Privacy
Policy

1. Scope and responsibility

This policy applies to information handled through the Korvexa Systems website and during the evaluation, planning, delivery, and administration of business software consulting services. Those services may include software needs assessments, tool comparisons, workflow reviews, CRM setup consultation, integration planning, implementation support, and remote staff training.

The policy does not govern the independent privacy practices of a client, a software vendor, a hosting provider, a payment processor, or another third party. Where Korvexa Systems processes information solely on a client’s documented instructions during a consulting engagement, the client generally determines the purpose and means of that processing and remains responsible for providing any legally required notices to its personnel, customers, or other data subjects.

Current form behavior: the request form on this website validates completed fields and displays an on-screen confirmation. It does not, by itself, transmit the entered content to Korvexa Systems or create a consulting engagement.

2. Information that may be collected

Information provided directly

Korvexa Systems may receive information that a person or business chooses to provide through email, telephone, a written proposal process, an online meeting, or another agreed communication channel. Depending on the interaction, this may include:

• name, job title, company name, business address, email address, and telephone number;
• the nature of a software need, workflow issue, planned implementation, training requirement, or other consulting request;
• information about current business systems, user roles, operating procedures, data fields, integrations, budgets, schedules, and internal responsibilities;
• communications, meeting notes, documents, questionnaires, decisions, approvals, and project feedback;
• billing contact information, invoice information, transaction confirmation, and tax-related details, but not complete payment-card data unless handled by an authorized payment provider;
• support information reasonably necessary to diagnose configuration, testing, or implementation questions.

Information generated during an engagement

Consulting work may generate requirements summaries, comparison tables, workflow observations, configuration recommendations, implementation plans, training materials, test results, issue lists, and records of client decisions. These materials may contain business contact information or limited operational data supplied by the client.

Website and device information

Shopify, the hosting environment, the theme, and enabled applications may automatically process technical information such as IP address, browser and device type, operating system, approximate location derived from IP address, page requests, referring URL, timestamps, diagnostic logs, cookie identifiers, and security events. The precise technical data depends on the store configuration and the services enabled by the site owner.

Sensitive and production data

Clients should not provide passwords, private authentication keys, full payment-card information, government identification numbers, protected health information, highly sensitive employment records, or unrestricted production datasets unless the information is strictly necessary, an appropriate written arrangement is in place, and a secure transfer method has been approved. Credentials should be temporary, role-limited, and revoked when no longer required.

3. How information may be used

Personal and business information may be used only as reasonably necessary for legitimate consulting and administrative purposes, including to:

• review and respond to a business inquiry;
• determine whether a requested service is appropriate and prepare a proposal, estimate, statement of work, or engagement schedule;
• perform a needs assessment, comparison, workflow review, configuration consultation, integration plan, implementation-support task, or training session;
• communicate with authorized client contacts and document requirements, decisions, changes, approvals, and project status;
• create invoices, maintain business and tax records, and administer payments, cancellations, and refunds;
• protect the website, accounts, communications, and consulting materials against misuse, fraud, unauthorized access, and security incidents;
• maintain and improve internal service processes, templates, quality controls, and website performance;
• comply with legal obligations, respond to lawful requests, establish or defend legal claims, and enforce agreements.

Korvexa Systems does not use client confidential information to train public artificial-intelligence models. If a third-party AI-enabled tool is proposed for a client engagement, its use, data handling, and applicable configuration should be evaluated and agreed upon before client information is submitted to it.

4. When information may be disclosed

Information may be disclosed in limited circumstances consistent with the purposes described above:

• Service providers. Hosting, collaboration, email, document storage, scheduling, accounting, security, analytics, or other providers may process information to supply contracted functions. Access should be limited to what the provider needs to perform those functions.
• Client-authorized vendors. Information may be shared with a CRM, project management platform, integration provider, software vendor, or other third party selected or approved by the client when needed for the engagement.
• Professional advisers. Accountants, legal advisers, insurers, and similar professionals may receive information where reasonably necessary and subject to appropriate duties.
• Legal and safety reasons. Information may be disclosed when reasonably believed necessary to comply with law or legal process, protect rights or safety, investigate fraud or misuse, or respond to a lawful government request.
• Business transition. Relevant records may be disclosed as part of a proposed or completed reorganization, financing, sale of assets, merger, or similar transaction, subject to appropriate confidentiality protections.

Korvexa Systems does not sell personal information for monetary consideration. It does not knowingly use personal information for cross-context behavioral advertising. If site applications or practices change in a way that creates additional disclosure or opt-out obligations, this policy and available controls should be updated before the change is implemented.

5. Cookies and similar technologies

The website may use cookies, local storage, pixels, server logs, and similar technologies required for hosting, security, session continuity, preferences, performance measurement, or features enabled by Shopify and installed applications. Some technologies are necessary for the website to function, while optional analytics or marketing technologies should be used only when enabled and subject to applicable consent requirements.

Browser settings can be used to delete or block cookies. Blocking necessary cookies may cause parts of the site to function incorrectly. Additional details about categories, choices, and current configuration appear in the Cookie Policy.

6. Security, access, and retention

Reasonable administrative, technical, and organizational safeguards are used or expected for information handled in the course of consulting. Measures may include data minimization, need-to-know access, multi-factor authentication where available, password management, secure collaboration tools, device protections, backups, limited credentials, and deletion or return of client data when it is no longer needed.

No internet transmission, hosted platform, or storage method is completely secure. Clients remain responsible for their own account administration, vendor configurations, user permissions, endpoint security, backups, and decisions about what information to provide.

Information is retained only for as long as reasonably necessary for the relevant inquiry or engagement, business continuity, warranty or support period, accounting and tax requirements, dispute resolution, legal compliance, or enforcement of agreements. Retention periods vary by record type. Information that is no longer required should be deleted, anonymized, or securely archived, unless preservation is legally required.

7. Privacy rights and requests

Depending on where an individual resides and whether a particular privacy law applies to Korvexa Systems, the individual may have rights to request access to personal information, correction of inaccurate information, deletion, a portable copy, or information about certain processing and disclosures. Applicable law may also provide a right to opt out of targeted advertising, the sale of personal data, or qualifying profiling.

The Kentucky Consumer Data Protection Act became effective on January 1, 2026 and applies only when its statutory thresholds and other requirements are met. If Korvexa Systems is subject to that law for a particular processing activity, qualifying Kentucky consumers may exercise the rights provided by KRS 367.3611 through 367.3629, subject to authentication, exceptions, and limitations in the statute.

To make a privacy request, use the contact information at the end of this policy and clearly identify the request, state of residence, relationship to Korvexa Systems, and information needed to locate relevant records. Reasonable steps may be taken to verify identity and authority. If a request is denied where an appeal right applies, the response will explain how to submit an appeal. Authorized-agent requests may require proof of authority and direct verification with the individual.

Korvexa Systems will not discriminate against an individual for exercising a legally protected privacy right. Certain information may be retained when necessary to complete a requested transaction, protect security, comply with law, maintain required records, or establish or defend legal claims.

8. Children’s privacy

The website and consulting services are intended for businesses and adults acting in a professional capacity. They are not directed to children under 13, and Korvexa Systems does not knowingly collect personal information online from a child under 13. If such information is believed to have been provided, a parent or legal guardian should contact Korvexa Systems so the situation can be reviewed and appropriate deletion steps can be taken.

9. International access and transfers

The website may be accessible from outside the United States, and cloud providers may process information in more than one jurisdiction. Where a cross-border transfer is subject to specific legal requirements, the parties should identify their respective roles and implement an appropriate transfer mechanism or contractual protection before regulated personal information is transferred.

Using the website from another country does not, by itself, mean that every privacy law in that country applies to Korvexa Systems. Rights and obligations depend on the facts, the parties, the location of the processing, and applicable legal thresholds.

10. Third-party websites and software

The website or consulting materials may refer to third-party software, documentation, or services. Those third parties control their own privacy, security, availability, and contractual practices. A reference or recommendation is not a promise that a third party will maintain a particular feature, price, security control, or privacy practice. Clients should review the vendor’s current terms and privacy documentation before adoption.

11. Changes to this policy

This policy may be revised to reflect changes in services, website configuration, vendors, legal requirements, or information practices. A revised version will be posted on this page with a new update date. Material changes may also be communicated through an appropriate business channel when required by law or an existing agreement.