Privacy
policy.

01Who we are

Khual Web Service LLC — an Oklahoma limited liability company, also going by Khual Web Service, KhualWS, and KWS — is a web design, hosting, and maintenance business based in Tulsa, Oklahoma. It is the business responsible for the information described on this page.

This policy covers every site we operate under the KWS name: khual.net, the client portal at kwsportal.khual.net, and any other subdomain or site we run for our own business. It does not cover websites we build or host for clients — those belong to the client, and section 09 explains that.

You can reach a human about anything on this page at privacy@khual.net or (918) 888-5508.

02What we collect

Browsing our sites. Our sites use Google Analytics and Cloudflare analytics, which record page views, the page you came from, your browser and device type, and your approximate location (city level, from your IP address). Cloudflare, which sits in front of our sites for security, also processes IP addresses to filter bots and attacks. Our host keeps standard server logs.

The quote form on khual.net collects what you type into it: name, email, business name, current website, what you need, and your message. Submissions are stored in our systems. We do not store your IP address or browser details with a quote request. Our server uses your IP address only in memory to slow down repeated submissions.

Domain registration details. To register a domain, we send your company's name, address, email, and phone number to our domain registrar, Hostinger, so the public record can be completed and privacy protection can be applied.

Business invoices. An invoice stores the payer's name, email, address and, where the client record has one, a tax ID, at the time it is issued. The tax ID appears on the invoice PDF.

A portal account holds more, because it is where we run your services:

Our uptime checks record whether your website responds, how quickly, and whether its SSL certificate is valid.

Password-reset and invitation links are single-use and short-lived (30 minutes to 1 hour for resets, 72 hours for invites), and we store only a cryptographic hash of them, never the link itself.

Payment-provider data. When you pay through Whop, our payment provider, Whop receives your payment details directly, and we receive a copy of the payment record: your name, email, the payment amount and status, and a card-brand and last-four label (for example, "Visa ···· 4242"). Whop's payload is stored in full in our system so we can match payments to invoices. Your card number is never sent to us. If you pay by Zelle, check, or cash, we record the payment against your invoice in our accounting records, the same as any business does.

03How we use it

Everything above is used to do the job and nothing else:

• Replying to your request, usually within one business day, with a scope and a price.
• Delivering and supporting the services you sign up for — hosting, domains, monitoring, updates.
• Invoicing you, recording payments, and meeting our own tax and accounting obligations.
• Keeping our sites working, secure, and free of spam and abuse.
• Understanding, in aggregate, how our sites are used so we can improve them.

We do not use your details for advertising, and we don't build profiles. We send marketing email only to people who have explicitly opted in, as described in section 08.

04Cookies and analytics

Our sites and portal set the cookies listed below. Essential cookies keep you signed in and protect the site. Analytics cookies come from Google Analytics.

• Essential cookies. A session cookie that keeps you logged into the portal, and one on the quote page that rate-limits submissions. The sites don't work without these.
• Analytics cookies. Google Analytics sets cookies to tell repeat visits from new ones. The data reaches us in aggregate — we see that a hundred people visited, not that you did.
• Security cookies. Cloudflare may set a cookie as part of telling humans from bots. It carries no personal profile.

The portal keeps a copy of your recent invoice and client data in your browser for up to 24 hours so pages load faster.

Opting out of analytics is straightforward: use Google's opt-out browser add-on (available at tools.google.com/dlpage/gaoptout), enable blocking in your browser or a content blocker, or browse with any common privacy extension. The site works fine without analytics loading. Cloudflare's analytics are cookieless and aggregate by design.

05Who else handles it

We do not sell, rent, or trade your information. These service providers process it for us:

• Hostinger: hosts the client portal and its database, and manages domains, DNS, and managed websites through its API.
• Cloudflare: security, DNS, CDN, and bot checks (Turnstile) in front of our sites. Processes IP addresses and DNS records.
• Google: Google Analytics, and the Analytics Data API we use to build scheduled reports for clients.
• Zoho: hosts our business email at khual.net. Messages you send us are stored in that mailbox.
• Resend: sends our transactional email (sign-in and reset links, invites, invoices, reports, notices) and marketing email. Receives the recipient's email address, name, and message content.
• Whop: processes card and subscription payments and payouts. Identity checks for payouts run inside Whop's embedded flow, through its verification provider. We do not receive that identity data.
• Have I Been Pwned (Pwned Passwords): when you set a password, we send only the first five characters of its SHA-1 hash, never the password.
• Anthropic: provides the AI model behind the optional assistant in the client portal. Receives only the question and the portal data needed to answer it, with personal contact details removed first (see section 13).
• Discord (only where we or a client have configured an uptime alert webhook): receives the website name, domain, and status. No personal data.
• Our bank and accounting tools see what any business's bank and books see: who paid, how much, and when.

Our systems are primarily in the United States. Some providers may process data in other countries under their own safeguards. The providers listed above are the full list of our service providers.

Beyond those, we disclose information only when the law requires it — a valid subpoena, court order, or similar — or when necessary to protect our rights, our clients, or someone's safety. If the business is ever sold or merged, client and enquiry records would transfer with it, and you would be told before anything changed.

06How long we keep it

Our current practice. Some of these periods depend on configuration:

• Quote requests that do not become projects: We keep this data only as long as needed for the purpose it was collected, then delete it.
• Analytics data: Google Analytics data is retained for 14 months.
• Server logs are rotated automatically and kept for a limited period.
• Session cookies: end when you close your browser, or after 15 minutes of inactivity for the sign-in cookie. The refresh cookie lasts 14 days for clients and 7 days for staff.
• Deleted records (accounts, clients, sites, domains): archived immediately, with access removed at once. The archived copy is kept for 90 days, then permanently purged. Archive snapshots that record a deletion are kept indefinitely.
• Invoices and payments: kept permanently as financial records and not purged automatically.
• Activity and audit logs (who did what, when, from where): We keep this data only as long as needed for the purpose it was collected, then delete it.
• Payment-provider webhook records and sign-in session history: We keep this data only as long as needed for the purpose it was collected, then delete it.
• Password-reset and invitation links: stored only as hashes and expire after their set lifetime. We keep this data only as long as needed for the purpose it was collected, then delete it.
• Uptime check history: We keep this data only as long as needed for the purpose it was collected, then delete it.

Ask us to delete your data sooner, and we will delete what the law allows and tell you plainly what we must keep.

07How we protect it

Every page and form on our sites is served over HTTPS, and browsers are told to use HTTPS for a year. Portal passwords are hashed with Argon2id and cannot be read back, including by us. Passwords must be at least 12 characters and are checked against common-password lists and a public breach database (the check is skipped if that service is unreachable). Sign-in is rate-limited, and sensitive staff actions (such as DNS changes and impersonation) need a fresh password. Reset and invite links are single-use, short-lived, and stored only as hashes. Session cookies are HttpOnly and marked Secure on HTTPS. Activity logs record sensitive actions. Cloudflare filters hostile traffic before it reaches our servers. Staff access is limited to authorized personnel and protected by password. Two-factor authentication is available for accounts.

No system is perfectly secure, and we won't pretend otherwise. If a breach ever affected your information, we would tell you promptly and tell you what to do about it.

08Your choices

Whatever your state or country grants you, our answer is the same: email privacy@khual.net and ask. You can ask us to:

• Tell you what we hold about you.
• Send you a copy of it.
• Correct anything wrong.
• Delete it, where we are not required to keep it.
• Stop contacting you, at any time and for any reason.

We will respond within 30 days and we will not charge you or treat you differently for asking. We verify your identity by email, sent to the address on your account, before handing over records. Copies of your data are provided as JSON or CSV. There is no self-service export or deletion in the portal yet; requests are handled by email.

Marketing email. We send marketing email only to people who have explicitly opted in. Each marketing email includes an unsubscribe link. Opting out stops marketing email to that address. Transactional email (sign-in, invoices, service notices, account security) is not affected by a marketing opt-out.

We do not sell or share personal information for advertising, so there is nothing there to opt out of. Analytics opt-outs are covered in section 04.

Do Not Track and Global Privacy Control. We do not respond to these signals for analytics. Analytics opt-outs are covered in section 04.

California Online Privacy Protection Act. This policy is written to comply with CalOPPA. Its effective date is shown at the top of this page, changes are posted here as described in section 11, and section 08 explains how we respond to Do Not Track signals. Google Analytics may collect information about your activity over time and across different websites; section 04 explains how to opt out.

California residents. We are a small business below the thresholds of the California Consumer Privacy Act, but the rights above — access, copy, correction, deletion — are honored for everyone, Californians included, on the same one-email basis.

09Sites we build for you

If you are a client, two things are worth separating out.

Your website is yours. The site we build for you needs its own privacy policy, covering whatever it collects — its contact forms, its store, any analytics or chat widget you asked us to install. This policy does not cover it. We are happy to help you get one in place, but the content and the obligations are yours as the site's owner. Where we host or maintain a client site, we handle the data on it on your instructions and do nothing else with it.

Your customers' data is yours too. If your site collects orders, enquiries, or accounts, that data belongs to you and your business. We touch it only to run and support your site, and it is handed over with everything else if you leave.

10Children

Our sites are business-to-business. They are not directed at children under 13, and we do not knowingly collect anything from them. If you believe a child has sent us information, email us and we will delete it.

11Changes to this policy

We may update this policy as the business changes. The current version always lives at this URL with its effective and last-updated dates at the top. If a change materially affects how we use information we already hold, we will email account holders at least 30 days before it takes effect.

12Contact us

Questions, corrections, or a deletion request — all of it goes to the same place:

• Email: privacy@khual.net
• Phone: (918) 888-5508
• Khual Web Service LLC, Tulsa, Oklahoma, USA

Our terms of service cover the working relationship itself — quotes, care plans, ownership, and cancellation.

13AI assistant in the client portal

The client portal includes an optional AI assistant that answers questions about your account and websites, such as visitor numbers, uptime, invoices and support requests.

What we send. When you use the assistant, we send your question and the portal data needed to answer it to our AI provider, Anthropic. This can include website analytics (visitor counts, top pages, traffic sources), uptime and SSL status, invoice and plan details, and the titles and status of your support requests. We remove email addresses, phone numbers, payment details and other personal contact information before anything is sent.

What we don't do. We don't store the text of your conversations with the assistant. We record only usage information, such as the date, the number of words processed and which portal data was looked up, so we can manage costs and keep the service reliable. Your data is used only to answer your question. Under our provider's commercial terms, it is not used to train AI models.

Access is limited to your account. The assistant can only see data your portal account already has permission to view. It cannot see other clients' information.

Accuracy. AI-generated answers can be wrong. For anything important, such as billing amounts or due dates, check the linked portal page, which always shows the authoritative figure.

Your choice. Using the assistant is optional, and the rest of the portal works without it. To have the assistant turned off for your account, contact us at contact@khual.net.