Trust & privacy at KRROP

This policy replaces the one dated 1 June 2025.

Most privacy policies start with the people who visit a website. This one starts with the people who have never heard of us, because a lot of what we do is research into companies and the people who work at them, done before anyone has asked us to.

KRROP helps businesses decide which companies to approach, why now, and who there to talk to. We do that through KRROP OS, a weekly research and scoring service, and through fixed-scope Sprints and Strategy work for clients. This page covers all of it.

KRROP · 199 Elizabeth St., Guelph, Ontario, Canada N1E 2X5 · info@krrop.com · +1-416-341-0623
Accountable for this policy: Kirko Papajanis, Managing Director

If you’ve never contacted us

You may be in our records because you work at a company that a business using KRROP wants to sell to, or one we’re considering approaching ourselves.

What we hold. Your name, your job title, the company you work for, and work contact details such as a business email address, a business phone number or a LinkedIn profile. We don’t go looking for anything about your life outside work.

Where it comes from. Your company’s own website, public professional profiles, Apollo (a business contact database we subscribe to), and, when the work is for a client, that client’s own records.

What we do with it. We decide whether your company is worth approaching now and who there is likely to be the right person. The reasoning is written up as a note about the company. If the work is for a client, the note goes to that client.

How contact happens. Nothing in our systems sends an email, a text, a LinkedIn message or a call on its own. A person decides and a person sends.

We don’t email someone unless we have a record of their permission to email them. Without that record, a first approach is a LinkedIn message written by a person. KRROP OS marks those accounts “LinkedIn only”. That mark is a reminder, not a lock. It doesn’t stop anyone sending an email. Our rule and the person doing the sending are what keep it.

If we phone you, it’s through Twilio.

If you’d rather not hear from us, say so to whoever contacted you, or write to info@krrop.com. We’ll stop, and keep a note of your name so you aren’t picked up again from another source.

If you’re a client

What you give us stays yours. When you give us a list, a file or access to your systems, we use it for the work we agreed with you and for nothing else. We don’t add it to our own prospecting, and we don’t share it with another client.

Your CRM. For KRROP OS we connect to your CRM (HubSpot, today) with a key you create in your own account and can revoke there at any time. Once a week an automated run reads company records, scores them, and writes the result back to each company: a band, a verdict, the approach to use, a note with the reasoning, and, for the calls worth making, a task assigned to a named person. The run works on company records. It doesn’t read your contact records, and it doesn’t change your lifecycle stage or lead status fields, because those are yours.

The research. To read a company, KRROP OS fetches that company’s own website and passes it, with the company’s details from your CRM, to an AI model (Anthropic’s Claude). The model reads and summarises. It doesn’t decide: the score, the band and the verdict are fixed arithmetic applied afterwards, so the same company scores the same way twice. We also use Claude when we research and write for you by hand.

Calls with us. Some of our video calls are transcribed with Otter AI so that what you said is captured accurately.

Where your files live. Our internal technology policy says KRROP’s data and yours are kept in KRROP’s Google Drive, or in the secure storage you prefer, and never saved on a staff member’s own device. It also requires strong passwords, multi-factor authentication wherever a service offers it, and the ability to wipe a lost device remotely.

If you asked for a free dossier

The form asks for your first name, your work email address, the company you work for, the company you’d like us to read, and why. It asks you to agree to us processing that information. A second box, unticked unless you tick it, lets you choose to receive our marketing emails. The company you name and your reason are saved on your company’s record in HubSpot.

We use them to write the dossier, to reply to you, and to book the call where we walk you through it. Asking for a dossier doesn’t sign you up for anything else. If you leave the marketing box unticked, we won’t add you to an email list or sequence because you asked for one.

One small thing happens in your browser. When you send the form, the name of the company you typed is kept in that browser tab, so the next page can show it back to you. It isn’t put into the page address and that step doesn’t send it anywhere. It’s gone when you close the tab.

If you’re reading this site

krrop.com runs on HubSpot. HubSpot sets cookies that count visits and connect a form you fill in, or a meeting you book, to you. The site also runs Google Analytics, which measures how pages are used, and, through Google Tag Manager, Apollo’s website tracker, which reports visits to Apollo. Two advertising tags run here too: LinkedIn’s Insight tag and Google Ads’ remarketing tag. They tell LinkedIn and Google that you visited, so that we can show ads to people who have, and count what those ads lead to. If you’re in Canada, the European Union, the UK or Switzerland, a banner asks you first, and these tags wait until you accept. In the United States they run until you choose Decline in the banner. Elsewhere they run without asking. You can block cookies in your browser; the site still works, but we won’t be able to link a form to your earlier visits.

Our fonts are served from our own site, so opening a page doesn’t send your IP address to Google for them.

Who else handles this information

We don’t hold security certifications of our own. These companies publish their own security and privacy terms, and those terms govern the data while it is in their systems. The technology policy links each one.

If something goes wrong

If information you trusted us with is exposed, we’ll tell you: within one business day by email and within two business days by phone.

How long we keep it

Until someone deletes it. Nothing deletes anything on a schedule, so in practice that means indefinitely. That applies to research records, to what clients give us, and to everything else on this page.

Some of it is kept on purpose. The date a company first appeared on one of our lists is never overwritten, because that’s how we avoid approaching the same company twice. What we write into a client’s CRM follows that client’s own retention.

Asking what we hold, or asking us to delete it

Write to info@krrop.com. There’s no form or self-serve page for this. A person reads that inbox and answers.

If you ask us to delete what we hold about you, we’ll delete it from our own systems and tell you when it’s done. We can’t delete it from a client’s own systems; we’ll tell you that it’s there.

When this page changes

We’ll change the date at the top.

If you’re one of the people in the first section, you didn’t choose to be in our records. Writing to us is how you get a say in what happens to them.