Privacy Policy
Last updated: 2026-10-11
This policy explains what KumoBuilder collects, why, who else handles it, how long it is kept, and what you can do about it. It describes what the software actually does — if something here stops being true, the policy is wrong and we will fix it.
KumoBuilder is provided by [COMPANY LEGAL NAME], [REGISTERED ADDRESS] (“we”, “us”). Questions: hello@kumobuilder.com.
Who this covers, and our role
Three kinds of people, treated differently:
- Account holders — business owners and their team members who sign up. For your account data we are the controller.
- Your customers — people who message a business through WhatsApp, Telegram, Instagram, Messenger or web chat, or use a website a business built with KumoBuilder. Their data belongs to that business, which is the controller; we are its processor and handle it only to provide the service the business uses. If you are such a customer, contact the business first.
- Visitors to kumobuilder.com, for the little we collect (a contact-form message, an affiliate link you arrived through).
What we collect
Your account
- Name, email address and password (the password is handled by our sign-in provider and never stored or logged by us). Optionally a company name, phone number and profile photo.
- If you use “Continue with Google”: the name, email and photo your Google account shares.
- Security records: sign-in attempts (email, IP address, browser, outcome), your active sessions (browser and IP address), email verification and password-reset requests, and your two-factor settings (the authenticator secret is encrypted; codes are stored only as hashes).
- Notification preferences and quiet hours, and the in-app notifications you receive.
- Team invitations you send (the invitee’s email).
- When you agreed to these policies, which version, and that you confirmed your age.
Payments
- Your plan, your AI usage, and for each payment: the amount, method, the reference your bank gave you and a photo of the receipt you upload. We do not collect card numbers.
- If you join the affiliate program: the payout details you enter (bank or wallet).
Your workspace
- What you put in: knowledge documents (we keep the extracted text; the original file is discarded), products and photos, imported links, automations, websites and their files, mobile app listings.
- Credentials you connect: messaging channel tokens, Google Search Console access, app store credentials — all encrypted before they are stored.
- Your website builder conversations and your Ask AI questions.
Your customers (processed for you)
- Their name or handle, platform identifier (for WhatsApp this is their phone number), messages, photos, voice notes and files, and transcripts of voice notes.
- A rolling summary of each conversation, and a few facts that should outlive one conversation (for example their language preference). The system refuses to store card numbers, national IDs or passwords this way.
- Orders, bookings and other records, which can include a name, phone number, address and notes.
- On websites built here: form submissions, and visit statistics — page, referring site, device type, country, and a visitor code made from the IP address and browser that changes every day and cannot be reversed. No visitor cookies are set.
Visitors
- If you use the contact form: your name, email, company, topic, message, and your IP address and browser.
- If you arrive through an affiliate link and allow marketing cookies: the affiliate code, the page you landed on and the referring site.
What we do not collect
No advertising or analytics trackers, no precise location, no device fingerprinting, and no card numbers. We do not send text messages.
Why, and our legal basis
Under the EU and UK GDPR, every use needs a legal basis (Article 6). Ours:
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in, running the workspace, AI replies, the website builder, hosting your sites, sending messages to your customers | Contract — Art. 6(1)(b) |
| Account and security emails (codes, resets, invitations, alerts you have switched on) | Contract — Art. 6(1)(b) |
| Rate limiting, bot checks, sign-in and session records, audit logs, fraud and abuse prevention | Legitimate interests in keeping accounts and the service secure — Art. 6(1)(f) |
| Payment records and receipts | Contract, and legal obligations to keep financial records — Art. 6(1)(b) and (c) |
| Answering contact-form messages | Legitimate interests, or steps before a contract you asked for — Art. 6(1)(f) / (b) |
| Remembering the affiliate who referred you; optional browser caches | Your consent — Art. 6(1)(a), given in the cookie banner and withdrawable any time |
| Processing your customers’ data | On your instructions as our customer, under Article 28; you choose the legal basis for it |
We do not use your data, or your customers’, to train AI models, and we do not sell it.
How AI is used
AI drafts and sends replies to your customers, summarises conversations, reads documents, images and voice notes, finds the right knowledge to answer from, builds websites, and answers your questions in Ask AI. To do this, the content involved is sent to OpenAI in the United States: the customer’s message and recent conversation, the knowledge and product details relevant to it, the facts remembered about that customer, images and voice notes they sent, text from uploaded documents, and for the website builder your instructions, business details, the site’s files and screenshots of it.
OpenAI’s API terms say it does not train on data sent through its API by default; see OpenAI’s data commitments. We also send OpenAI operational traces of the reply agent (which tools ran and how long they took), with message content excluded.
AI output can be wrong. A customer can ask for a person, and you can take any conversation over from the inbox. Automations only ever notify your team; they cannot message your customers.
International transfers
Our database is in the EU (Frankfurt). Our API runs in the United States, and OpenAI, Resend and Google are in the United States; Cloudflare, Meta and Telegram operate globally. So your data is processed outside the EEA and the UK.
For these transfers we rely on [TRANSFER MECHANISM — e.g. the EU Standard Contractual Clauses and UK Addendum in each provider’s data processing agreement, or the EU–US Data Privacy Framework where the provider is certified]. Ask us for a copy.
How long we keep it
- Your account and workspace: while they exist. When a workspace is deleted (seven days after you ask), everything in it is deleted, including files, websites and every member’s account.
- Your own account: deleted seven days after you ask (Settings → Profile). What you did inside the workspace stays with the business.
- Verification codes, reset links, two-factor codes and pending sign-ins: deleted one day after they expire.
- Sign-in attempts: 90 days.
- Read notifications: 30 days.
- Payment records: while the workspace exists. [CONFIRM ANY LONGER STATUTORY RETENTION FOR FINANCIAL RECORDS]
- Contact-form messages: until we have dealt with them and delete them.
- Operator audit records (who changed what on an account): kept after a workspace is deleted, for accountability.
- Server logs (no IP addresses or content): as long as our host keeps them.
- Backups: our database provider keeps backups on its own schedule; deleted data leaves them as they expire.
Security
- HTTPS everywhere, with HTTP redirected and HSTS.
- Each workspace’s data is separated at the database (row-level security) and again in every query, and tested.
- Passwords are handled only by our sign-in provider. Sign-in is rate limited and locks after repeated failures; sign-up has a bot check.
- Two-factor authentication is available. Channel tokens, two-factor secrets, Google tokens and app store credentials are encrypted before storage; codes and links are stored only as hashes.
- Files are kept in private storage and shared only through short-lived links.
We hold no security certification (such as SOC 2 or ISO 27001). No system is perfectly secure. If we learn of a breach affecting your data, we will tell you and the authorities as the law requires.
Your rights
You can, at any time:
- Access and take your data: Settings → Profile → Download my data (a JSON file of your personal data); owners and admins can export the whole workspace from Settings → Danger zone.
- Correct it: in your profile and workspace settings, or ask us.
- Delete it: Settings → Profile → Delete my account, or the whole workspace from Settings → Danger zone. A workspace on a paid plan can be deleted once its paid month ends; contact us to delete sooner.
- Object or restrict: to processing based on legitimate interests — write to us.
- Withdraw consent: , or the link in our footer. Withdrawing does not affect what was done before.
- Stop optional emails: emails about customers asking for a person, the assistant pausing, payments, and the daily summary each have a one-click unsubscribe link, and a switch in Settings → Notifications. Alerts about new orders, bookings and suggested pages go to owners and admins as part of running the workspace; alerts from automations stop when you switch the automation off. Account and security emails cannot be turned off.
- Complain to a data protection authority — in the EU your local one, in the UK the ICO. Our lead authority: [LEAD SUPERVISORY AUTHORITY].
For anything else, email hello@kumobuilder.com. We answer within one month. If you are a customer of a business that uses KumoBuilder, your request goes to that business; we will help it answer.
EU representative: [EU / UK REPRESENTATIVE, IF REQUIRED]. Data protection officer: [DPO, IF APPOINTED].
California (CCPA / CPRA)
In the last 12 months we collected the categories described in “What we collect”: identifiers (name, email, IP address, platform IDs), commercial information (plans, payments), internet activity (sign-in and session records, website visit statistics), audio (voice notes), and the content of communications — for the purposes in “Why”.
We do not sell or share personal information, as those words are defined in the CCPA, and we do not use sensitive personal information to infer characteristics. We honour Global Privacy Control signals. You have the right to know, delete and correct your information, and not to be discriminated against for using these rights. Use the tools above or email hello@kumobuilder.com; an authorised agent may act for you.
Children
KumoBuilder is for businesses. You must be 18 or older to create an account, and you confirm this when you sign up. If we learn an account belongs to someone younger, we delete it. Businesses must not use KumoBuilder to collect data from children in breach of the law.
Changes
When this policy changes we update the date at the top. If a change matters — new kinds of data, a new provider, a new purpose — we email account holders before it takes effect.
Contact
[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Email hello@kumobuilder.com. For a security problem, use the subject line “Security issue”.