Summary
We keep this short because the way KRISPTS works keeps the data picture simple.
- This website has no accounts, no advertising, no analytics and no tracking cookies.
- The KRISPTS application is run by the organisation that deploys it, on its own servers and database. We do not receive its data unless that organisation sends us some, for example to get support.
- If an organisation turns on a hosted AI model to read documents, document content goes to that provider. A local model or rules-only reading sends nothing out.
- Questions or requests go to support@builtbykris.com.
Who is responsible
For this website and for messages sent to us, Built by Kris decides why and how personal data is used, and is responsible for it.
For the KRISPTS application, the organisation that installs and runs it (the "operator") decides what is stored and why, and is responsible for that data. Built by Kris supplies the software. Where an operator asks us for support and we can see their data, we handle it only to help them and only as they instruct.
This website
| What | Why | Details |
|---|---|---|
| Your theme choice (light or dark) | To remember your preference | Saved in your browser's local storage only. It never reaches us and you can clear it at any time. |
| Fonts from Google Fonts | To display the page as designed | Your browser requests font files from Google, which receives your IP address and browser details under its own policy. |
| Messages you send to support@builtbykris.com | To reply and keep a record of the conversation | We store your address, your message and our reply. We do not add you to a mailing list unless you ask. |
| Hosting logs | To keep the site running and secure | The host that serves this page may record technical data such as IP address, time and the page requested. |
We do not sell personal data, and we do not use this website to profile visitors.
The KRISPTS application
The operator chooses what goes into the system. In normal use it holds:
- User accounts: username, display name, role, and sign-in data. Passwords are stored as one-way hashes. Two-step sign-in seeds and other stored secrets are encrypted.
- Business records: enquiries, quotes, policies, endorsements and renewals, which can include customer names, contact details, trade licence numbers, addresses, insured values and claims history.
- Documents: files uploaded with an enquiry, kept on the server's disk or in the operator's S3 bucket.
- Activity records: an audit log of who did what and when, and a change log that updates screens live.
- Messages: a log of e-mails sent from and received by the system, where the operator has switched e-mail on.
- Integration records: API key details, OAuth clients and tokens, and a delivery log for webhooks.
Backups contain all of the above, including password hashes. Operators should treat backup files as sensitive.
Document reading and AI
KRISPTS can read uploaded documents to fill in an enquiry. The operator picks how:
| Option | Where the content goes |
|---|---|
| Hosted model (Gemini) | The text or page images of the document are sent to the provider (Google) to be read. Its own terms and privacy policy apply to that processing. |
| Local model (Ollama) | Processed on a machine the operator controls. Nothing is sent to a third party by KRISPTS. |
| Rules only | Pattern matching inside the application. No model is used. |
| OCR for scans | Tesseract runs on the operator's own server. |
Operators who handle personal or confidential documents should choose the option that matches their own legal duties and tell the people concerned.
Assistants connected through MCP can only reach what the connecting user or API key is permitted to reach, and what an assistant does with the information it receives is governed by that assistant's own provider.
Retention and deletion
Messages to support are kept for as long as needed to handle the matter and for a reasonable period afterwards, then deleted. Website visitors' theme preference stays in the browser until cleared.
In the application the operator sets how long records are kept. The audit log is deliberately tamper-evident, so entries are not edited or removed one by one. Operators who must erase personal data should plan for that when deciding what to put in free-text fields.
Security
- Sign-in is protected with lockout, rate limits, optional or required two-step verification and optional single sign-on.
- Sessions use HttpOnly cookies with SameSite protection, plus a token checked on every change.
- Access is limited by role, line of business and approval authority, and enforced on the server.
- API keys are scoped, can expire, and are shown once.
- Stored secrets are encrypted, and the audit log is chained so changes to history are detectable.
No system is perfectly secure. Operators are responsible for the server, network, database and backups they run KRISPTS on. If you believe you have found a security problem, write to support@builtbykris.com.
Your rights
Depending on where you live, you may have the right to ask what personal data is held about you, to have it corrected or deleted, to restrict or object to its use, to receive a copy, and to complain to your data protection authority.
For data we hold, such as messages to support, write to us and we will respond within a reasonable time and in line with the law that applies to you. For data held in a KRISPTS system run by an organisation, contact that organisation first.
This website and KRISPTS are not aimed at children, and we do not knowingly collect data from them.
Changes
If we change this policy, we will update the date at the top. If a change affects how we use data in a way you would not expect, we will say so on this page.
Contact
Questions, requests and security reports: