, ownership, and cancellation.
Ask. One email and we will tell you exactly what is in our inbox with your name on it, and delete it if that is what you want.