The short version
- Your employer decides what goes into its kanopySIS workspace. We look after it on their behalf.
- We don't sell personal information, and we don't use it for advertising.
- This website has no analytics or advertising trackers. The only cookies keep you signed in and protect the sign-in form.
- Passwords are stored only as one-way hashes. We can't read them.
1. Who we are and what this covers
kanopySIS is a people platform provided by OASIS Technologies LLC (“OASIS,” “we,” “us,” or “our”) to companies that operate multiple clubs (“Customers”). This Privacy Statement explains how we collect, use, share and protect personal information through the kanopySIS application, its public pages, and this website (together, the “Service”).
We do not sell personal information, and we do not use Customer data for advertising.
2. Our role for customers
Most personal information in kanopySIS, such as records about a company's staff and coaches, is entered or controlled by the Customer. For that information the Customer decides what is collected and why, and OASIS processes it on the Customer's behalf and under its instructions (a “service provider” or “processor”).
If you work for, or applied to, a company that uses kanopySIS, please contact that company first about your information. It controls it, and we will help it respond to your request.
3. Information we collect
Information Customers and their users provide
- Organization details: the company's name and contact details, its regions, and its clubs' names, addresses, phone numbers and contact details.
- People records: names, work email addresses, job titles, phone numbers, hire dates, roles, account status, and the regions or clubs each person is assigned to.
- Passwords: stored only as one-way (bcrypt) hashes, never in readable form. Links for setting a password work once and expire, and are also stored only as hashes.
- Two-step sign-in: if the system owner account turns it on, we store the secret key its authenticator app uses. The six-digit codes themselves are never stored.
- Staff profiles: what each person chooses to add to their own profile: a photo, a cover photo, headline, biography, specialties, years of experience, hometown, Instagram handle and LinkedIn address, whether to show their phone number, their professional certifications (name, issuer, credential ID, and issue and expiry dates), and for their professional profile their past jobs (job title, company, location, start and end month, and a description) and education (school, degree or course, dates, and a description).
- Display preferences: the theme, text size and colours a person chooses in My Preferences, and how they arrange their sidebar (its width, whether it is folded to icons, the order of its sections and pages, and which sections they fold away), kept with their account so they apply on any device. Nobody else sees them.
- Social Next (the company's own social network): posts people share, and news published for the whole company, a region or a club (with a headline), including posts they write on a colleague's page and posts they share again; pictures they attach to posts, with any descriptions they add; comments and replies; reactions (such as Like or Celebrate) to posts and likes on comments; @mentions of colleagues; who follows whom; posts a person saves for later; the notifications this creates (for example “Ana wrote on your page”) and whether they have been read; and each person's choice of who may write on their page. Each item keeps its author and time, and an edited post shows that it was edited.
- Training records: the courses and onboarding steps assigned to each person, which lessons they completed, which required lesson videos they watched to the end and which statements in a lesson they acknowledged (and when), their quiz answers and scores, tasks they marked done, who signed tasks off, and the certificates they earned. The Tutor also records which help steps a person marked as understood.
- Uploaded files: files people upload, such as profile and cover photos, pictures in Social Next posts, lesson handouts and videos, company logos and the spreadsheets used to import clubs and people. Spreadsheets contain whatever people records the Customer chooses to import.
Information from job applicants
When you apply for a job on a Customer's public job board, we collect what you enter for that Customer: your name, email address and phone number, whether you already work for that Customer and at which of its clubs, your answers to the questions on the application form the Customer chose for that job (which the Customer writes, for example your experience, certifications, availability, work history or references), any résumé or other files the form asks you to attach, the job you applied for, which board you applied through, and your IP address (used to stop automated spam). Your application goes to the hiring Customer, is stored in that Customer's own database together with a copy of the questions you answered, and is visible only to the staff it allows to manage that job. They may add ratings and notes about your application. If you are hired, your name, email address and phone number are used to create your account; if you already have an account with that Customer, your new role and club are added to it instead.
Information collected automatically
- Sign-in and session records: when you sign in and are active, your IP address, and your browser type, used to keep your session secure.
- Failed sign-in attempts: the email address tried, the IP address and the time, used to lock out repeated guessing.
- Audit log: who made changes to people, accounts and company settings, what changed, when, and from which IP address, so Customers can see who did what.
- Server logs: our web server records each request (IP address, page, browser and time) for security and troubleshooting.
- Email and text delivery records: for each email or text message the Service sends (sign-in and password links, help desk replies, notifications), the recipient's address or number, the subject, the time, and whether it was delivered, so we can find and fix delivery problems.
Help desk questions
When you ask the kanopySIS team a question with the help desk (the ? button), we collect your name, email address, company, the part of kanopySIS and the page you asked from, your question, and the replies on both sides. Help desk questions go to OASIS staff who support kanopySIS, not to other people at your company.
Information from website visitors and prospects
If you email us or ask for a demo, we collect what you choose to give us, such as your name, company, email address, phone number and your message.
When you book a demo at kanopysis.com/demo, we collect your name, work email, phone number, company, role, number of clubs, the topics you pick, any note you add, and your time zone. The booking is kept in the scheduling system OASIS runs for its products, which emails you a one-time code to confirm your address and a confirmation with links to reschedule or cancel, and may text a confirmation to the phone number you give.
4. How we use information
- to provide, operate, maintain and support the Service for the Customer;
- to publish a Customer's open jobs and receive applications on its behalf;
- to warn a person and their managers before a certification they listed expires;
- to sign users in and keep accounts secure, including locking out repeated failed attempts, and emailing sign-in and password-reset links;
- to answer help desk questions, and to email (and, for urgent questions, text) our support staff and the person who asked;
- to secure the Service, prevent fraud and abuse, and investigate incidents;
- to troubleshoot, fix errors and improve the reliability and performance of the Service;
- to respond to website visitors and prospective customers, including sending demo booking codes and confirmations by email and text message; and
- to comply with law and enforce our Terms of Service.
We do not use Customer data for targeted advertising, do not build marketing profiles of a Customer's people, and do not use it for any purpose unrelated to providing the Service.
6. Cookies and similar technologies
kanopySIS uses only what it needs to work:
- A sign-in cookie keeps you signed in. It is removed when you sign out, and a session ends after 12 hours without activity or 7 days at most.
- A form cookie protects the sign-in page and job application forms from forged submissions. It lasts two hours.
- Your light or dark theme choice is kept in your own browser's storage so pages open in the right theme. When you are signed in, it is also saved with your My Preferences.
This website does not use analytics, advertising cookies or third-party tracking.
7. Security
We use administrative, technical and physical safeguards, including encryption in transit (HTTPS), passwords stored only as hashes, lock-out after repeated failed sign-ins, permissions by role and by club or region, keeping each Customer's data separate from every other Customer's, audit logging, and restricted access to production systems. No system is perfectly secure. If we learn of a security incident affecting a Customer's data, we will notify that Customer without undue delay so it can meet its own notification obligations.
8. Retention
We keep Customer data for as long as the Customer's subscription is active, or as it directs. After a subscription ends, the Customer may request an export, and we then delete or de-identify the data within a reasonable period, subject to backup cycles and legal obligations. Job applications, uploaded files and training records are part of the Customer's data and follow the same rule. Security records such as sign-in attempts and audit logs are kept as long as needed to protect the Service and investigate incidents. Information from website visitors is kept only as long as needed to respond and to maintain our business records.
When we delete a Customer, everything that is its own goes at once: its database (people, clubs, jobs and applications, training records, profiles, posts and every other record), every file it uploaded, its people's logins and preferences, its listings on the public job boards, and its help desk questions, message log, sign-in attempt records and audit log. Deleting takes a second, confirmed step with a code sent to our administrator's phone. We keep one record that the deletion happened: who did it, when, and how many records and files were removed. Copies in our database backups expire on their normal cycle.
9. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your personal information, or to object to or restrict certain processing.
- People who use kanopySIS at work: you can update your own name, job title, phone and password under My Account, edit or remove what is on your profile and certifications under Staff Profiles, choose who may write on your Social Next page, unfollow people, and edit or delete your own posts and delete your own comments; you can also delete anything others write on your page. For anything else, contact your employer, and we will support it in responding.
- Job applicants: contact the company you applied to about your application. It controls it, and we will help it respond.
- Website visitors and prospects: contact us directly using the details below, and we will respond within the time the law requires.
We will not discriminate against you for exercising your privacy rights.
10. Children
The Service is built for businesses and their staff and is not directed at children under 13. We do not knowingly collect personal information from children under 13.
11. International users
The Service is operated from, and data is stored in, the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.
12. Changes to this Statement
We update this Privacy Statement as kanopySIS grows, for example when a new module collects new kinds of information. The “Last updated” date at the top shows when it last changed. For material changes we will give Customers reasonable advance notice through the Service or by email.
13. Contact us
Questions or requests about this Privacy Statement can be sent to:
OASIS Technologies LLC · kanopySIS
Email: lucian@iplexone.com
Web: kanopysis.com