PRIVACY POLICY

Last updated: September 7, 2026

1. Introduction

KX21, Inc. ("KX21," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our platform services (including AI voice agents).

This policy describes our practices and the rights that may be available under applicable privacy laws, including the California Consumer Privacy Act (CCPA), the Texas Data Privacy and Security Act (TDPSA), and the General Data Protection Regulation (GDPR), where those laws apply.

2. Information We Collect

2.1 Personal Information

We may collect the following categories of personal information:

Identifiers: Name, email address, phone number, postal address, IP address
Commercial Information: Records of services purchased or considered
Financial Information: Bank account numbers, routing numbers (for vendors/partners only, stored encrypted)
Professional Information: Company name, job title, business address
Internet Activity: Browsing history on our site, interactions with our services
Geolocation Data: General location based on IP address

2.2 Automatically Collected Information

Device type and browser information
Operating system
Pages visited and time spent on pages
Referring website addresses
Cookies and similar tracking technologies

3. How We Use Your Information

We use collected information for the following purposes:

To provide and maintain our platform services (including AI voice agents)
To process transactions and send related information
To send promotional communications (with your consent)
To respond to your inquiries and provide customer support
To improve our website and services
To detect, prevent, and address technical issues or fraud
To comply with legal obligations

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

Service Providers: Third-party vendors who assist in operating our services
Business Transfers: In connection with a merger, acquisition, or sale of assets
Legal Requirements: When required by law or to protect our rights
With Your Consent: When you have given us explicit permission

Our website advertising measurement practices and the current status of the LinkedIn integration are described below. You can ask us to not sell or share your personal information.

LinkedIn Advertising Measurement

LinkedIn advertising measurement is enabled for selected business marketing pages on this site. This policy page does not load the LinkedIn Insight Tag.

When enabled, the LinkedIn Insight Tag helps us measure advertising visits and accepted business demo requests. LinkedIn can receive the page URL, referrer, IP address, browser and device information, timestamp, and cookie identifiers. LinkedIn describes its processing in its Privacy Policy and lists cookies and their durations in its Cookie Table. Its advertising services also support audience insights and retargeting.

Our demo-conversion event contains a fixed conversion identifier. We do not add form field values, email addresses, Kapture recordings, or recording identifiers to that event. The Insight Tag's own technical data collection is separate from the event payload. Kapture form recording is a separate service described in our Cookie Policy.

This integration excludes staging and preview sites, submission receipts, investor forms, audit tools, and hosted form documents. On permitted business marketing pages, unrecognized query parameters, URL fragments, and query-bearing referrers prevent the tag from loading.

A browser's Global Privacy Control signal or enabled Do Not Track signal prevents this LinkedIn integration from loading and sending our demo-conversion event. These controls do not delete previously collected data or disable all other site services, including Google Analytics and Kapture. See the choices in our Cookie Policy or submit a privacy request. LinkedIn members can also manage advertising preferences in their LinkedIn settings.

5. Your Privacy Rights

5.1 California Residents (CCPA Rights)

If you are a California resident, you have the right to:

Know: Request disclosure of personal information collected about you
Delete: Request deletion of your personal information
Opt Out: Opt out of the sale or sharing of personal information where applicable
Non-Discrimination: Not be discriminated against for exercising your rights
Correct: Request correction of inaccurate personal information
Limit Use: Limit the use and disclosure of sensitive personal information

5.2 European Residents (GDPR Rights)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Right of Access: Request a copy of the personal data we hold about you
Right to Rectification: Request correction of inaccurate or incomplete personal data
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data under certain circumstances
Right to Restrict Processing: Request that we limit how we use your data
Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format
Right to Object: Object to processing of your personal data for direct marketing or based on legitimate interests
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
Right to Lodge a Complaint: File a complaint with your local data protection authority

Legal Basis for Processing (GDPR Article 6)

We process personal data under the following legal bases:

Consent: You have given clear consent for processing for a specific purpose
Contract: Processing is necessary for a contract with you or to take pre-contractual steps
Legal Obligation: Processing is necessary to comply with the law
Legitimate Interests: Processing is necessary for our legitimate interests, provided they are not overridden by your rights

International Data Transfers

Your personal data may be transferred to and processed in countries outside the EEA, including the United States. When we transfer data internationally, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where applicable
Other legally approved transfer mechanisms

Data Protection Officer

For GDPR-related inquiries, you may contact our data protection team at hello@kx21.com.

5.3 Texas Residents

The Texas Data Privacy and Security Act took effect on July 1, 2024. Where it applies, Texas residents may request access to, correction of, deletion of, or a portable copy of their personal data, and may opt out of targeted advertising, the sale of personal data, or certain profiling. Texas residents may also appeal a decision on a privacy request by replying to our response.

5.4 Other State Rights

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights including access, correction, deletion, and opt-out rights. Contact us to exercise these rights.

5.5 Exercising Your Rights

To exercise any of these rights, submit a privacy rights request through our contact form. Please describe the right you wish to exercise and the information needed to locate your records. We will respond within the period required by applicable law and may request information reasonably necessary to verify your identity. Authorized agents should identify themselves and provide evidence of their authority.

6. Children's Privacy

Our services are general-audience business services and are not directed to children under 13 years of age. We do not knowingly collect personal information online from children under 13. If you are a parent or guardian and believe a child has provided us with personal information, please contact us immediately.

Consistent with the Children's Online Privacy Protection Act (COPPA), where applicable:

We do not collect personal information from children under 13
We do not allow children under 13 to register for our services
We will delete personal information collected from a child under 13 after we learn of it, unless we are legally required to retain it
We do not condition participation in activities on disclosure of more information than necessary

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

Encryption of sensitive data at rest and in transit
Access controls and authentication requirements
Regular security assessments and updates
Secure data storage with industry-standard protocols

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, it is securely deleted or anonymized.

9. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

10. Updates to This Policy

We may update this Privacy Policy from time to time. The revised version will be identified by the "Last updated" date above. We encourage you to review this policy periodically.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

KX21, Inc.

Las Vegas, NV, USA

Contact form: kx21.com/contact

12. Governing Law

This Privacy Policy and any disputes arising hereunder shall be governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict of law provisions. Any legal action relating to this Privacy Policy must be brought in the state or federal courts located in Texas.

13. Do Not Track Signals

We treat a recognized Global Privacy Control signal as a request to opt out of the sale or sharing of personal information where applicable. Our LinkedIn integration also honors an enabled "Do Not Track" signal, as described in the LinkedIn Advertising Measurement section. This does not disable all other site services.

14. Form Session Recording on This Site

Forms on the KX21 website are built on Kapture, our proof-of-submission product. When you interact with a form on this site, the session is recorded (the fields as you type them and the page as shown) and stored as a replayable, tamper-evident record attached to your submission. This is disclosed beside each form. To request deletion of a submission and its recording, use our contact form.