Privacy Policy

Version française

Last updated: 23 October 2026

Revised 25 October 2026 (clarifications that add rights, see section 14): section 1 names KURUVI LLC and its address; section 9 rights apply wherever you are; one response time in sections 9 and 12; section 15 names the person in charge of privacy; section 2 states how sensitive data is handled.

This Privacy Policy explains how Kuruvi ("we", "us", "our") collects, uses, stores, and shares personal data when you use the Kuruvi application, the kuruvi.com website, and related services (collectively, the "Service"). We take your privacy seriously and aim to be as transparent as possible.

1. Who we are

The data controller for the personal data we hold about you is KURUVI LLC, Mooresville, North Carolina 28117, United States ("Kuruvi"). For any questions about this policy or to exercise your rights, contact us at hello@kuruvi.com. If your enquiry concerns data protection specifically, you can reach our data protection lead at privacy@kuruvi.com.

2. What personal data we collect

Information you give us

• Account information: your name, username, the email address or phone number you sign in with, an optional profile photo, and your country and inbox-language settings. If you sign in with a password, Google Firebase Authentication stores it in hashed form on our behalf; Kuruvi never sees it. If you sign in with Google or Apple, we receive the name and email address that service shares.
• Your agreement to our terms: when you sign up, we record which versions of our Terms and this policy you agreed to, and when.
• Billing information: payments are processed by Stripe, or by Apple, Google Play or Shopify when you subscribe through them. Your card number and billing address stay with that payment provider. Kuruvi keeps your payment provider's customer reference, your billing country, the country that issued your card, and your subscription status.
• Support correspondence: messages you send us, and any information you choose to include.

Information we sync on your behalf

• Channel data: when you connect a channel, we sync your conversations, contact names, phone numbers or email addresses, profile photos, message content and attachments (including voice notes) so we can show them in your inbox. Channels: WhatsApp Business, Instagram, Facebook Messenger, Telegram, email (Gmail, Outlook, or another mailbox you connect), SMS, the Kuruvi chat widget on your own website, and any outside system you connect through Kuruvi's inbox API.
• Marketplace data: when you connect eBay or a WooCommerce store, we sync orders, listings and the buyer details on them.
• Shopify data: when you connect Shopify, we read your customers (name, email, phone), order history, and order statuses, plus products, to display them alongside conversations. See section 16 for the full Shopify Protected Customer Data disclosure.

Information we collect automatically

• Security and access records: when someone in your team opens Shopify customer data or a rental application, and when a Kuruvi administrator acts on an account through our admin tools, we record who, what and when, with the IP address. Some abuse limits use a one-way hash of an IP address instead of the address itself.
• Device and error data: push-notification tokens and the kind of device it is, so notifications reach you; and, when something fails in the app, an error report with the app version and a reference number.
• Calls: who called whom, when, and the connection details the devices exchange. Call audio and video are not recorded.
• Phone contacts: only if you allow it. Kuruvi reads your phone's contacts on your device and sends their phone numbers and email addresses to our servers to find which of them use Kuruvi. A contact is saved to your Kuruvi contacts only when you add it.
• Cookies and browser storage: we use no analytics, advertising or tracking cookies. What the website chat and the Kuruvi app keep in your browser is described in section 10.

Sensitive data: Kuruvi does not ask for sensitive personal data, such as health, religious or philosophical beliefs, political opinions, sex life or sexual orientation, racial or ethnic origin, or genetic or biometric data. Messages and attachments your customers send may contain it; we process them only to show them in your inbox and as sections 5 and 6 describe.

3. Legal basis for processing (Article 6 GDPR)

We rely on the following lawful bases for processing your personal data:

• Contract (Art. 6(1)(b)): to provide the Service you've signed up for — syncing your inbox, showing Shopify context, processing payments.
• Legitimate interests (Art. 6(1)(f)): to keep the Service secure, prevent abuse, and improve features based on aggregated usage. These interests are balanced against your rights.
• Consent (Art. 6(1)(a)): where the app asks for it: before Kuruvi reads your phone contacts, and before inbox auto-translate sends message text to Google Cloud Translation (section 6). You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): when we must retain or disclose data to comply with tax, accounting, or law-enforcement requirements.

4. How we use your information

We use personal data to:

• Operate the Service — sync messages, display Shopify context, send notifications.
• Authenticate you and keep your account secure.
• Process subscription payments and send billing receipts.
• Respond to support requests and improve our help materials.
• Debug crashes, monitor uptime, and detect abuse or fraud.
• Send transactional emails (e.g. billing, security alerts).

Marketing emails: we only send marketing emails if you opt in during signup or via account settings. You can unsubscribe anytime via the link in every email, or by emailing privacy@kuruvi.com. Unsubscribing from marketing does not stop transactional messages tied to your account.

5. Sharing your data

We never sell your personal data. We share it only with the following categories of recipients, and only as needed.

Sub-processors

The providers below process data on our behalf. For each one, the table says where the provider's published terms say it may process data, and which published data-processing terms apply. It describes those published terms; it does not describe any separately negotiated agreement.

Platforms you connect

When you connect one of these platforms, data moves between Kuruvi and that platform so the connection can work. Each platform handles that data under its own terms and privacy policy, and several say they act as an independent controller rather than as our processor.

Note: when you connect a mailbox with its server settings (IMAP and SMTP), or receive mail through your own SendGrid account's Inbound Parse, Kuruvi reads and sends mail through your own email provider, under that provider's terms.

Note: when you connect a self-hosted WooCommerce store, the WooCommerce site itself runs on infrastructure you control (your WordPress host) — not on a Kuruvi-managed sub-processor. Webhook delivery between your store and Kuruvi goes through Google Cloud Functions in us-central1.

• Legal authorities: when we are legally compelled to do so. We push back on overbroad requests and notify you wherever lawfully permitted.

6. AI processing and message translation

Kuruvi sends content to outside providers in three separate ways: AI help with a conversation, the Ask Kuruvi help desk, and optional automatic translation. Each works differently, so each is described on its own below.

6.1 AI help with a conversation

In a conversation, three buttons use AI: Suggest (a suggested reply), Order status (an order-status draft) and Generate (a conversation summary). A request is made only when a signed-in person with access to that conversation presses one of them. Receiving a message does not make an AI request. In a shared team conversation, anyone in your team who has access to it can press these buttons, so someone else can request AI for a conversation you also work on.

What each request contains:

• Suggested reply: the text of up to the 24 most recent messages in the conversation (messages without text, such as a photo with no caption, are left out), the conversation's latest message if someone other than you sent it, and the customer's first name.
• Conversation summary: the text of up to the 24 most recent messages. No separate customer-profile or order fields are added; message text may itself contain those details.
• Order-status draft: the text of up to the 8 most recent messages, the conversation's latest message if someone other than you sent it, the customer's first name and, if Kuruvi finds a matching order, a few order fields: order number, fulfilment and payment status, tracking number and tracking link, estimated delivery date, and the titles and quantities of up to 5 items. Kuruvi looks for the order among your store's 50 most recent orders, using the customer's email address or phone number, and uses only an order that matches this customer. The email address and phone number used for that match are not sent to the AI provider.

Each message is cut to 1,600 characters after redaction (see 6.4). The request also contains Kuruvi's own instructions to the model. The reply or summary that comes back is saved with the conversation, together with which provider produced it.

These requests go to Google (Gemini API) first. If Google cannot answer (for example, it is down, rate-limited, timed out, or refuses our account or key), the same request goes to Anthropic (Claude), and if Anthropic also cannot answer, to OpenAI. A request that a provider rejects as invalid is not passed on to the next one.

6.2 Ask Kuruvi help desk

Ask Kuruvi answers questions about using Kuruvi. It is sent the question you type (up to 500 characters), up to 10 earlier questions and answers from the same help session (each cut to 400 characters), and the 5 passages of Kuruvi's help documentation that best match your question. It does not fetch your inbox conversations, your customers or your orders.

If you paste customer details into a question, such as a name, an address or part of a message, they become part of the request.

Ask Kuruvi uses OpenAI only. Your question is first sent to OpenAI's embeddings service to find the matching help passages, then the question, session history and passages go to OpenAI to write the answer. There is no fallback to another provider.

6.3 Automatic message translation

Translation is separate from the AI buttons and uses a different provider, Google Cloud Translation. It is off unless you turn it on, with the Translate incoming messages switch in Edit profile (open your profile card in Settings) or during profile setup. Kuruvi asks you to confirm before the switch turns on. It is available only when your team's plan includes translation, and you choose the language messages are translated into.

The setting is personal. While it is on, each time you open a conversation, including a shared team conversation, the text of its messages that you did not write yourself is sent to Google Cloud Translation. There is no separate tap for each message. Google detects the language; a message already known to be in your language, or already translated into it, is not sent again. Only message text is sent (up to 5,000 characters per message), not your contacts or order data. Translation text is not redacted, so whatever a message says, including a name or an address, is sent as written.

The original message is never altered or replaced. Both the original and the translation are stored in your Kuruvi data, and the translation is shown with the original one tap away. Deleting a message deletes its translations with it.

Translations are machine-generated and can be wrong. Turning the switch off stops further message text being sent for translation when you open a conversation. Teammates who have it on keep their own setting.

6.4 Limits on what is protected

Redaction. Before a conversation AI request, or an Ask Kuruvi question and its session history, is sent, Kuruvi replaces text that looks like a card number, an email address, a phone number, a Bearer token, or a Shopify, Stripe, Google or Slack key or token with a placeholder. Customer names are cut to the first name. Redaction works by matching patterns. It does not make content anonymous, and it does not catch every sensitive detail: other people's names, street addresses and anything else a customer writes are sent as written. Translation requests (6.3) are not redacted.

No AI switch. Kuruvi has no setting that turns the AI buttons off for you or your team. The requests in 6.1 and 6.2 are made only when someone uses those features. Content still leaves Kuruvi in other ways, without anyone pressing an AI button: through translation when it is on, through the platforms you connect, and through the providers listed in section 5.

What the providers do with it. We use each provider's paid service under its published standard terms. This describes those published terms, not any separately negotiated agreement:

• Google (Gemini API): Google does not use prompts or responses to improve its products. It logs them for a limited period, which its terms do not state in days, to detect and prevent policy violations and for legally required disclosures. They may be stored briefly or cached in any country where Google or its agents maintain facilities. (Gemini API terms)
• Anthropic: Anthropic does not train its models on this content by default. It deletes API inputs and outputs within 30 days, but may keep content flagged for a usage-policy violation for up to 2 years. Its terms do not name a processing country. (Anthropic data retention)
• OpenAI: OpenAI does not use API data to train its models unless the customer opts in to sharing. It keeps requests to its chat and embeddings services for up to 30 days to monitor abuse, longer where the law requires. Its documentation names no default processing region. (OpenAI API data controls)
• Google Cloud Translation: Google holds the text briefly in memory to translate it and does not use it to train or improve its translation features. Processing may take place wherever Google or its sub-processors maintain facilities. (Cloud Translation data usage)

Deleting your Kuruvi data does not reach copies a provider still holds under these terms. Those copies are deleted on the provider's own schedule.

7. International transfers

Kuruvi's primary application infrastructure runs on Firebase and Google Cloud in the United States. Your data is therefore transferred to the United States, and the providers and platforms in section 5 may process it in other countries as their published terms describe.

EU customer data may be moved to an EU region in future as our EU customer base grows. We'll notify affected users before any such migration and update this section.

8. Data retention

We retain personal data only as long as necessary for the purposes set out above:

• Account data: for as long as your account exists, and up to 90 days after deletion for backups.
• Disconnecting a channel: Kuruvi deletes the access credentials it stored for that channel, so it can no longer read from or send to it. Messages, orders and customer records already synced stay in your Kuruvi data until you delete your account or ask us at privacy@kuruvi.com to erase them. Deleting a WhatsApp, Instagram, Messenger, Telegram, email or website-chat conversation in the app only hides it from you; it does not erase it. To withdraw Kuruvi's access on the platform's side as well, remove Kuruvi in that platform's own settings (for Shopify, uninstall the app; see section 16.3).
• Archived conversations are deleted automatically 30 days after they are archived. Website chat conversations are deleted automatically after 365 days without a new message.
• Deleting your account: deletes your profile, your connections and their stored credentials, your listings, the files you uploaded, and the conversations of channels connected to your own account. In a team, the team's conversations and channel connections belong to the team: they stay while anyone remains in it and are deleted when its last member deletes their account. Kuruvi-to-Kuruvi chats, team chat groups and topics, and the files shared in them are not yet deleted automatically; ask us at privacy@kuruvi.com to delete them.
• Billing records: your payment provider (Stripe, Apple, Google Play or Shopify) keeps payment and invoice records under its own terms and the tax and accounting rules that apply to it. The subscription status Kuruvi keeps is deleted with your account.
• Security and access records: the access records described in section 2, and records of account deletions and data requests, are kept without a fixed end date so that misuse can be investigated.
• Ask Kuruvi logs: the question (redacted as described in section 6.4), the answer and the IDs of the help passages used are retained for up to 90 days for safety review and quality improvement, then automatically deleted. They are not deleted earlier when you delete your account.
• AI suggestions and summaries: stored with the conversation they were made for, as part of your synced messages. A copy of each result is also kept for 90 days in your team's AI usage records, then deleted automatically.

9. Your rights

Wherever you are, you have the following rights with respect to your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention obligations.
• Right to restrict processing — limit how we use your data while a query is being resolved.
• Right to data portability — receive your data in a structured, machine-readable format. Download my data in Settings exports your profile, conversations, message text and orders. It does not yet include attachments, translations, AI suggestions and summaries, or team chat groups; ask us for those.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — at any time, where processing is based on consent.
• Right not to be subject to automated decisions — Kuruvi does not make legally significant decisions about you using purely automated processing.

To exercise any of these rights, email privacy@kuruvi.com. We respond within 30 days, or sooner if the law where you live requires it. If a request is complex and that law allows more time, we may take longer, and we tell you why within those 30 days. You also have the right to lodge a complaint with your local supervisory authority.

10. Cookies and browser storage

We do not use analytics, advertising or tracking cookies, and our website runs no analytics tool. What is stored or sent:

• Website chat (kuruvi.com): every page loads our chat widget, which fetches Google's Firebase code from www.gstatic.com, so Google receives your IP address and browser details for that request. When you open the chat, the widget signs you in anonymously and keeps that anonymous session in your browser's storage, so the conversation carries on if you leave and come back.
• Kuruvi app (app.kuruvi.com and the mobile apps): your sign-in is kept in your browser's or device's storage so you stay signed in. On the web, the app uses Google reCAPTCHA Enterprise to protect accounts from abuse; reCAPTCHA sets a necessary cookie, _GRECAPTCHA, for its risk analysis, and processes your browser details under Google's terms.

This storage is what lets the chat and sign-in work. We do not use it to track you across other websites.

11. Security

We protect personal data with these measures: TLS in transit; encryption at rest by Google Cloud; Shopify and eBay access tokens additionally encrypted with Google Cloud Key Management; and other platform credentials kept in server-only storage that the app cannot read. No system is ever 100% secure. If we become aware of a personal-data breach, we will tell the relevant supervisory authority where the law requires it, within 72 hours of becoming aware of it where feasible, and tell the people affected where the law requires it. Where we hold the data for a business (section 5), we will tell that business without undue delay so it can meet its own duties.

Data-loss prevention & unauthorized-access controls:

• Firebase Security Rules keep each business's conversations, orders and connections to that business and its team. Your public profile (name, username, photo and whether you are online) is visible to other signed-in Kuruvi users so they can find and message you, as are marketplace listings.
• Signed-in access: the app's server functions check who is calling, refuse signed-out and revoked sessions, ask you to sign in again before sensitive actions, and most also require Firebase App Check. The website chat widget is the exception: it lets visitors who are not signed in message a business.
• Rate limiting is enabled on sensitive and costly endpoints to prevent abuse.
• Access records of who opened Shopify customer data or rental applications, and of administrator actions (section 2).
• Backups: our database has point-in-time recovery and daily backups.

To report a vulnerability, see our Security page.

12. California residents (CCPA/CPRA)

If you live in California, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know — request the categories and specific pieces of personal information we have collected about you in the past 12 months, along with how we use and share it.
• Right to delete — request deletion of personal information we have collected from you, subject to legal-retention exceptions.
• Right to correct — request that we correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" — Kuruvi does not sell or share personal information as those terms are defined under the CCPA/CPRA. We have nothing to opt you out of, but the right exists if our practices ever change.
• Right to limit use of sensitive personal information — you can ask us to restrict the use of sensitive categories (e.g. precise geolocation, account credentials) to what's strictly necessary to provide the Service.
• Right to non-discrimination — we won't deny you the Service, charge you more, or give you a worse experience for exercising any of these rights.

To exercise any California right, email privacy@kuruvi.com with "California rights request" in the subject. We verify the request by confirming control of the account email and respond within the time in section 9, which is shorter than the 45 days (extendable by 45 with notice) that California law allows. Authorised agents may submit requests on your behalf with written permission.

13. Who can use Kuruvi, and children's data

Accounts. Kuruvi is for businesses. To create an account you must be at least 18 and able to enter into a contract, as our Terms require. We do not knowingly let anyone under 18 hold an account; if you believe someone under 18 has one, contact privacy@kuruvi.com and we will close it and delete its data.

People who message a business. Businesses use Kuruvi to talk with their own customers, and those customers can include children. The business decides what it collects from the people who message it and is responsible for that; Kuruvi processes those messages on the business's behalf. To have a child's messages removed, contact the business; you can also contact us at privacy@kuruvi.com.

14. Changes to this policy

We may update this policy occasionally. When we change what we collect, how we use it or who we share it with, we change the "Last updated" date at the top and, for material changes, notify you by email or in-app. A clarification that only adds to your rights keeps that date and is listed as a dated revision under it. Continued use of the Service after notice constitutes acceptance of the updated policy.

15. Contact

General privacy questions: privacy@kuruvi.com
Anything else: hello@kuruvi.com

Person in charge of the protection of personal information (including under Quebec's Law 25): Saminathan Palanivel, President, KURUVI LLC, privacy@kuruvi.com.

16. Shopify Protected Customer Data

This section sets out, specifically, how Kuruvi handles Protected Customer Data accessed through the Shopify API, in line with Shopify's Protected Customer Data requirements.

16.1 What Shopify data we access

When a merchant connects their Shopify store, Kuruvi accesses only the following customer and order data, and only to provide the Service:

• Customer name
• Customer email address
• Customer phone number
• Order history (order number, line items, totals)
• Order status (financial and fulfilment status, tracking)

We do not request or store full payment card numbers — payment data stays with Shopify and its payment processors.

16.2 How we use it

• Display beside customer messages — so a seller sees the relevant order context next to a conversation.
• Match customers across platforms — to link a Shopify customer to the same person's WhatsApp/Instagram/Messenger/email thread.
• Help sellers respond to inquiries — order details are shown as support context, and a few order fields go into an Order status draft when someone asks for one (section 6.1).

We do not use Shopify Protected Customer Data for advertising, profiling unrelated to the merchant's own customer service, or resale.

16.3 Data retention and deletion

• Uninstalling the app: Shopify sends Kuruvi a shop/redact request about 48 hours after a store uninstalls Kuruvi. Kuruvi then deletes that store's customers, orders, checkouts and order events.
• Disconnecting inside Kuruvi: deletes Kuruvi's access tokens for the store, so no new data is read, but keeps the customers and orders already synced until the app is uninstalled, the account is deleted, or the merchant asks us at privacy@kuruvi.com.
• Customer requests: Kuruvi handles Shopify's customers/data_request and customers/redact webhooks automatically. A redact request deletes that customer's Shopify customer and order records in Kuruvi; it does not delete conversations with that person on other channels, such as WhatsApp or email. In the app, a merchant can only hide those conversations, which does not erase them; to have them erased, the merchant asks us at privacy@kuruvi.com. For a data request, Kuruvi emails the store owner an export of that customer's data and keeps a copy of the export.

16.4 Data security

• Encrypted at rest using AES-256 (Google Cloud / Firestore default encryption), with Shopify access tokens additionally encrypted with Google Cloud KMS.
• Encrypted in transit using TLS.
• Access controls — Firebase App Check, per-merchant data isolation, and a record when someone opens Shopify customer or order data in the app, with who, when and the IP address.

16.5 Third-party sharing

Shopify Protected Customer Data is stored only with Google Firebase / Google Cloud (our infrastructure sub-processor, under Google's published data-processing terms — see section 5). It is never sold to third parties. The only other processing is the limited order context sent to AI providers when someone presses Order status in a conversation (section 6.1): the customer's first name and a small set of order fields, after the redaction described in section 6.4. When Shopify passes on a customer's data request, the export is emailed to the store owner through SendGrid (section 5).

If a seller turns on Translate incoming messages, the text of messages in a conversation is additionally sent to Google Cloud Translation to be translated — see section 6.3. Message text can contain whatever a customer wrote, including a name or an address. Order fields are not sent for translation, and translation is off unless the seller turns it on.

16.6 Merchant and customer rights

• Request deletion of their data at any time.
• Export their data.
• Contact us at hello@kuruvi.com for any Shopify data request.

16.7 GDPR & CCPA

Shopify Protected Customer Data is covered by the same GDPR rights and lawful bases set out in sections 3 and 9, and the CCPA/CPRA rights in section 12. Kuruvi acts as a data processor for this data on behalf of the merchant (the data controller).

17. SMS/text messaging

Businesses using Kuruvi send SMS/text messages to their own customers from their own phone number. Kuruvi is the software they send from — we do not message consumers on our own behalf.

17.1 Opt-in data and consent

SMS/text messaging opt-in data and consent will not be shared with third parties or used for marketing purposes unrelated to the services provided.

When someone opts in to SMS/text messages — by texting JOIN to a business number, by replying YES or START, or through the SMS updates page — we record their phone number, the business they consented to, the consent status and timestamp, and how consent was given. That record exists to prove and honour the consent, and for no other purpose.

17.2 Who can see it

Opt-in records are visible only to the business the consumer opted in to. They are stored with Google Firebase / Google Cloud (our infrastructure sub-processor, under Google's published data-processing terms — see section 5) and sent to Twilio only as needed to deliver or stop the messages the consumer asked for. They are never sold, never shared with other businesses using Kuruvi, and never used to build marketing or advertising audiences.

17.3 Stopping messages

Replying STOP to any message unsubscribes the consumer from that business immediately; replying HELP returns support contact details. We keep a record that consent was withdrawn, because honouring an opt-out requires remembering it. Message frequency varies by business, and message and data rates may apply.