Privacy policy

KRP — client portal at krp.hk and the KRP Workspace app for iPhone and iPad. Last updated: 6 November 2026.

Who we are

KRP is a sole proprietorship registered in Hong Kong (BR No. 41625695). Contact for any privacy question: [email protected].

What we collect

• Account: your name, email address, company, job title, language and time zone, created by you or by KRP for your company.
• Content you send: messages, photos and files, tickets, meeting requests and voicemails.
• Calls and meetings: who took part, start and end times, duration. Audio and video are end-to-end encrypted: our servers relay them but cannot see or hear them. A call is recorded only if the organiser turns recording on, and every participant sees a red “Recording” indicator.
• Device: device type, app version, push notification tokens and a device public key used to keep your session secure. Your IP address is used to protect the service against abuse (logs are hashed).

What we do not collect

No advertising, no tracking across apps or websites, no analytics SDK, no location, and the app does not read your phone contacts or photos (except a photo you choose to send).

How we use it

Only to provide the service: sign-in, calls, messages, meetings, notifications, support, billing for KRP clients and security. We never sell or share your data for marketing.

Where it is stored and who processes it

On servers operated by KRP in the European Union. Push notifications go through Apple Push Notification service (a call identifier, the caller’s name or a short message preview). Emails are sent from our own mail server.

How long we keep it

Files shared during a call: 12 hours. Messages, tickets and call history: as long as your account is active. Invoices: 7 years (Hong Kong law). App sessions expire after 90 days without use (30 days for administrators).

Your rights

You can access, correct, export or delete your data, and sign out any device remotely (Settings › My devices). To delete your account, write to [email protected] from your account email: we confirm and delete within 30 days, except invoices we must keep. These rights apply under the GDPR (EU) and the PDPO (Hong Kong).