Data Processing Addendum

Version française

Last updated: 26 October 2026

This Data Processing Addendum ("Addendum") is between KURUVI LLC, P.O. Box 3605, Mooresville, North Carolina 28117, United States ("Kuruvi"), and the business that holds a Kuruvi account (the "Customer"). It forms part of the Terms of Service and applies when Kuruvi processes Customer Personal Data in providing the Service. Accepting the Terms accepts this Addendum.

1. Scope and precedence

"Customer Personal Data" is the personal data of the people the Customer deals with through Kuruvi, which Kuruvi processes on the Customer's behalf: the data described in Annex 1. For this data the Customer is the controller (in India, the Data Fiduciary; in California, the "business") and Kuruvi is its processor (in India, the Data Processor; in California, the "service provider"). If the Customer uses Kuruvi for another business (for example, an agency running a client's inbox), the Customer is that business's processor, Kuruvi is the Customer's sub-processor, and the Customer is responsible for having that business's authority for its instructions.

Kuruvi's own account, billing, security and support records, and the data of people who use kuruvi.com, are not Customer Personal Data. Kuruvi handles them as controller under its Privacy Policy. These are also Kuruvi's own: the records of who opened Shopify customer data or rental applications, the SMS consent records Kuruvi keeps to meet carrier rules (it also keeps them for the Customer), and the usage records it keeps to apply plan limits.

If this Addendum conflicts with the Terms on the processing of Customer Personal Data, this Addendum prevails.

2. Kuruvi follows the Customer's instructions

Kuruvi processes Customer Personal Data only on the Customer's documented instructions. These are this Addendum, the Terms, the Customer's use and settings of the Service (for example connecting a channel, sending a message, pressing an AI button, turning on message translation, deleting or archiving content), and any other written instruction Kuruvi agrees to. Kuruvi processes it otherwise only where a law it is subject to requires, and then tells the Customer first unless that law forbids it. Kuruvi tells the Customer promptly if it believes an instruction breaks data protection law. The Customer discloses Customer Personal Data to Kuruvi only for the business purposes in Annex 1.

The Customer is responsible for the lawfulness of its instructions: its legal basis, the notices it gives its own customers (including that messages may be sent to the AI and translation providers named in the Privacy Policy, section 6), and any consent needed for marketing by SMS or WhatsApp. Rental applications and messages may contain sensitive or criminal-record information; Kuruvi does not ask for it, and the Customer decides whether to collect it.

If a public authority asks Kuruvi for Customer Personal Data, Kuruvi tries to redirect the request to the Customer, tells the Customer promptly unless the law forbids it, discloses only what the law requires, and challenges a request it believes is unlawful.

Kuruvi may create aggregated or de-identified information about how the Service is used (for example counts, performance and errors, not the content of messages) and use it to run, secure and improve the Service. Kuruvi does not train AI models on Customer Personal Data.

3. Confidentiality

Kuruvi lets only people who need it for the Service access Customer Personal Data, and each of them is bound to keep it confidential.

4. Security

Kuruvi applies the measures in Annex 2. It may change them as long as the overall level of protection does not go down.

The Customer is responsible for its own side of security: keeping its team's sign-in details safe, removing people who no longer need access, choosing settings that fit its risk, and keeping its own copies of data it must keep. The Customer does not put health records protected by the US HIPAA law, or full payment card numbers, into the Service.

5. Sub-processors

The Customer authorises Kuruvi to use the sub-processors listed in the "Sub-processors" table in section 5 of the Privacy Policy. That table is the list for this Addendum. Kuruvi binds each sub-processor by contract to data protection terms that protect Customer Personal Data, and remains responsible to the Customer for its sub-processors.

Before adding a sub-processor to that table, or replacing one in it, Kuruvi emails the account owner at least 30 days in advance. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may stop using the affected feature or end the Service, and Kuruvi refunds any prepaid fees for the unused period. Each sub-processor's own sub-processors are listed by that sub-processor and change on its own notice terms.

The platforms the Customer connects (such as WhatsApp, Instagram, Messenger, Shopify, eBay, Telegram, Microsoft and the Customer's own mail provider) process data under the Customer's own agreements with them, not as Kuruvi's sub-processors.

6. Helping with people's requests

Kuruvi helps the Customer answer requests from people to see, correct, delete or move their data, or to object. The Customer can use the Service's own tools (archive and delete conversations, Download My Data, and the automatic handling of Shopify's customer data requests). Where those do not cover a request, the Customer can email privacy@kuruvi.com, and Kuruvi responds promptly, and in time for the Customer to meet its own legal deadline, at no charge unless requests are clearly excessive. If a person sends a request about Customer Personal Data to Kuruvi directly, Kuruvi passes it to the Customer, tells the person it has done so, and does not answer it itself unless the Customer asks.

7. Security incidents and other help

Kuruvi notifies the Customer without undue delay, and within 72 hours, after becoming aware of a breach of security that affects Customer Personal Data. The notice describes, as far as known, what happened, the data and people affected, the likely consequences, what Kuruvi is doing, and a contact point for more information; details may follow in stages. A notice is not an admission of fault or liability. Kuruvi also gives the Customer the information reasonably available to it for the Customer's own security, breach-notification and impact-assessment duties, including about the AI and translation features.

8. Return and deletion

The Customer can download its data with Download My Data at any time. Customer Personal Data is deleted when the Customer deletes it in the Service, when the last member of the Customer's team deletes their account, or on written request to privacy@kuruvi.com, within 30 days from Kuruvi's own systems. The periods in section 8 of the Privacy Policy apply, including:

• archived conversations are deleted 30 days after archiving, and website-chat conversations after 365 days without a new message;
• copies of AI results kept to apply plan limits are deleted after 90 days, and search-index records after 365 days without activity;
• Kuruvi's own backups are kept for up to 90 days;
• Kuruvi-to-Kuruvi chats, team chat groups and topics, and the files shared in them, are not deleted automatically when an account is deleted, because they also hold other people's messages; Kuruvi deletes the Customer's share of them on written request;
• order records Kuruvi created for the Customer's inbox, Shopify customer data exports, and orders left after a WooCommerce store is disconnected are deleted on written request.

Sub-processors that store data for Kuruvi complete deletion from their own systems and backups on their own schedules (Google Cloud, for example, allows up to 180 days), and copies held by AI and translation providers are deleted on those providers' own schedules (Privacy Policy, section 6). Kuruvi keeps data longer only where a law requires it. On request, Kuruvi confirms a deletion in writing.

9. Information and audits

Kuruvi makes available the information needed to show it meets this Addendum: this Addendum, Annex 2, the sub-processor list and answers to reasonable written security questionnaires, and it cooperates with the Customer's reasonable security assessments. Kuruvi holds no third-party security certification or audit report today; once it has a current independent audit report covering the Service, it provides that report first. If that information is not enough to show Kuruvi's compliance, a regulator or law requires an audit, or a security breach affecting Customer Personal Data has occurred, the Customer (or an independent auditor bound by confidentiality) may audit Kuruvi's compliance. Audits take place no more than once in any 12 months, except after such a breach or where a regulator or law requires more. The Customer sends an audit plan at least 30 days ahead, or with shorter reasonable notice after such a breach or where a regulator or law requires it; the audit takes place during business hours without unreasonably disrupting the Service; the Customer does not scan or test Kuruvi's systems without Kuruvi's written approval; and the Customer pays its own costs and Kuruvi's reasonable time, unless the audit finds that Kuruvi materially breached this Addendum.

10. Where data is processed

Kuruvi's database and file storage are in the United States. Its sub-processors, including AI providers that may keep copies, process Customer Personal Data in the countries the Privacy Policy states. If the Customer's law requires a transfer instrument for sending personal data to Kuruvi (for example from the UK, EU or Switzerland), the Customer tells Kuruvi before sending it, and the parties put one in place in writing.

11. US state privacy laws

Where the California Consumer Privacy Act or another US state privacy law applies, Kuruvi acts as the Customer's service provider or processor and:

• does not sell or share Customer Personal Data, or use it for targeted or cross-context behavioural advertising;
• processes it only for the business purposes in Annex 1, and does not retain, use or disclose it for any other purpose, including its own commercial purposes, or outside its direct business relationship with the Customer, other than the aggregated or de-identified service information in section 2, as those laws allow;
• does not combine it with personal data from other sources, except as those laws allow (for example, to provide the Service or to detect security incidents and fraud);
• gives it the level of privacy protection those laws require, and tells the Customer if it can no longer meet them;
• cooperates with the cybersecurity audits and risk assessments those laws require of the Customer, including by providing the information in section 9;
• lets the Customer take reasonable steps to check, stop and remedy any unauthorised use (sections 6 to 9);
• binds its sub-processors by written terms that require them to protect Customer Personal Data as those laws require.

12. India

For Customers in India, this Addendum is the contract under which the Customer, as Data Fiduciary, engages Kuruvi as Data Processor under the Digital Personal Data Protection Act, 2023. Kuruvi processes only for the Customer's purposes, applies the safeguards in Annex 2, notifies the Customer of breaches under section 7 so the Customer can inform the Data Protection Board and the people affected, and deletes data under section 8.

13. Duration, liability and governing law

This Addendum lasts as long as Kuruvi processes Customer Personal Data, including the periods in section 8. Liability under this Addendum is subject to section 13 of the Terms, except where the law does not allow it to be limited. This Addendum is governed by the same law, and disputes go to the same courts, as the Terms (section 17).

Annex 1: Details of processing

• Subject matter and purpose: providing the Service so the Customer can talk with and serve its own customers: a shared inbox, order context, publishing and messaging, as the Customer instructs.
• Duration: while the Customer uses the Service, plus the periods in section 8.
• Nature: receiving data through connected channels, storing, organising, displaying, search indexing, sending messages and notifications, AI processing and translation when the Customer asks, malware scanning of files, and deletion.
• People: the Customer's customers and others who message it on connected channels; visitors who use the Customer's website chat; SMS recipients; marketplace buyers; rental applicants; and the Customer's team members, for what they exchange in team chats.
• Data: names, usernames, phone numbers, email addresses and profile photos; message content, attachments and voice notes; order, checkout, listing and shipping details; SMS consent status, time and source; rental application contents; AI suggestions, summaries and translations of these.
• Sensitive data: not requested by the Service; messages and rental documents may contain it (section 2).

Annex 2: Security measures

• Encryption in transit (TLS, with HSTS on Kuruvi's sites) and encryption at rest by Google Cloud.
• Shopify and eBay access tokens encrypted with Google Cloud KMS; other channel credentials kept in server-only storage that the app cannot read; secrets in Google Secret Manager.
• Separation between businesses and teams enforced by database and storage access rules; uploaded files scanned for malware.
• Server-side checks of who is calling; revoked or disabled sessions refused; recent sign-in required for sensitive actions; app attestation (App Check) on most server functions.
• Rate limits on sensitive and costly functions.
• Removal of common personal data patterns before conversation AI requests.
• Records of who opened Shopify customer data or rental applications, and of administrator actions.
• Database point-in-time recovery and daily backups.
• A written breach-response procedure.

Annex 3: Sub-processors

The "Sub-processors" table in section 5 of the Privacy Policy.

Contact

Questions about this Addendum: privacy@kuruvi.com.