Privacy Policy | Konstantly

KONSTANTLY, LLC, a Virginia limited liability company ("we," "us"), operates Konstantly. This policy covers konstantly.com, app.konstantly.com, Konstantly applications, hosted learning portals, supported legacy portals, customer-configured domains and related support and communications (the "Service"). Other products operated by KONSTANTLY, LLC have separate terms and privacy notices.

This policy explains processing; it is not a request for blanket consent. Our Terms of Servicegovern use of the Service. A customer's own privacy notice also applies to its training, course sales and other activities. External websites and services have their own notices.

1. Our role and your organization's role

We determine the purposes and means of processing business-account, billing, sales, support and website information for our own operations. Where applicable law uses these terms, we act as a controller or business for that information.

For learner records and other personal data we process on a customer's instructions to deliver its workspace, we act as its processor or service provider. The customer determines its training purposes, who participates, what information it uploads, how it uses results and which integrations it connects. A customer acting for another organization may itself be a processor. The applicable data processing agreement ("DPA") and law govern these relationships. Contact support to arrange a DPA before processing for which one is required; signup does not automatically execute a DPA.

Workspace administrators can manage users and permissions and access information such as profiles, course participation, assessment responses, completion records, messages and reports according to their permissions. Direct requests about an organization's training records to that organization. If you contact us, we will route the request or assist it as required; we also remain responsible for requests relating to information we control ourselves.

2. Information we receive

Account and business details: names, email addresses, passwords in protected form, organization and role information, contact and billing addresses, country, time zone, authentication identifiers and account settings.
Transactions: plan, subscription, invoice, tax, payment status and payment-provider identifiers. Stripe handles card details for payments collected through Stripe; we do not receive full card numbers through that flow. Legacy or reseller purchases may involve their payment providers.
Workspace information: courses, documents, images, audio, video, messages, invitations, learner profiles, groups, assignments, progress, assessment responses, scores, certificates, activity and integration data.
AI inputs and results: prompts, conversation context, selected source materials, lesson text, media and generated results when AI features are used. The information sent depends on the requested feature.
Communications: support requests, feedback, sales inquiries and correspondence, including attachments you choose to provide.
Technical and acceptance records: IP addresses, browser and device information, pages and features used, timestamps, errors, security events, cookies, session identifiers and records of notices and affirmative agreement acceptance where collected.

Sources include you, your organization and its administrators, other authorized users, your browser or device, payment and identity providers, and integrations you or your organization connect. Do not include unnecessary sensitive information in uploads, AI prompts or support requests. The Service is not offered for protected health information requiring a HIPAA business associate agreement without our separate written agreement.

3. Why we process information

We use information to establish and administer accounts, authenticate users, deliver and support features, process instructions and payments, maintain records, troubleshoot, prevent fraud and misuse, secure and improve the Service, respond to requests, enforce agreements and meet legal obligations. We may produce aggregate or de-identified service statistics that do not identify a person or customer; we do not use those statistics to re-identify individuals. We also use campaign information to understand which marketing referrals lead to visits and sales inquiries.

We send service and billing communications and may send product updates and other marketing where permitted. You can unsubscribe from marketing emails through their unsubscribe link or by contacting us. Necessary service notices are separate. Private workspace content is not made available for unrelated advertising or third-party direct marketing merely because it is uploaded.

Where a law requires a lawful basis, our own processing relies as applicable on performing a contract with you or taking requested pre-contract steps; our legitimate interests in operating, supporting, securing and improving our business and communicating with business contacts, balanced against your rights; legal obligations; or consent where required. You may withdraw consent prospectively. The customer is responsible for its lawful grounds for workspace processing.

4. Recipients and connected services

Personnel and providers receive information needed for their work. Provider categories include hosting, file storage and delivery, payments, email, support, customer-relationship management, analytics, monitoring and AI processing. The services integrated into Konstantly include AWS, DigitalOcean and Cloudflare for infrastructure or delivery; Stripe for payments; Resend for email; Intercom for support; Attio, HubSpot and our hosted CRM for business contacts; Google Analytics for website analytics; Capterra for advertising referral and campaign measurement; and PostHog for product diagnostics and usage analytics where configured. Internal notification services may receive limited signup and business contact details. Availability and provider use vary across current and legacy services.

Google Gemini processes AI requests and their relevant context. ElevenLabs processes lesson text and, for enabled narration or presenter features, audio, images and other media needed to generate the requested output. Our AI Policyexplains these features and provider-specific data-use considerations. Connecting your own provider account or an external AI agent, including through MCP, sends the selected information to that service under your or your organization's arrangements with it.

Your organization, permitted workspace users and recipients of your sharing or export actions may receive information. Course sellers receive information needed for their sales and training. Independent payment, identity and integration providers may also process information for their own purposes under their notices.

We may disclose information to comply with law and valid legal process, protect rights and safety, investigate misuse, obtain professional advice, or carry out a merger, financing, restructuring or transfer of the business, subject to applicable confidentiality and data-protection requirements. We do not sell private workspace content or learner records for others' advertising. Website analytics and your available privacy controls are described below and in our California privacy notice.

Sharing, embeds, public courses and exports can make content available beyond your workspace. In addition, some uploaded course media and files are delivered through direct file URLs that can be opened without signing in. Restricting a course or workspace does not necessarily restrict access to those file URLs. Do not use those uploads for material requiring authenticated file access. Contact support before uploading material with specific confidentiality needs. Removing access does not recall copies already downloaded by others.

6. Cookies, analytics and preferences

Cookies and similar storage support login, security, preferences and consent choices. The website also uses Google Analytics, Capterra campaign tracking and, where enabled, the Intercom support widget. These tools may collect identifiers, device and usage information. Embedded media and customer-selected integrations can contact their providers when loaded. Browser controls can block storage, but some features may stop working.

When a visit includes campaign parameters, we store campaign and advertising click identifiers, the landing-page URL, referring page and collection time in a first-party cookie, _kl_attr, for up to 90 days. If you submit a sales inquiry, this information may accompany it in our customer-relationship and email systems, where the retention criteria below apply.

The website's cookie preferences and Global Privacy Control determine whether Google Analytics, Capterra and the optional Intercom widget load. You can change your choice through cookie preferences. These controls do not currently prevent or clear the separate campaign-attribution cookie described above. Browser settings can block or remove stored cookies. These choices do not disable necessary authentication or server-side security and operational records. We do not otherwise respond to the older Do Not Track browser signal.

7. Retention and deletion

We retain information for the purposes described here for as long as reasonably needed, considering account activity, the customer's instructions, the type and sensitivity of the records, security needs, contractual requirements and legal retention and limitation periods. Billing, acceptance, dispute and security records may outlast an account. A deletion request does not require us to erase records that law permits or requires us to retain for a legitimate purpose.

For the current self-service platform, canceled workspaces are normally scheduled for deletion after 90 days. Free workspaces and expired trials may be scheduled for deletion after approximately three months without activity and a further 30-day warning period. Voluntary account deletion, a verified erasure request, security or legal requirements, an applicable DPA or an agreed retention schedule may result in a different period. Retention does not guarantee continued paid features or an export window. Export needed records before closing an account.

Deleting a profile does not necessarily delete training records controlled by its organization, shared course materials or independently held copies. Backups, logs and separately stored files may be removed through different processes; deletion is not necessarily immediate across every copy. Contact us about a particular record or retention requirement. We remain subject to applicable deletion duties and the applicable DPA.

8. Locations and security

We are a United States company and use providers operating in the United States, Europe and other locations. A hosting region does not mean every related support, delivery, analytics or AI operation occurs there. Contact support for the current provider and location information applicable to your workspace before imposing a residency requirement. Where legally required, international transfers must be covered by appropriate safeguards, such as an applicable adequacy decision or standard contractual clauses. Contact support to ask which safeguards apply to your data and how to obtain a copy.

We use technical and organizational measures appropriate to the processing and risks. Our security overview describes the Service and its limitations. No system is completely secure. Protect credentials and select access and integration settings carefully.

9. Your choices and rights

Depending on the law that applies, you may request access, correction, deletion or a portable copy of personal data, object to or restrict processing, withdraw consent, opt out of certain processing, or appeal a denied request. Contact [email protected]and describe your request and the relevant account. We may need proportionate verification of identity or an agent's authority. We will respond within applicable legal deadlines and explain any applicable exception or appeal route. You may also complain to your competent data-protection authority. We will not unlawfully discriminate against you for exercising privacy rights.

For customer-controlled learner data, contact the organization administering your workspace. We assist it with requests under the applicable DPA and law. California residents should also read our California privacy notice.

10. Age requirements

Konstantly is offered to registered users aged 18 and over. We do not knowingly solicit accounts from children. Contact us if you believe a child has supplied personal information contrary to these requirements so we can investigate and take appropriate action.

11. Changes and contact

We may update this policy. We will post the updated policy on this page with its date. Where law requires notice of a change or your consent to it, we will provide that notice or obtain that consent. An update does not authorize an incompatible use of information collected earlier, or override an existing agreement or mandatory privacy rights.

Privacy requests to KONSTANTLY, LLC: [email protected]. Formal legal notices: [email protected].