Trust & Security

Compliance isn’t a feature.
It’s the foundation.

K.I.N.D is built GDPR & POPIA-compliant by default. Every campaign, every consent signal, every suppression request is logged and auditable — automatically.

Last updated: June 2026

🇿🇦 POPIA
Compliant
● Active
🇪🇺 GDPR
Aligned
● Active
🔒 Data
Encrypted
● TLS 1.3
🌍 Cape Town
Hosted
● In-country
🧾 Audit
Trail
● Full log
🇺🇸 CAN-SPAM
Compliant
● Active
🏖 CCPA
Aligned
● Active
Protection of Personal Information Act

POPIA compliance, by default.

South Africa’s POPIA sets strict requirements for how personal information is collected, processed, and stored. K.I.N.D is built to meet these requirements automatically — not through configuration, but through architecture.

Consent management

Every outreach interaction is recorded with consent basis, timestamp, and channel. You hold a compliance record for every contact FIGSY touches.

  • Consent type logged per contact
  • Timestamp and channel recorded
  • Exportable consent records on request

Suppression & opt-out

Unsubscribe requests are honoured immediately and permanently. No contact is ever re-added to a campaign once suppressed.

  • Instant suppression on unsubscribe
  • Suppression list synced across all campaigns
  • No re-activation without explicit re-consent

Right to access & erasure

Data subjects can request access to their information or deletion at any time.

  • Access requests: privacy@get-kind.com
  • Erasure processed within 30 business days
  • Deletion confirmation provided in writing

Data minimisation

FIGSY only stores data required to run your campaigns. No surplus collection, no profiling beyond campaign relevance.

  • Contact data scoped to campaign use only
  • Auto-expiry after 24 months inactive
  • No data sold or shared with third parties
Data sovereignty
Your data, hosted securely and compliantly.
K.I.N.D's primary data centre is in Cape Town (Supabase af-south-1), on SOC 2-audited infrastructure. Hosting is GDPR-, UK GDPR-, POPIA- and CCPA-compliant. US and international clients who require it can request dedicated US data residency, and all cross-border transfers are governed by Standard Contractual Clauses — which matters for the data-governance requirements of regulated industries including financial services and healthcare.
Primary data centre
Cape Town, South Africa
Data residency
Cape Town (af-south-1); US region on request
Cross-border transfers
Governed by Standard Contractual Clauses
Backup location
Cape Town (geo-redundant)
General Data Protection Regulation

GDPR-aligned for international prospects.

If your outreach targets contacts in the EU or UK, GDPR applies. K.I.N.D’s consent and suppression architecture is aligned with GDPR requirements, giving you a defensible compliance posture for cross-border campaigns.

Lawful basis for processing

Outbound B2B email operates under legitimate interest. K.I.N.D logs the legitimate interest assessment for each campaign automatically.

  • Legitimate interest basis documented per campaign
  • Balancing test logged at campaign creation
  • Opt-out mechanism present in every email

Data processor agreements

K.I.N.D acts as a data processor on your behalf. A Data Processing Agreement (DPA) is available for all customers on request.

  • DPA available on request
  • Sub-processor list maintained and current
  • Anthropic (Claude) DPA in place
Technical security

Built securely at every layer.

Security is not a compliance exercise. Every layer — data in transit, data at rest, access controls, API authentication — is hardened by default.

Encryption

  • All data in transit: TLS 1.3
  • All data at rest: AES-256
  • API keys: encrypted at rest, never logged
  • Email credentials: vault-stored, not accessible to staff

Access controls

  • Role-based access control (RBAC) on all accounts
  • MFA enforced for all admin access
  • Staff access to customer data: audit-logged
  • Zero standing access policy for production systems

Infrastructure

  • Application: Railway (runs on SOC 2-audited cloud infrastructure)
  • Database: Supabase — Cape Town, af-south-1 (US region available on request)
  • Daily automated database backups, 30-day retention
  • Private repo, branch-protected — no direct pushes to production
  • Dependency vulnerability scanning (GitHub Dependabot)
  • ISO 27001 certification: Year 2 roadmap target

Incident response

  • Breach notification within 72 hours (UK GDPR, Kenya DPA)
  • POPIA: prompt notification to Information Regulator
  • Incident response plan documented and maintained
  • All incidents logged with root cause and remediation
  • Security contact: hello@get-kind.com
CAN-SPAM Act — United States

US email law. Met in full.

If your outreach touches US-based contacts, the CAN-SPAM Act applies. K.I.N.D’s email infrastructure is built to satisfy all FTC requirements automatically — no manual configuration required.

Sender identification

Every email sent through K.I.N.D identifies the true sender clearly. No misleading headers, no deceptive subject lines.

  • From name and domain match the sending account
  • Subject lines accurately reflect message content
  • No hidden or forged routing information

Physical address

CAN-SPAM requires a valid physical postal address in every commercial email. K.I.N.D includes this in all outbound templates.

  • Physical address included in every email footer
  • Address verified at account setup
  • PO Boxes accepted under FTC guidance

Opt-out mechanism

Every email includes a clear, working unsubscribe mechanism. Opt-out requests are processed within the FTC-mandated 10 business days.

  • One-click unsubscribe link in every email
  • Opt-out processed within 10 business days
  • No fee or extra steps required to unsubscribe

Commercial email labelling

Where required, K.I.N.D marks emails as commercial and ensures advertising content is clearly identified.

  • Transactional vs commercial distinction maintained
  • ADV labelling applied where applicable
  • No misleading categorisation of email type
CCPA / CPRA — California

California privacy rights. Respected by default.

The California Consumer Privacy Act (and its 2023 update, CPRA) grants California residents rights over their personal information. K.I.N.D honours these rights without requiring manual workflows.

Right to know

California residents can request details on what personal information K.I.N.D holds about them, where it came from, and how it is used.

  • Data subject requests: privacy@get-kind.com
  • Response within 45 days as required
  • Full category and purpose disclosure provided

Right to delete

Residents can request deletion of their personal information. K.I.N.D processes deletion requests and propagates suppression across all campaigns.

  • Deletion request processed on receipt
  • Contact suppressed across all active campaigns
  • Deletion confirmed in writing within 45 days

No sale of personal information

K.I.N.D does not sell, share, or rent personal information to third parties for monetary or other valuable consideration.

  • No data sold to any third party — ever
  • No data sharing for cross-context behavioural advertising
  • Opt-out of sale: always active by default

Right to opt-out & correct

California residents can opt out of data processing and request corrections to inaccurate personal information at any time.

  • Opt-out request honoured within 15 business days
  • Correction requests: privacy@get-kind.com
  • CPRA sensitive personal information protections applied
Email infrastructure

Deliverability built on trust.

Compliant email requires more than legal wording — it requires infrastructure that major providers trust. K.I.N.D’s sending stack is built to land in the inbox, not the spam folder.

Sending infrastructure

K.I.N.D sends via Resend with a dedicated custom domain. No shared IP pools that inherit other senders’ reputation problems.

  • Dedicated sending domain: send.get-kind.com
  • Not a shared IP pool — isolated reputation
  • Bounce and complaint monitoring active

Authentication (SPF / DKIM / DMARC)

Full email authentication stack in place. Major providers (Google, Microsoft, Yahoo) require these for bulk senders — K.I.N.D exceeds the minimum requirements.

  • SPF record published and validated
  • DKIM signing on all outbound email
  • DMARC policy: quarantine / reject

Domain warming

New customer domains are warmed gradually. Sending volume increases over time to build provider trust before high-volume campaigns start.

  • Automated warmup schedule on new domains
  • Volume caps enforced during warmup period
  • Reputation score monitored throughout

List hygiene

FIGSY validates contact data before sending. Unverified or high-risk addresses are flagged or removed before a single email goes out.

  • Email validation on import
  • Hard bounces removed automatically
  • Catch-all domain flagging to protect sender score

Compliance queries & DPA requests

For data subject access requests, DPA agreements, or any compliance question, contact our team directly.

privacy@get-kind.com →
Commitments

What we don’t do.

Compliance is as much about what you refuse to do as what you do. These are hard limits — not guidelines, not suggestions.

❌ No scraped lists

We do not purchase, scrape, or accept contact lists from third-party brokers. Every contact FIGSY reaches must be sourced through verified, lawful means.

❌ No spam list re-use

Suppressed contacts are permanently removed. We do not re-activate opted-out or bounced contacts under any circumstance, even under a new campaign or sender identity.

❌ No data sold — ever

Your campaign data, contact records, and conversation history are yours. We do not sell, rent, or share personal information with any third party for commercial gain.

❌ No indefinite retention

Data is not held indefinitely. Inactive contact records are flagged for review and deleted according to your retention settings and applicable legal requirements.

❌ No hidden sub-processors

Our full sub-processor list is available on request. We do not introduce new sub-processors without notifying affected customers and updating our DPA.

❌ No cold calls without POPIA basis

Phone outreach is only enabled where a lawful basis exists under POPIA. We do not permit unsolicited cold calling to suppressed or non-consenting contacts.