1. About this policy
Kuro RMS Pty Ltd, based in Victoria, Australia, provides Kuro: a workspace for equipment rental, event and production teams. In this policy, “Kuro”, “we” and “us” mean Kuro RMS Pty Ltd.
This policy explains how we handle personal information through our website at kurorms.com, Kuro Web at app.kurorms.com, Kuro Mobile and our support communications. Contact us at support@kurorms.com with privacy questions or requests.
An organisation using Kuro also decides what information it enters about its staff, clients, contractors and jobs. That organisation is responsible for its own collection notices, permissions and lawful use of those records. Its privacy policy may apply alongside this one. You can contact us directly about how Kuro handles your information.
2. Information we collect
The information involved depends on how you and your organisation use Kuro. It may include:
- Account and organisation details: names, email addresses, company details, roles, account identifiers, login/session information and subscription status.
- Business records: contacts, event details, job addresses, crew and driver information, quotes, invoices, equipment records, pullsheets, repair notes, messages and files entered or uploaded by your organisation.
- Support and enquiries: the details you send us, correspondence and information needed to investigate an issue or respond to a request.
- Payment information: billing contacts, subscription/payment references and payment status. Payment providers process payment details through their own systems when those services are used.
- Technical and usage information: browser/device information, IP addresses, activity events, error information and service logs used to operate, understand and protect the service.
- Location information: reported device coordinates and associated job, vehicle, driver, timestamp and location-history information during an active mobile tracking session.
Kuro is a business operations service. Please avoid entering unnecessary sensitive information, such as health information or identity documents, into general job notes or attachments. If your organisation needs to handle that information, it must first establish an appropriate lawful basis and safeguards.
3. How information reaches us
We collect information when you register, use the service, upload records, contact us or use a supported integration. Your organisation or another authorised user may enter information about you. Our systems and service providers also generate technical information as the service operates.
You can browse the marketing website without a Kuro account. Where practical, you can make a general enquiry without giving your full identity. We may need identifying information to establish an account, investigate an account-specific problem or respond securely to an access request. Without necessary information, we may be unable to provide the relevant service.
4. What we use information for
We use information to provide the workspace and its supported workflows, authenticate users, manage subscriptions, share relevant job information between authorised users, provide support, investigate errors, improve the service and protect against misuse. We also use information to comply with applicable obligations and handle disputes or privacy requests.
Service communications may include account, billing, security and support messages. If we send optional marketing communications, you can ask us to stop them. This does not prevent necessary service communications.
5. Shared work and location tracking
Information entered into a company workspace can be visible to other authorised members of that organisation according to their access and the relevant feature. Your organisation manages its users and should explain how shared records will be used.
Kuro Mobile can report location during an active tracked logistics job, including in the background when the relevant device permissions are granted. Reports can be associated with the driver, vehicle and job so operations users can view the latest reported position and recorded history.
Your organisation must provide appropriate notices and obtain any permissions or consents required for worker location tracking. A subscription or this policy does not, by itself, authorise workplace surveillance. Users can manage location permissions in their device settings. Withdrawing permission or stopping a session can limit further reporting; it does not automatically erase previously reported locations.
Location reporting depends on the device, permissions and connectivity. It is not a guarantee of continuous position reporting or a safety monitoring service. Some work information and pending location reports may be stored locally on the device to support the app’s operation and synchronisation.
6. Service providers and integrations
We use service providers to operate Kuro. These include Google/Firebase for cloud hosting, authentication and data/file services; Google Maps for supported mapping features; and Stripe where subscription or payment processing is configured. They receive information relevant to the services they provide.
The Kuro web app includes Google Analytics for usage reporting. Usage events can include account and organisation identifiers, user names and roles, as well as browser/device information. The app’s current analytics configuration also enables advertising-related consent settings. These practices must be considered separately from the marketing website, which currently has no analytics or advertising scripts.
Where AI-assisted equipment matching is used, relevant equipment names, manufacturer/model/variant details and candidate catalogue records are sent to Google’s generative AI service to suggest matches. Do not include unnecessary personal or sensitive information in equipment fields. This policy does not promise that provider processing or model-training settings have a particular configuration.
If your organisation enables a supported external integration, information required for that integration may be shared with the connected provider. That provider’s own terms and privacy practices also apply.
We may also disclose information to authorised personnel and advisers where needed for support, security, legal compliance or a dispute, or where disclosure is required or permitted by applicable law. We do not offer customer personal information for sale.
7. Processing outside Australia
Kuro uses international cloud providers. Our currently identified web application hosting region is Singapore. Information may also be handled in other countries through a provider’s infrastructure, support or sub-processors. The hosting region does not establish the location of every database, backup, analytics, payment or AI service.
We take appropriate steps required by applicable law when arranging overseas handling of personal information. You can contact us for information about providers and overseas processing relevant to your organisation. The final provider/country disclosures must be confirmed before this draft is adopted.
8. Cookies and local device storage
The marketing website currently does not set analytics or advertising cookies. Its web host may still process ordinary request and security logs. Following a link to Kuro Web, a store or another provider takes you to a separate service.
Kuro Web and Kuro Mobile use browser or device storage for functions such as sign-in sessions, preferences, cached work information and pending synchronisation. Kuro Web’s analytics can also involve cookies or similar identifiers. Blocking storage or changing device permissions can affect those functions. Removing local data from a device does not necessarily delete company records stored by the service.
9. Retention and deletion
We keep personal information for the purposes described in this policy and for applicable legal obligations. We do not keep personal information indefinitely simply because storage is available.
Free demo workspace data will be deleted 60 days after the demo ends if the organisation has never activated a paid subscription. Activating a paid subscription before deletion ends the demo-only retention rule.
Workspace data for organisations that previously activated a paid subscription will be deleted after 12 consecutive months of subscription inactivity. The period starts when the paid subscription has ended and the organisation has no active subscription. It is not triggered merely by a lack of logins while a subscription remains active. Reactivating the subscription interrupts that period.
These rules cover the inactive workspace’s customer records and uploaded files, including its recorded location history. Retention does not provide continued free access or guarantee restoration of a closed workspace. Contact us before your demo or subscription ends if you need to retrieve your records.
We may retain information that must be kept for legal, accounting or dispute-related purposes for as long as that purpose requires. Any such retained information is handled separately from ordinary workspace use. You can request earlier deletion of personal information; we will consider the request, applicable rights and any lawful reason for retaining it.
10. Security
We take reasonable technical and organisational steps to protect personal information. These include account authentication, access controls and the security capabilities of our cloud services. No online service or device is completely free of security risk.
Your organisation should manage user access, secure its devices and credentials, and contact us promptly about suspected unauthorised access. If a breach requires notification under applicable law, we will follow those requirements. We do not claim a particular security certification or an uninterrupted service guarantee in this policy.
11. Access, correction and privacy requests
Email support@kurorms.com to request access to or correction of your personal information, or to ask about deletion and other rights available under applicable law. Tell us enough to locate the information and understand the request; do not send unnecessary identity documents.
We may need to verify your identity or authority before releasing or changing information. For records managed by your organisation, we may coordinate with its administrator while still addressing our own obligations. We will explain the outcome and any lawful limitation or refusal, and aim to respond within a reasonable time. Asking us to correct information is free of charge.
12. Complaints and changes
Send a privacy complaint to support@kurorms.com, describing what happened and the outcome you seek. We will acknowledge it, investigate the relevant handling of information and respond with our findings or next steps. We aim to provide a substantive response within 30 days, or explain if more time is needed.
If the complaint is unresolved, you may contact the Office of the Australian Information Commissioner, where it has jurisdiction, or another relevant authority. This does not remove rights available to you under applicable law.
We will update this policy when our practices change. The published version will show its update date. Where required, we will provide additional notice or obtain consent for a new use of personal information. See also our terms of service.