This policy explains how KolchiInOne (“KIO”, “we”, “us”) handles personal data in KIO CRM (crm.kolchiinone.com), the website chat widget, the form webhooks and the AI agents that run inside it (together, the “Service”).
1. Who is responsible
KIO CRM is used by businesses (“Clients”) to manage their own prospects and customers. For the contacts a Client brings into the CRM — people who fill a form, write on WhatsApp, Messenger, Instagram, email or the website chat (“Contacts”) — the Client is the data controller and KIO acts as its processor, under our Data Processing Agreement. For the accounts of people who sign in to the CRM (“Users”) and for our own business relationship with Clients, KIO is the controller.
KIO is based in Casablanca, Morocco. Contact: contact@kolchiinone.com.
2. What we collect
- User accounts: name, email, role, a salted hash of the password (bcrypt — never the password itself), colour, last sign-in time.
- Contact data brought in by Clients: name, phone, email, city, country, the source (form, ad, campaign), tags, status, notes, documents, amounts and payment status recorded by the Client, and the answers given in forms.
- Conversations: the messages exchanged with a Client on WhatsApp, Messenger, Instagram, email or the website chat, with timestamps, delivery status and the platform identifier of the sender.
- Connected accounts: when a Client connects Facebook, Instagram, WhatsApp, Gmail, n8n or an AI provider, we store the identifiers and access tokens needed to do that job. Tokens and keys are encrypted at rest (AES-256-GCM) and are never shown again in the interface.
- Social media data the Client asks us to read: their own page posts, their followers count, post statistics and, if they connect an ad account, daily ad spend per campaign.
- Website chat visitors: the messages typed in the chat bubble and a random session identifier stored in the visitor’s browser so the conversation continues across pages.
- Technical data: IP address and browser information in server logs, used for security (rate limiting, abuse prevention) and troubleshooting.
3. Why we use it
- To provide the Service to Clients: store and display leads, conversations, pipelines, payments and reports; send the messages Users write; run the automations and AI agents the Client switches on.
- To secure the Service: authentication, permissions, rate limits, audit of changes, backups.
- To support Clients and improve reliability.
Legal bases: performance of our contract with the Client; the Client’s instructions (for Contact data); our legitimate interest in keeping the Service secure; and consent where the law requires it (the Client is responsible for collecting consent from its Contacts, for example on its forms).
4. AI agents
When a Client switches on an AI agent, the recent messages of a conversation, the Client’s instructions and the knowledge the Client gave the agent are sent to the AI model provider the Client selected (for example Google Gemini, Anthropic Claude or OpenAI) to generate a reply. The agent may fill in the lead (name, phone, email) and mark it as interested. Every AI message is labelled as such in the CRM, and a person can take over any conversation at any time. We do not use Contact data to train AI models and we choose provider options that do not allow training on API data where they exist.
5. Who else receives data (sub-processors)
- Hostinger — servers located in Paris, France (European Union).
- Meta Platforms (Facebook, Instagram, WhatsApp) — only when a Client connects those accounts; messages are sent and read through Meta’s APIs.
- Google — Gmail (when a Client connects a mailbox) and Gemini (AI).
- AI model providers chosen by the Client: Google, Anthropic, OpenAI, Mistral, xAI, DeepSeek, or an endpoint the Client configures.
- n8n — automation engine hosted on our own server; only when the Client connects it.
- Content delivery — the CRM interface loads open-source libraries and fonts from public CDNs (unpkg, Google Fonts); no personal data is sent to them beyond the standard web request.
We do not sell personal data and we do not use it for advertising.
6. International transfers
Data is hosted in the European Union. Some providers above (AI models, Meta, Google) may process data in other countries under their own safeguards (such as standard contractual clauses). Moroccan Law 09-08 and, where applicable, the EU GDPR apply to these transfers.
7. How long we keep it
Client data stays in the CRM as long as the Client’s account is active. Deleted leads go to the Trash and can be deleted permanently by the Client at any time. When a Client leaves, its data is deleted within 30 days, except what we must keep by law. Encrypted backups are kept for 14 days and then overwritten.
8. Security
- HTTPS everywhere; HTTP-only, Secure session cookie; passwords hashed with bcrypt.
- Tokens and API keys encrypted at rest; webhooks protected by per-source secrets compared in constant time.
- Role-based permissions per business, checked on the server for every change; rate limits on sign-in, webhooks and the API.
- Nightly backups; the server blocks requests to private network addresses.
No system is perfectly secure. If a breach affects personal data, we inform the affected Clients without undue delay so they can meet their own obligations.
9. Your rights
You can ask to access, correct, delete or receive a copy of your personal data, or object to its processing (Law 09-08 in Morocco — supervised by the CNDP — and the GDPR where it applies). If you were contacted by a business using KIO CRM, contact that business first: it controls your data. You can also write to contact@kolchiinone.com; see Data deletion. We answer within 30 days.
10. Children
The Service is for businesses and is not directed to children under 16. Clients must not use it to target children without the consent required by law.
11. Changes
We may update this policy. The effective date at the top shows the current version; important changes are announced to Clients inside the CRM or by email.