Privacy Policy
Last updated: 2026/10/10
Campulse Insight Corp. ("we", "us") values your privacy. In accordance with the Personal Data Protection Act of Taiwan (R.O.C.), this Privacy Policy explains how we collect, process, use and protect your personal data when operating Kemai | Business CRM (the "Service", including kemai.campulse.tw, its subdomains and custom domains connected by customers).
Data we collect
Depending on how you use the Service, we collect the following data:
- Account data: name, email address, profile picture, and a hashed password (we never store your password in plain text).
- Workspace data: company or team name, subdomain, member list and roles.
- Subscription and payment data: plan, orders and payment status. Subscriptions are managed by Recur (recur.tw), and card and other payment details are processed directly by PAYUNi; we never handle or store full card numbers.
- Usage records: IP address, browser type, sign-in times, and audit logs of sign-ins, permission changes, data exports and similar actions.
- Contact data: name, email, phone number and message you provide when requesting a demo or contacting support.
Signing in with Google
When you choose to sign in with Google and give consent on Google's authorization screen, the Service obtains only your basic profile information from Google: your name, email address, profile picture URL and Google account identifier (scopes: openid, email, profile).
We use Google user data as follows:
- Only to create and identify your account, sign you in to the Service, and display your name and profile picture in the interface.
- We do not access your Gmail, Google Drive, Google Calendar, Google Contacts or data in any other Google service.
- We do not sell Google user data, use it for advertising, or transfer it to third parties, except to service providers needed to run the Service (such as hosting) or as required by law.
- We do not use it to develop, improve or train generalized artificial intelligence or machine learning models.
- The Service's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- You can revoke the Service's access at any time from the "Third-party apps & services" page of your Google Account; you can still sign in with your email address afterwards.
- If we later introduce features that require additional Google permissions (such as sending email from your Gmail through the Service or syncing Google Calendar), we will explain their purpose and obtain your consent before you use them.
Purposes and use
We collect personal data for the following specified purposes under the Personal Data Protection Act: 090 consumer and customer management and services; 135 information and communication services; 136 information, communication and database management; 157 survey, statistics and research analysis; and, with your consent, 040 marketing. Specifically, we use it to:
- Provide the Service, including account verification, workspace management, support and system notifications.
- Process subscriptions, payments and invoices.
- Keep the Service secure, for example by detecting unusual sign-ins, preventing abuse and keeping audit logs.
- Analyze usage with de-identified statistics to improve the Service.
- With your consent, send product updates and marketing information; you can unsubscribe at any time.
Period, region, recipients and manner of use
Period: for as long as your account exists, plus any retention period required by law or necessary for our business.
Region: the regions where we and our service providers operate, including where the Service's servers are located, which may be outside Taiwan.
Recipients: us and the service providers we engage to provide the Service.
Manner: automated or non-automated means, used reasonably within the scope of the purposes above.
Customer data in workspaces
Data that you or your organization create in or import into a workspace (such as your customers' contact details) belongs to that workspace. We process it only as a service provider to deliver the Service and do not use it for any other purpose.
Each workspace's data is isolated by database-level access controls and cannot be read by other workspaces. Each workspace is responsible for obtaining its data lawfully and giving notice to the data subjects.
When a workspace lets its customers view a document through a share link (for example a quote), the name, message and reply those customers enter on the shared page, and how often and when the document was opened, are Customer Data of that workspace, which we process only as its service provider. Data subjects should contact the workspace that sent the share link to exercise their rights; we will assist the workspace.
Sharing and service providers
We do not sell your personal data. We share data with third parties only in the following cases:
- Service providers: cloud hosting and network services, subscription management and payment processing (Recur and PAYUNi), email delivery and error tracking, and web analytics (Google, only after you consent to analytics cookies). We contractually require them to protect the data and use it only for the services they provide to us.
- When required by law, or in a lawful investigation by judicial or regulatory authorities.
- When necessary to protect the rights, property or safety of us, our users or the public.
- In a merger, acquisition or transfer of business, where data is transferred with the same level of protection and you are notified in advance.
Cookies
The Service uses two kinds of cookies:
- Essential cookies: required for the Service to work, including session cookies that keep you signed in, a cookie that stores your language preference, and a cookie that records your cookie choice. These cannot be turned off.
- Analytics cookies: the Service uses web analytics services provided by Google (Google Analytics and Google Tag Manager), which help us understand how the site and the Service are visited and used (for example, which pages are viewed and where visitors come from) so we can improve them. Analytics data is aggregated, never includes the customer data in your workspace, and is never used for advertising. These are enabled only if you choose "Accept all" in the cookie banner; choosing "Essential cookies only" keeps them off.
- Shared pages that a workspace provides to outside parties (URLs starting with /p/, such as an online quote) use essential cookies only: after you enter the correct access code, an access cookie for that document is stored in your browser so you do not need to enter it again for 30 days. Shared pages do not show the cookie banner and do not load analytics cookies.
- We do not use third-party advertising or tracking cookies. Your cookie choice is kept for 180 days, after which we will ask again; you can also clear cookies in your browser at any time to choose again. You may disable all cookies in your browser, but you will then be unable to sign in.
Retention and deletion
We keep your data for as long as your account exists. When a workspace is deleted at its owner's written request, the data in it is deleted immediately; when you request deletion of your personal data under the Personal Data Protection Act, we delete or de-identify it within 30 days; data in backups is deleted when the backup retention cycle ends. Data we are legally required to keep (such as transaction and invoice records) is kept until the statutory period expires.
Workspace owners can request an export or deletion of all data in their workspace.
Security
We take reasonable technical and organizational measures to protect your data, including HTTPS encryption for all traffic, argon2id password hashing, isolation of data between workspaces, role-based access control, and audit logs for important actions. However, no transmission over the internet is completely secure, so please keep your sign-in methods safe.
Your rights
Under Article 3 of the Personal Data Protection Act, you may exercise the following rights regarding your personal data:
- Inquire about or review it.
- Request a copy.
- Request supplementation or correction.
- Request that we stop collecting, processing or using it.
- Request deletion.
If you do not provide data
Providing personal data is voluntary. However, if you do not provide data required for registration (such as an email address), you will not be able to create an account or use the Service.
Minors
The Service is intended mainly for businesses and teams. Minors must obtain the consent of their legal guardian before using the Service.
Changes to this policy
We may revise this Privacy Policy. Revisions will be posted on this page with an updated date, and we will notify you of material changes by email or a notice on our website.
Contact us
If you have any questions about this document, or wish to exercise your rights regarding personal data, please contact us:
Campulse Insight Corp. (領智創匯顧問股份有限公司)
Tax ID (Unified Business No.): 60535046