Privacy Policy

Kuro Data AI ("Kuro AI", "we", "us" or "our") provides an AI-powered business intelligence platform for small and medium-sized businesses. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over it.

This policy applies to our website at kurodata.co and to the Kuro AI application and related services (together, the "Service"). By using the Service you agree to the practices described here.

We collect the following categories of information:

• Account information — your name, email address, company name and the details you provide when you register or contact us.
• Business content you connect — when you link tools such as Gmail, Outlook, Google Drive, Microsoft OneDrive, Excel spreadsheets and PDF documents, we process the content of those sources so the Service can answer your questions and generate insights.
• Usage data — information about how you interact with the Service, such as features used, requests made and general diagnostic and performance data.
• Payment information — subscriptions are processed by our payment provider, Stripe. We do not store your full card details on our systems.
• Communications — messages you send us through our contact and waitlist forms (handled by our form provider) or by email.

We use your information to:

• Provide, operate and maintain the Service, including our multi-agent AI system that answers questions and produces insights from your connected data.
• Process transactions and manage your subscription.
• Provide customer support and respond to your enquiries.
• Monitor, secure and improve the performance and reliability of the Service.
• Comply with our legal obligations.

We rely on a lawful basis for each use, including performance of our contract with you, your consent, our legitimate interests in operating and improving the Service, and compliance with legal obligations.

Your business data is never used to train our AI models or those of any third party. We process your data only to provide you with insights and to operate the Service on your behalf.

The Service uses strict per-business data isolation, so your information is kept separate from that of other customers.

Profiling is your choice. You decide whether our AI profiles you — you can opt in, or remain completely un-profiled.

We do not sell your personal data. We share information only in the following limited circumstances:

• Service providers — trusted third parties who help us run the Service, such as our cloud infrastructure provider, our payment processor (Stripe), our AI model providers and our form-handling provider. They may only process data on our instructions.
• Legal and safety — where required by law, regulation, legal process or enforceable governmental request, or to protect the rights, property or safety of Kuro AI, our users or others.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to the protections in this policy.
• With your consent — where you have asked us to share information, for example when you connect a third-party integration.

All of your data is stored and processed in the European Union and the United Kingdom.

We protect your data with enterprise-grade safeguards, including AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access control, multi-factor authentication, continuous security monitoring and audit trails. Our security controls are designed to SOC 2 Type II and ISO 27001 standards.

Because we store and process data in the EU and UK, most processing takes place within those regions. Where any transfer outside the EU or UK is necessary — for example to a sub-processor — we put appropriate safeguards in place, such as standard contractual clauses, to ensure your data remains protected.

We retain your personal data for as long as your account is active or as needed to provide the Service. You can export or delete your data at any time.

When you ask us to delete your data, or when it is no longer required, we remove it from our systems, subject to any legal obligation to retain certain records.

Under the UK GDPR and EU GDPR you have the right to:

• Access the personal data we hold about you.
• Request rectification of inaccurate or incomplete data.
• Request erasure of your data (the right to be forgotten).
• Receive your data in a portable format.
• Restrict how we process your data.
• Object to certain processing, including profiling.
• Withdraw consent at any time where processing is based on consent.

If you are located in California, you have additional rights under the CCPA, including the right to know what personal information we collect and the right to request its deletion. We do not sell personal information.

To exercise any of these rights, contact us at info@kurodata.co. You also have the right to lodge a complaint with your local data protection authority.

Our website uses a limited number of cookies and similar technologies to operate the site, remember your preferences and understand how the site is used. You can control cookies through your browser settings.

When you connect a third-party service such as Google or Microsoft, that service is governed by its own terms and privacy policy. We access only the data needed to provide the Service, and you can revoke our access at any time from your account or from the third-party provider.

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the Service.

If you have any questions about this Privacy Policy or how we handle your data, contact us at info@kurodata.co.