Privacy Policy
Last updated: August 2026 · Beta draft — legal review before paid launch
1. Who We Are & What We Process
Kuvo AI is provided by MOAAYD MOHAMMEDMAHMOU M ALSHANQITI, an independent professional licensed under Saudi Freelance Certificate no. FL-143060777, trading as “Kuvo AI”. We process two categories of data: Customer (business) data — account details, billing, and knowledge-base content; and your customers’ data — conversation content, WhatsApp numbers or website identifiers, voice notes and their transcripts, and names where provided. For end-customer data, the business is the data controller and we act as its processor under the Data Processing Agreement.
2. Why We Process It (Legal Bases)
We process data to perform the contract (operating the Service and answering customers), for legitimate interests (quality, abuse prevention, security), for legal obligations (billing and records), and with consent where required by the Saudi PDPL or the GDPR.
3. Where Data Lives
The database is hosted with Supabase in Singapore (ap-southeast-1). Replies are generated by OpenAI in the United States, and WhatsApp messages pass through Meta’s servers outside the Kingdom. These are cross-border transfers, made as strictly necessary to perform the contract. If your business is subject to in-Kingdom data-residency requirements, contact us before subscribing.
4. Sub-processors
These are the only parties that receive personal data from us:
| Recipient | Purpose | Location |
|---|---|---|
| Meta Platforms (WhatsApp Business Cloud API) | Delivering and receiving WhatsApp messages | United States / Ireland |
| Supabase | Database and authentication | Singapore (ap-southeast-1) |
| OpenAI | Reply generation, embeddings, and voice-note transcription | United States |
| Resend | Sending email alerts to the business owner when a conversation is handed over | Japan (ap-northeast-1) |
| Tap Payments | Payment and subscription processing | Kingdom of Saudi Arabia / GCC |
| Sentry | Error monitoring | United States |
Your data is never shared with anyone else and never sold. We do not use your content to train general-purpose AI models, and our providers are contractually held to the same.
5. Retention & Deletion
Account data is retained for the life of the subscription. On account closure, data is deleted within 30 days, except records we must keep by law (billing). You can delete any knowledge source from the dashboard, and deletion includes the indexed copies used for search.
To delete your account entirely or export your data, email privacy@aikuvo.com and we will action it within 30 days.
6. Your Rights
You — and your business’s customers — have the right to access, correct, delete, port, and object to processing. Send requests to privacy@aikuvo.com; we respond within 30 days. If you are an end customer of a business using Kuvo, we will route your request to the controlling business and follow its instructions.
7. Cookies
We use strictly necessary cookies only: one for your login session, and one to remember your chosen language. We do not use advertising or tracking cookies, and we share nothing with ad networks.
8. Security
Data is encrypted in transit (TLS) and at rest, with strict tenant isolation enforced at the database level (RLS). If a breach affects your data, we will notify you and the competent authorities as required by law.
Contact: privacy@aikuvo.com · Beta draft; final version before the first paid subscription.