Privacy Policy

1. Scope and roles

This Policy applies to kaltiq.com, business.kaltiq.com, auth.kaltiq.com, the Kaltiq consumer and business applications, and supported desktop clients (the “Services”). The staff-only Org control plane is governed by employee, contractor and administrator notices in addition to this Policy.

Kaltiq is normally the controller of account, safety, billing and service-operation data. A verified Business Profile may separately control information it asks you to provide for its own customer relationship. Its notice governs that independent use; Kaltiq remains responsible for processing it performs for its own purposes.

2. Information we collect

Account and identity

• Username, display name, profile image, age or age-range where required, country, language, email address or phone number, credential-verification status and password verifier. We do not store your plaintext password.
• Your internal 12-digit Kaltiq number, number class (standard, vanity, premium or reserved business 9-series), account status, verification badges, contacts you choose to sync, blocked users and settings.
• Business registration, beneficial-owner or representative information, business category, verification evidence and staff assignments when you use a Business Profile.

Chats, channels and files

• Messages, reactions, edits, delivery/read states, reports, channel and group membership, voice notes, images, video, documents and other files you submit.
• Metadata including sender, recipients, conversation or channel, timestamps, file type and size, moderation state and deletion events.
• Private-message payloads between enrolled devices are end-to-end encrypted by default. Groups, channels and unsupported legacy clients remain server-managed. Unless a screen expressly says a conversation is end-to-end encrypted, do not assume Kaltiq is technically unable to access stored content. Device identity keys are encrypted under Kaltiq's administrative key-encryption key and can be recovered only through a restricted, case-bound and audited break-glass process. This is not zero-knowledge encryption.

Voice and video calls

• Call participants, invitation and response events, start/end time, duration, type, connection state, quality diagnostics and network-routing information.
• Audio and video are peer-to-peer where possible and may pass through Kaltiq-operated or contracted TURN relays. Relay traffic is transported, not intentionally retained as call content.
• Call recording is off by default and available only to authorised accounts. When enabled, the interface must show a recording indicator and users must obtain every consent required by local law. Exported recordings leave Kaltiq’s protected storage and are controlled by the exporting user.

Location

• Precise location is collected only after device permission and an action such as sharing a location or using a location-dependent feature. A shared location becomes content visible to selected recipients.
• Approximate country, region or city may be inferred from IP address for security, fraud prevention, routing, localisation and geo-compliance. VPN/proxy risk signals may be used to block, challenge or limit sensitive features.

Device, network and session data

• IP address, user agent, operating system/version, app/browser version, device model, processor class, language, time zone, generated installation identifier, push endpoint, crash/security events, session times and last-seen status.
• Kaltiq does not intentionally collect hardware MAC addresses. Device PINs and biometric templates remain under the operating system’s secure facilities; Kaltiq receives only an authentication result or public-key credential, not your fingerprint or face template.

KalCoins and payments

• KalCoin grants, purchases, debits, refunds, adjustments, balances, serialised ledger entries, internal order identifiers and fraud signals.
• For supported USDT purchases: public wallet addresses, network, transaction hash, amount, block and confirmation data. Blockchain transactions are public and cannot be erased by Kaltiq.
• We do not request private keys or seed phrases. Payment networks, app stores, banks, wallet providers and blockchain infrastructure process information under their own notices.

Support, safety and legal

• Support communications, complaints, appeals, abuse reports, moderation evidence and decisions.
• Law-enforcement requests, legal holds, identifiers named in a request, action history and encrypted legal-review notes.
• Information from other users, business profiles, service providers, public blockchains, fraud/security partners and lawful authorities.

3. Why we process data and our legal bases

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. If that changes, we will update this Policy and provide legally required opt-outs before the change.

4. When information is disclosed

• Recipients and communities: content, profile and presence information according to your selections and group/channel rules.
• Business Profiles: information you send to a business and order/support metadata needed to serve you.
• Processors and vendors: hosting, storage, content delivery, security, email, maps, TURN connectivity, customer support, app distribution and payment/blockchain infrastructure under contractual restrictions.
• Authorities and safety: when required by valid law or reasonably necessary to prevent imminent serious harm, defend rights, investigate fraud or secure the Services. Kaltiq reviews requests for scope and authority where legally permitted.
• Corporate events: as part of a merger, financing, reorganisation or sale, subject to confidentiality and continued legal protection.
• At your direction: exports, backups, integrations or other recipients you choose.

Employees, agents and contractors receive least-privilege access for assigned work. Administrative actions are logged. They may not use user data for personal purposes.

5. Automated systems

Kaltiq may use automated signals to identify spam, coordinated abuse, malware, suspicious registrations, payment fraud, VPN/proxy risk or prohibited content. A signal may queue content for review, slow or block an action, require step-up authentication or temporarily restrict an account. Where applicable law gives you a right to human review or an explanation, use the appeal channel described below.

6. Retention, deletion and legal holds

We keep information only for the period needed for the purposes above, the user’s chosen conversation settings, security, accounting and mandatory law. The detailed schedule and deletion exceptions are in our Data Retention & Deletion Notice. Deletion from active systems may take time to propagate to encrypted backups; data subject to a legal hold, fraud dispute, safety preservation or accounting duty is isolated and retained only for that purpose.

Deleting an account does not erase content already received or independently retained by another user, public blockchain records, or records Kaltiq must retain by law. Where possible, remaining records are minimised, pseudonymised or de-linked from the deleted account.

7. Security

Measures include TLS, password hashing, signed sessions, access controls, least privilege, rate limits, audit logs, encrypted sensitive legal notes, AES-256-GCM wrapping for opted-in escrowed identity keys, backups and incident response. Escrow recovery is limited to designated Super Admin actions and creates an immutable recovery audit record. No service can guarantee absolute security. Protect your credentials, use device locking and report suspected compromise to security@kaltiq.com.

8. International transfers and residency

Data may be processed outside your country. Where required, Kaltiq uses recognised safeguards such as adequacy decisions, approved contractual clauses and transfer-risk measures. A configured data-residency zone may limit primary storage location, but messages to recipients in other regions and global security/support operations can require lawful cross-border processing.

9. Children

Kaltiq is not directed to children under 13 and must not knowingly collect their data without a legally valid child service and parental process. A higher minimum age may apply, including age 16 for self-consent in some EEA states and age 18 under India’s DPDP framework unless a lawful exemption applies. Kaltiq may use proportionate age assurance and restrict accounts when age requirements are not met.

10. Your choices and privacy rights

Depending on applicable law, you may request access, correction, deletion, portability, restriction, objection, withdrawal of consent, information about sharing, limitation of sensitive-data use, review of certain automated decisions, or an appeal. You may also complain to your local regulator. We will verify requests proportionately and may refuse or limit a request where law permits, including to protect other people, security, legal privilege or mandatory records.

Use in-app privacy controls or email admin@kaltiq.com. Authorised agents must show valid authority. We do not discriminate for exercising privacy rights.

11. Regional supplements

Our Regional Privacy & Service Notice explains additional provisions for the EEA/UK/Switzerland, United States, India, Brazil, Canada, Australia/New Zealand, Singapore and other jurisdictions. Mandatory local rights prevail over inconsistent wording in this Policy.

12. Cookies and local storage

See the Cookie & Local Storage Policy. Kaltiq currently uses necessary session, security, preference and application-storage technologies. Non-essential analytics or advertising storage may not be activated where consent is required until you choose it.

13. Changes

We may update this Policy for product, legal or security changes. We will post the version and effective date and give prominent advance notice when a change materially affects your rights, unless an urgent legal or security change requires faster action. Prior versions will be archived.

14. Contact and complaints

Privacy/DPO and interim regional contact: admin@kaltiq.com
Security: security@kaltiq.com
General support: support@kaltiq.com

This POC identifies the controller as Kaltiq at www.kaltiq.com. Its registered legal name, postal address, registration details and any formally required regional representative appointment remain to be added before production acceptance.