Privacy Policy
Effective 9 October 2026
1. Who We Are
Kiln is a multi-tenant SaaS platform operated by JMWD Solutions Ltd, a company registered in Scotland with company number SC760915, whose registered office is at 3 Smith Crescent, Clydebank G81 6AD. This policy describes how we collect, use, and protect personal data.
Who is responsible for your data depends on who you are:
| You are | Who decides how your data is used (controller) | Our role |
|---|---|---|
| A Kiln account holder or team member (an individual, a business or an organisation) | JMWD Solutions Ltd | Controller. This policy applies. |
| A visitor to kiln.solutions, including someone who sends us an enquiry | JMWD Solutions Ltd | Controller. This policy applies. |
| Kiln platform staff | JMWD Solutions Ltd | Controller. This policy applies. |
| A visitor to, or customer of, a site built with Kiln | The account holder who owns that site | Processor, acting for the account holder under our Data Processing Schedule. See section 2. |
2. Sites Built With Kiln
If the site is run purely for personal or household purposes, its owner may not be covered by data protection law. We still handle your data as their processor, under the same safeguards. If you cannot reach the site's owner, or have a concern about how we handle the data, contact us. If you contact us about a site's data, we will pass your request to its owner.
3. Information We Collect
| Who | What we collect |
|---|---|
| Account holders and their team members | Name, email address and phone number. Any site or business details you enter (such as a site or business name, address and company number). Your password, stored only as a one-way hash. Passkeys and sign-in security codes for owners. Payment provider customer and account IDs. Subscription and invoice history. The terms you accepted, with the IP address and browser you accepted them from. What you put into Kiln. |
| Visitors to kiln.solutions | What you type into our enquiry form (for example name, email, phone, message), and the IP address and browser of the request. |
| Platform staff | Name, email, password hash, passkeys, and a log of the actions they take, including when they view an account to help its owner. |
| Everyone | Technical data needed to run and secure the Service: IP address, browser user agent, request logs, and security events such as sign-ins and failed sign-ins. |
We do not collect card numbers. Card details go straight to our payment processor.
4. How We Use Your Information and Our Lawful Bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account, hosting your site, providing the features you use | Contract |
| Taking subscription and add-on payments, invoicing | Contract |
| Keeping financial records | Legal obligation |
| Emails about your account, security and service changes | Contract; legitimate interests for service notices |
| Answering enquiries sent to kiln.solutions | Legitimate interests (replying to you), or steps before a contract |
| Security: sign-in protection, bot checks, audit logs, fraud and abuse prevention | Legitimate interests (keeping the Service and its users safe) |
| Setting up new accounts and giving support | Contract; legitimate interests |
| Improving Kiln | Legitimate interests |
| Drafting text with the AI writing assistant when you ask it to | Contract |
We do not sell personal data to third parties. We do not use it for advertising.
We don't send marketing emails. If that changes, we'll ask you first.
5. Who We Share Data With
We share personal data only with service providers that help us run Kiln, and only as much as each one needs. Where a provider processes personal data for us, we use one that offers data-protection terms. Some services, such as map display, receive only technical data like your IP address. The categories are:
| Category | What they do | Data they receive |
|---|---|---|
| Cloud hosting and infrastructure | Run the application, database, queues, cache and logs | All data held in Kiln |
| Email delivery | Send account, security and site emails | Email addresses and email content |
| Content delivery and security | DNS, custom domains, file storage, bot checks, protection from attacks | Web traffic including IP addresses; uploaded images and files; bot-check signals from the browser |
| Payment processing | Subscription billing; card payments on sites that take them | Billing name, email, address and card details; payment amounts |
| Address lookup, where enabled | Turn a UK postcode into an address | The postcode typed into a form |
| Vehicle registration lookup, where enabled | Look up vehicle details from a registration number | The registration number |
| AI writing assistance, only when you use it | Draft and rewrite text for your site | The text and site details you give the assistant (such as name, contact email and phone) |
| Map display | Show maps in Kiln and on sites built with it | The viewer's IP address and the map area viewed |
A list of the named providers is available on request from hello@kiln.solutions.
Integrations you choose to connect. Some features send data to a provider you connect yourself, such as a calendar or a social media account. You are then sharing the data with that provider under your own account with them.
Connected calendars (Google Calendar). If an account holder connects their Google account, Kiln creates a calendar for bookings in that account and writes each booking to it. Each entry includes the booking time and reference, and the customer's name, email and location. Kiln also reads the connected Google account's email address, to show which account is connected. Disconnecting stops Kiln sending bookings to the calendar. Kiln's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Connected social media (Instagram). If an account holder connects their Instagram account, Kiln reads that account's own published posts and shows them on the account holder's site. Kiln sends no visitor data to Instagram. The account holder and Meta are each responsible for Meta's processing of that account's data under Meta's own terms. Disconnecting stops Kiln syncing posts.
Embedded video. If a site owner embeds a video, the video provider receives the viewer's IP address when the video loads. Embedded video uses the provider's privacy-enhanced (no-cookie or do-not-track) mode.
We may also share data with professional advisers, or where the law requires it.
6. Where Data Is Stored and International Transfers
Kiln stores data in the UK and the EU. Some of our service providers process data outside the UK, including in the United States, and our content delivery network operates globally. Where personal data leaves the UK, we protect it with one of these safeguards:
- UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework (the "UK–US data bridge") where the provider is certified;
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
For details of the safeguard that applies to a provider, email hello@kiln.solutions.
7. How Long We Keep Data
| Data | How long |
|---|---|
| Account data and Your Content | While your account is open, then 90 days after it closes, then deleted |
| Payment, invoice and booking financial records | Six years, as UK tax and company law requires |
| Security audit log (sign-ins, admin actions, IP addresses) | 400 days, then deleted automatically |
| Records of platform staff viewing an account to help its owner | 400 days, then deleted automatically |
| Platform staff and team-member accounts | Erased when the person leaves, or when the account they belong to is deleted |
| Payment notifications from our payment processor (billing name, email, postcode) | Personal details removed after 90 days |
| IP address and browser recorded with form submissions | Removed after 30 days; the submission itself stays with the site owner |
| Password reset links | Deleted 7 days after they expire |
| Sign-in sessions | Up to 30 days for account holders and team members, and up to 90 days for customer accounts on sites built with Kiln, or until you sign out |
| Vehicle lookup results, where enabled | Cached for up to 30 days |
| Application and access logs | 365 days |
| Database backups | 7 days |
| A record that an email address bounced or reported spam | Kept as a one-way hash with no expiry, so we stop emailing it |
8. Your Rights
Under UK GDPR you also have the right to restrict or object to our processing, and to withdraw consent where we rely on it. We will reply within one month. Some rights have limits; for example, we must keep financial records for six years. If your data is on a site built with Kiln, ask the site's owner (see section 2).
9. Security
10. Cookies and Local Storage
We use essential cookies for authentication and session management. We do not use advertising or cross-site tracking cookies. We do not use analytics cookies, so we do not show a cookie banner. Embedded video uses privacy-enhanced modes.
| Name | Type | Purpose | How long |
|---|---|---|---|
| kiln_rt_platform, kiln_rt_tenant | Cookie | Keeps account holders, team members and staff signed in | Up to 30 days |
| kiln_rt_customer | Cookie | Keeps a visitor signed in to their account on a site built with Kiln | Up to 90 days |
| kiln_customer | Cookie | Tells the page a visitor is signed in (holds no personal data) | Up to 90 days |
| kiln_admin_gate | Cookie | Security check before the dashboard loads | Session |
| kiln-session, a session cookie with a random name, XSRF-TOKEN | Cookie | Session and form-forgery protection | 2 hours |
| Payment provider cookies (__stripe_mid, __stripe_sid) | Cookie | Fraud prevention for payments, set on booking and payment pages | Up to 1 year / 30 minutes |
| Bot check | Browser signals | Checks you are human on booking, sign-up and form pages | Per check |
| darkMode | Local storage | Remembers light or dark mode | Until you clear it |
| admin_guard | Local storage | Remembers which kind of login you last used | Until you clear it |
| loglevel | Local storage | Technical setting for the page's error logging (holds no personal data) | Until you clear it |
| storefront_token, booking and editor drafts | Session storage | Keeps you signed in and keeps your place if the page reloads | Until you close the tab |
Pages on sites built with Kiln set no cookies until you sign in or open a booking page.