Privacy Policy

Version: 1.1.0 Effective Date: April 13, 2026

Kate Keeps It Klean LLC ("K3," "we," "our," or "us") is committed to protecting the privacy and security of our clients' personal information. This Privacy Policy explains what information we collect, the legal basis on which we process it, how we use and protect it, how long we retain it, and the choices available to you regarding your information.

This Policy applies to information collected through the K3 Client Portal ("Portal"), the K3 public website at katekeepsitklean.com ("Website"), and direct communications (phone, email, SMS, in-person). These are distinct data surfaces. The Portal collects a broader range of information, including sensitive operational data such as entry instructions and access codes, which is subject to heightened care as described in this Policy.

This Policy is incorporated by reference into the K3 Client Portal Terms of Use and the K3 Website Terms & Conditions. In the event of any conflict between this Policy and any other K3 document on a matter involving personal information or data handling, this Policy controls.

K3 provides services exclusively in central Iowa. This Policy is written for Iowa residents. If applicable law in your jurisdiction provides rights not addressed here, contact K3 directly using the information in Section 16.

Document Hierarchy

In the event of any conflict between K3 legal documents, the following order of precedence applies:

1. The K3 Client Service Agreement controls on all matters related to service delivery
2. This Privacy Policy controls on all matters related to personal information and data handling
3. The K3 Client Portal Terms of Use controls on matters related to portal system usage
4. The K3 Website Terms & Conditions controls on matters related to public website usage

Each document governs only the context it describes and does not override another document outside its domain.

2. Our Privacy Principles

Data Minimization: We collect only what is necessary to deliver and improve our services. We do not collect data speculatively or for undefined future purposes.

Purpose Limitation: Data collected for one purpose is not repurposed for unrelated uses without your knowledge and, where required, your consent.

Security by Default: Reasonable safeguards are applied to all data by default. Access to sensitive data is restricted to those with a legitimate operational need.

Transparency: We explain what we collect, why we collect it, and how it is used. We do not obscure data practices in vague or ambiguous language.

Retention Limits: We do not retain data beyond the period necessary for its stated purpose, subject to legal obligations.

3. Information We Collect

3A. Information You Provide Directly

When you — whether a "Client" (an individual receiving or requesting K3 services) or a "User" (any visitor to the K3 Website) — engage K3 for services, create a Portal account, or communicate with us, we may collect:

• Full name, phone number, and email address
• Physical address and property details
• Entry instructions, access codes, and lockbox information
• Service preferences, notes, and special instructions
• Communication and correspondence history
• Payment intent or payment method indicators (not payment card data — see Section 4)

3B. Information Collected Automatically

When you access the Website, we may automatically collect limited technical information, including:

• Pages visited, session duration, and navigation paths
• On-site interactions such as link clicks, button activations, and feature engagement (e.g., service views, quote requests, call actions, and external link clicks)
• Device type, browser type and version, and operating system
• Referral source (how you arrived at the Website)

This data is collected through ForVera Analytics, a self-hosted, first-party analytics platform operated by ForVera Media LLC on K3's behalf. ForVera Analytics does not use advertising cookies, cross-site tracking, fingerprinting, or third-party data sharing. Analytics data is not collected from authenticated Portal sessions.

K3 also logs IP addresses submitted through inquiry and quote forms for spam prevention and abuse detection. This data is not connected to ForVera Analytics and is not used for marketing or profiling.

If K3's analytics practices change materially, this Policy will be updated with at least fourteen (14) days' prior notice.

3C. Information We Do Not Collect

K3 does not collect or store:

• Credit card or debit card numbers
• Bank account or routing numbers
• Social Security Numbers or government-issued ID numbers
• Biometric data

Payment transactions are handled through third-party processors. K3 does not receive or retain full payment credentials from those transactions.

4. Legal Basis for Processing

Contractual Necessity: Processing required to fulfill your service agreement with K3, including scheduling, service delivery, and billing.

Legitimate Interest: Processing necessary for K3's legitimate operational interests, such as improving service quality, preventing fraud, and maintaining security, where those interests are not overridden by your rights.

Legal Obligation: Processing required to comply with applicable law, including tax, accounting, and data breach notification requirements under Iowa Code Chapter 715C.

Consent: Where K3 relies on your consent (such as for SMS communications), you may withdraw that consent at any time without affecting services. Consent is never a condition of receiving K3 services.

5. How We Use Information

K3 uses collected information solely for the following purposes:

• Responding to inquiries and providing service estimates
• Scheduling, delivering, and confirming cleaning services
• Communicating service updates, reminders, and account notifications
• Maintaining service records and client history
• Investigating and resolving service issues or disputes
• Improving operations, Portal functionality, and client experience
• Detecting, preventing, and responding to fraud, abuse, or misuse
• Complying with legal, regulatory, and contractual obligations

We do not use your information for unrelated commercial purposes, targeted advertising, or data profiling.

6. Data Sharing

K3 does not sell personal information. We do not share personal information with third parties for their own marketing or commercial purposes.

6A. Service Providers

K3 may share information with third-party vendors who assist in delivering our services or operating our systems, including:

• Payment processors (for transaction facilitation)
• Web hosting and infrastructure providers
• Communication platforms (email, SMS delivery services)
• ForVera Media LLC (operator of the ForVera Analytics platform — see Section 3B)

These providers are permitted to use your information only as necessary to perform services on K3's behalf and are expected to maintain appropriate confidentiality and security standards. K3 is not responsible for the independent privacy practices of third-party providers once data is transmitted to their systems.

6B. Legal Compliance and Safety

K3 may disclose information when required to:

• Comply with applicable law, regulation, or valid legal process (e.g., court order, subpoena)
• Protect the safety, rights, or property of K3, its clients, or the public
• Investigate or prevent fraud, abuse, or violations of these policies

Where legally permissible, K3 will notify affected clients of such disclosures.

6C. No Sale of Data

K3 does not sell personal information and does not engage in data brokering. This applies regardless of the definition of "sale" under any applicable state privacy law, including the Iowa Consumer Data Protection Act (ICDPA, Iowa Code Chapter 715D, effective January 1, 2025).

7. Data Security

K3 employs reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. Safeguards are reviewed and updated periodically at K3's discretion.

Sensitive operational data — including entry instructions and property access codes — is treated with heightened care and access is restricted to personnel with a direct operational need.

No method of transmission over the internet or electronic storage system is completely secure. By using our services, you acknowledge that inherent security risks exist and that K3 cannot guarantee absolute security of any information.

8. Data Retention

K3 retains personal information only as long as necessary for the purposes for which it was collected, subject to applicable legal, tax, and operational requirements.

Upon expiration of the applicable retention period, data is deleted or anonymized in a manner that prevents reconstruction. Requests for early deletion are subject to the limitations described in Section 12.

9. Communications and SMS

K3 may contact clients via phone, email, or SMS (text message) for service-related communications, including scheduling confirmations, reminders, and account notifications.

9A. SMS Consent

By providing your mobile phone number to K3, you consent to receive SMS messages related to your services. This consent is not a condition of receiving K3 services. Standard message and data rates from your carrier may apply.

9B. Opt-Out

You may opt out of SMS communications at any time by:

• Replying STOP to any K3 text message
• Contacting K3 directly using the information in Section 16

Following an opt-out request, K3 will send one confirmatory message and cease non-essential SMS communications. Service-critical messages (e.g., same-day schedule changes) may still be sent where necessary.

9C. No Unsolicited Marketing

K3 does not use SMS for unsolicited marketing or promotional campaigns unrelated to your active services.

10. Cookies and Analytics

K3 uses cookies and analytics tools to support Website functionality and to understand how visitors interact with our Website.

Essential cookies are required for core functionality, including session management, security protections, and form processing. These cookies are set automatically and cannot be disabled without affecting core functionality.

Analytics cookies are used by ForVera Analytics, K3's self-hosted, first-party analytics platform, to collect aggregated usage data about Website interactions — including pages visited, session duration, and on-site actions such as link and button clicks. These cookies do not track Portal users, do not involve third-party advertising networks, and do not enable cross-site tracking or behavioral profiling. A brief notice is displayed on your first visit to the Website so you are aware analytics are in use.

K3 does not use advertising cookies, remarketing pixels, session replay tools, or any cookies that track you across other websites.

If K3 adopts additional cookie types in the future, this Policy will be updated with at least fourteen (14) days' prior notice.

11. Data Breach Notification

In the event of a security breach involving Client personal information, K3 will comply with applicable notification requirements under the Iowa Data Breach Notification Law (Iowa Code Chapter 715C) and any other applicable state or federal law. K3 will notify affected Clients in the manner and within the timeframes required by law.

Clients are encouraged to report suspected unauthorized access or security concerns to K3 immediately using the contact information in Section 16.

12. Your Choices and Requests

K3 supports the following requests from Clients and Users:

• Access — You may request a summary of the personal information K3 holds about you
• Correction — You may request that inaccurate information be corrected
• Deletion — You may request deletion of your information, subject to K3's legal retention obligations and operational requirements
• SMS opt-out — You may withdraw SMS consent at any time as described in Section 9B
• Analytics — Website analytics are first-party and aggregated; individual opt-out is available by contacting K3 directly

To make any of these requests, contact K3 using the information in Section 16. K3 will respond within a reasonable timeframe and may need to verify your identity before processing a request. Some requests may be limited where fulfilling them would conflict with K3's legal obligations or ability to deliver contracted services.

13. Children's Privacy

The K3 Portal and Website are not directed to individuals under the age of 18. K3 does not knowingly collect personal information from minors. If K3 becomes aware that information has been collected from a minor, it will be deleted promptly.

14. Changes to This Policy

K3 may update this Privacy Policy from time to time. When material changes are made, K3 will update the version number and effective date shown at the top of this Policy. For changes that materially affect your rights or how your data is processed, K3 will provide at least fourteen (14) days' notice through the Portal, by email, or through another appropriate channel before the changes take effect.

Your continued use of K3 services following notice of changes constitutes your acceptance of the updated Policy.

15. Iowa Law

This Privacy Policy is governed by the laws of the State of Iowa. Where applicable, K3 complies with:

• Iowa Code Chapter 715C (Data Breach Notification)
• Iowa Code Chapter 715D (Iowa Consumer Data Protection Act, effective January 1, 2025)
• Iowa Code Chapter 554D (Uniform Electronic Transactions Act)

16. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or the handling of your personal information, contact K3 at:

Kate Keeps It Klean LLC 515-901-5655 kate@katekeepsitklean.com