Knowledge Base Article

Personal Data Inventory for Khoros Subscription Services

This document captures a complete inventory of personal data points used throughout Khoros products. Khoros relies on performance of a contract and/or legitimate interests in order to process the personal data contained in this document.

Please scroll down to the charts below or simply click on one of the following product links to be redirected to the corresponding chart:

Table of Contents

MARKETING

Data ElementSource

Subprocessor Recipients (If blank, none)

Country Locations of subprocessors can be found here

Retention/Deletion

Campaigns/Initiatives

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Roles

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Approvals

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Labels

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Credentials

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Notifier

  • Recipient Email
User-created Aurora - indefinitely until 30 days post-contract

User Profile

  • ID
  • first name
  • last name
  • email
  • avatar image
  • mobile phone
User-created Aurora - indefinitely until 30 days post-contract

Directory Service Customer/Company

  • User ID
Company Administrator-created Aurora - indefinitely until 30 days post-contract

FINEX (Financial Industry Export)

  • outgoing content (publishing posts and care replies)
  • snapshots of company user profile details in the system
  • user approvals
Generated nightly by the marketing system. AWS filesystem - 1 day (deleted and regenerated nightly)

Suite navigation data

  • User ID
Captured by Pendo as users navigate the product suite. Indefinitely at Pendo until 30 days post-contract)

Promotion Accounts

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Promotions

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Care analytics data

  • User ID
Generated by the Marketing system as user actions occur. 

Aurora - indefinitely until 30 days post-contract

Redshift - 30 days

Care Rules

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

whodex profiles

  • Social Handles
  • Name
  • Profile Image
  • Location Coordinates
  • Country Code
  • Follower Count
  • Following Count
Sourced from supported social networks via API Aurora - indefinitely until 30 days post-contract

whodex profile author notes

  • user id
  • author notes
User-created Aurora - indefinitely until 30 days post-contract

export logs

  • User ID
Generated by the Marketing system as user actions occur. Kibana - 30 days

analytics dashboards

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

plans

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

messages

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Content Center assets

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

auto-labeling rules

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

comments

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

replies

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

retweets

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

streams

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

Stream Entities

  • Author
  • Bio
  • Full Name
  • profile Picture:
  • username
  • social network user id
  • Post Contents
Sourced from supported social networks via API. 

Aurora - indefinitely until 30 days post-contract

Cassandra - 7 days

Memcached - 1 day

User

  • user id
  • twitter handle
  • full name
Company Administrator-created Aurora - indefinitely until 30 days post-contract

visualizations

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

spaces

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

spotlight reports

  • User ID
User-created Aurora - indefinitely until 30 days post-contract

post search results

  • Author
  • Bio
  • Full Name
  • profile Picture:
  • username
  • social network user id
  • Post Contents
Sourced from supported social networks via API Cassandra - indefinitely until 30 days post-contract

Stream Items

  • Author
  • Bio
  • Full Name
  • profilePicture:
  • username
  • social network user id
  • Post Contents
Sourced from supported social networks via API Cassandra - indefinitely until 30days post-contract

Influencers

  • whodex profile id
User-created Aurora - indefinitely until 30 days post-contract

TeamQueue data

Generated by the Marketing system as user actions occur. Cassandra- 30 days post contract

 

CARE

Data ElementSource

Third-Party Recipients

Country Locations can be found here

Retention/Deletion
Id
Name
Screenname
Profile picture
Bio
Location		TWITTER: Consumer data is retrieved through Twitter APIs after the company authenticates their Twitter Handle(s) with Care. All consumer data is subject to Twitter's Terms of Service. YesDeleted within 30 days of end of customer contract.
Tweets deleted in Twitter will also be deleted in Care based on Twitter notification.
Id
Name
Picture
First name
Last name		FACEBOOK: Consumer data is retrieved through Facebook APIs after the company authenticates their Facebook Page(s) with Response. All consumer data is subject to Facebook's Terms of Service. YesDeleted within 30 days of end of customer contract.
User comments deleted in Facebook will also be deleted in Care based on Facebook notification.
Id
Username		INSTAGRAM: Consumer data is retrieved through Instagram APIs after the company authenticates their Instagram Handle(s) with Response. All consumer data is subject to Instagram's Terms of Use.YesDeleted within 30 days of end of customer of contract.
IdGOOGLE BUSINESS MANAGER: Consumer data is received through streaming updates after company authenticates Business messages with Care. All consumer data is subject to Google's Business Messages Terms of Service.YesDeleted within 30 days of end of customer contract.
Name
Username

GOOGLE MY BUSINESS: Consumer data is received through Google MyBusiness APIs after company authenticates with Care. All consumer data is subject to Google's Terms of Service.

YesDeleted within 30 days of end of customer contract.
NameRSS: Consumer data is received through RSS APIs after company authenticates with Care.YesDeleted within 30 days of end of customer contract.
Id
Display name
Profile image url		YOUTUBE: Consumer data is retrieved through YouTube APIs after the company authenticates their YouTube Channel(s) with Response. All consumer data is subject to YouTube's Terms of Service.YesDeleted within 30 days of end of customer contract.

Id

APPLE BUSINESS CHAT:Consumer data is received through streaming updates after company authenticates Apple Business Chat with Care. All consumer data is subject to Apple's Terms of Service.

YesDeleted within 30 days of end of customer contract.

Id
First name
Last name

WEB MESSANGER (SMOOCH): Within a secure chat, provided by Sunshine Conversations, consumers will share unstructured PII (i.e. the information will be shared within a chat conversation). This data will be ingested into Care.YesDeleted within 30 days of end of customer contract.
Id
Name		WECHAT: Consumer data is retrieved through WeChat's APIs after the company authenticates their WeChat Account(s) with Response. All consumer data is subject to WeChat's Terms of Service.Yes

Deleted within 30 days of end of customer contract.

Phone numberSMS: Consumer data is retrieved through Twilio APIs after the company authenticates their SMS numbers with Care. All consumer data is subject to Twilio's Terms of Service.Yes

Deleted within 30 days of end of customer contract.

Phone number
First name
Last name

WHATSAPP: Consumer data is retrieved through Smooch APIs after the company authenticates their WhatsApp numbers with Care. All consumer data is subject to WhatsApp's Terms of Service.Yes

Deleted within 30 days of end of customer contract.

Name
Device information

GOOGLE PLAY STORE REVIEWSYes

Deleted within 30 days of end of customer contract.

Id
Name
Profile image url

NETBASEYes

Deleted within 30 days of end of customer contract.

Name

IOS APP STORE REVIEWSYes

Deleted within 30 days of end of customer contract.

Id
First name
Last name
Bio
Profile image

LINKEDIN: Consumer data is retrieved through LinkedIn APIs after the company authenticates their LinkedIn Page(s) with Response. All consumer data is subject to LinkedIn's Terms of Service.Yes

Deleted within 30 days of end of customer contract.

 

RADIAN 6: This is a general listening integration that can bring in content from all of the other networks listed. We should no longer be using this provider.Yes

Deleted within 30 days of end of customer contract.

Id
Name
Profile image url

YELP: Consumer data is retrieved through LinkedIn APIs after the company authenticates their Yelp Location(s) with Response. All consumer data is subject to Yelps Terms of Service.Yes

Deleted within 30 days of end of customer contract.

Id
Display name
Email
Profile image url

KHOROS COMMUNITYYes

Deleted within 30 days of end of customer contract.

 

KHOROS BOT

Data ElementSource

Third-Party Recipients

Country Locations can be found here

Retention/Deletion
  • Name
  • Timezone
  • Language
  • Profile picture
  • Chat related data that can include personal data (Specified by customer in custom DPA)
Facebook messenger
  • MongoDB
  • Google cloud
  • On project removal
  • On applied data retention policy
  • Phone number
  • Name
  • Chat related data that can include personal data (Specified by customer in custom DPA)
WhatsApp
  • MongoDB
  • Google cloud
  • On project removal
  • On applied data retention policy
  • IP address
  • Browser version
  • Browser language
  • Chat related data that can include personal data (Specified by customer in custom DPA)
Web Widget
  • MongoDB
  • Google cloud
  • On project removal
  • On applied data retention policy
  • Any shared files are removed after 90 days
  • Name
  • Chat related data that can include personal data (Specified by customer in custom DPA)
Khoros
  • MongoDB
  • Google cloud
  • On project removal
  • On applied data retention policy
  • Phone number
  • Chat related data that can include personal data (Specified by customer in custom DPA)
Twilio
  • MongoDB
  • Google cloud
  • On project removal
  • On applied data retention policy
  • Phone number in case of WhatsApp or SMS
Analytics metadata
  • Google cloud
  • On project removal

 

COMMUNITY

Data ElementSource

Third-Party Recipients

Country Locations can be found here

Retention/Deletion
  • Author
  • login (username)
  • email address (except privacy guide)
  • salted password hash (except SSO)

SSO - from SSO identity provider (usually customer's propitiatory identity system via SSO cookie).

Local with migration - from PS team or Administrator importing the info

Local without migration - from users through initial registration

Yes

Mysql, Elasticsearch, Cassendra - indefinitely.

Redis - 24 hours

  • Author
  • userId
Created during the first initial interaction to the system, may it be SSO or import or registrationYes

Mysql, Elasticsearch, Cassendra - indefinitely.

Redis - 24 hours

  • Author
  • ICQ (optional)
  • AIM (optional)
  • Skype (optional)
  • MSN (optional)
  • Yahoo (optional)
  • Bio (optional)
  • Custom personal data fields (customizable per community)

Except required custom fields, all are optional not related to any feature supported

Entered by user either through initial registration or sub-sequential interaction with the community.

For custom personal data fields, it could also possible be from SSO cookie.

Yes

Mysql, Elasticsearch, Cassendra - indefinitely.

Redis - 24 hours

  • Author
  • Twitter access token

Supported Feature: Twitter Integration

Entered by user either through initial registration or sub-sequential interaction with the communityYesMysql - indefinitely.
  • Author
  • Facebook access token

Supported Feature: Facebook connect and integration

Entered by user either through initial registration or sub-sequential interaction with the communityYesMysel - indefinitely.
  • Supported Feature: Profile picture
  • Author
  • profilePicture
Entered by user either through initial registration or sub-sequential interaction with the communityYes

Mysql - indefinitely.

Redis - 24 hours

  • Author
  • IP address
  • browser cookie string
  • user agent
  • http referrer headers
From the http requests to the communityYes

Mysql - indefinitely.

Redis - 24 hours

Community User Metrics

  • Total Messages Posted
  • Total Page Views
  • Total Messages Read
  • Board Topics Started
  • Board Replies Blog
  • Articles Posted Blog
  • Comments Posted
  • Ideas Posted Idea
  • Comments Posted
  • Questions Posted
  • Q&A Replies Posted
  • Answers Posted Q&A
  • Comments Posted
  • Total Board Views
  • Total Logins Total
  • Minutes Online
Created by the communityYes

Mysql, Elasticsearch indefinitely.

Redis - 24 hours

 

CX INSIGHTS

Data Element

Source

Third-Party Recipients

Country Locations can be found here

Retention/Deletion

Audio Recordings:

  • Name
  • Phone number
  • Email address
  • Physical address
  • Dates directly related to an individual (birth, death, admission, etc.)
  • Gender
  • Username
  • Security code/PIN
  • Security questions
  • Account number
  • IMEI number
Audio files provided by Khoros clients
  • Amazon Web Services
Earlier of 24 months after the audio recording was created or Agreement termination date

Audio Recordings:

  • Name
  • Phone number
  • Email address
  • Physical address
  • Dates directly related to an individual (birth, death, admission, etc.)
  • Gender
  • Username
  • Security code/PIN
  • Security questions
  • Account number
  • IMEI number
Audio files provided by Khoros clients
  • Amazon Web Servies
  • MongoDB
  • Google Cloud Platform
Earlier of 24 months after the audio recording was created or Agreement termination date

Conversation transcripts:

  • Name
  • Phone number
  • Email address
  • Physical address
  • Dates directly related to an individual (birth, death, admission, etc.)
  • Gender
  • Username
  • Security code/PIN
  • Security questions
  • Account number
  • IMEI number
Text-based conversation transcripts provided by Khoros clients
  • Google Cloud Platform
Earlier of 24 months after the audio recording was created or Agreement termination date

Product Reviews and Surveys:

  • Name
  • Phone number
  • Email address
  • Physical address
  • Gender
  • Age
  • Username
  • Account number
  • IP address
  • MAC address
Text-based product/service review data provided by Khoros clients
  • Amazon Web Services
  • MongoDB
  • Google Cloud Platform
Earlier of 24 months after the audio recording was created or Agreement termination date

Social Media Posts:

  • Social network user ID
  • Name
  • Username
  • Post contents
From social networks via API, provided by Khoros clients, or third-party data aggregation sources
  • Amazon Web Services
  • MongoDB
  • Google Cloud Platform
Earlier of 24 months after the audio recording was created or Agreement termination date

Web Session Data:

  • Username
  • IP address
  • MAC address
  • Email address
Web session recording applications
  • Amazon Web Services
  • MongoDB
Earlier of 24 months after the audio recording was created or Agreement termination date

User Access Data:

  • Email address
  • IP address
User created activity
  • Okta
Three (3) months from the date of the user session

User Access Data:

  • Name
  • Email address
User created activity
  • Zendesk
Indefinitely at Zendesk until 90 days post-contract termination

User Access Data:

  • Email address
  • IP address
User created activity
  • Alienvault
  • Sumo Logic
Twelve (12) months from the date of the user session

User Access Data:

  • Name
  • Email address
User created activity
  • Pendo.io
Indefinitely at Pendo.io until 30 days post-contract termination
Updated 2 months ago
Version 20.0
policies & guidelines
No CommentsBe the first to comment