Privacy Policy

When you register for, trial, or purchase KChat services, we collect:

• Company or business name, industry, and size
• Your name, job title, and business email address
• Phone number and preferred contact method
• Billing address, invoicing contact, and payment details (processed via secure third-party payment gateways; card data is not stored on our servers)
• Account credentials (username / hashed password)
• Support and onboarding preferences

As a CCaaS provider, KChat processes data on behalf of our business customers ("Clients") when their end-customers ("End Users") interact through the KChat platform. This includes:

• Chat transcripts, WhatsApp messages, email threads, Instagram DMs, and call logs routed through the KChat inbox
• Voice recordings (where enabled by the Client and disclosed to End Users)
• Ticket details, notes, and case history
• Contact details supplied by End Users during a support interaction (name, phone number, email)
• Sentiment and satisfaction scores generated by AI analysis
• Agent performance metrics and response-time data

When acting as a data processor for our Clients, we handle End User data strictly according to our Data Processing Agreement (DPA) and the Client's instructions. Clients are the data controllers responsible for ensuring lawful processing of their End Users' data.

We operate an AI-powered assistant available through the OpenAI ChatGPT platform (our "ChatGPT App"). When you interact with this assistant — for example, to ask questions about KChat features, pricing, integrations, or customer support best practices — we may receive and process:

• The text you submit (queries, follow-up messages, uploaded documents or snippets)
• AI-generated responses produced in reply to your queries
• Session metadata (timestamp, session ID)

Your inputs are also processed by OpenAI, LP in accordance with OpenAI's own Privacy Policy (openai.com/policies/privacy-policy). We do not permanently store conversational data from the ChatGPT App unless it is necessary for customer support follow-up, security investigations, or legal compliance. Do not submit sensitive personal information — such as government ID numbers, financial account numbers, or health information — through the ChatGPT App.

When you visit kchat.live or kasookoo.com, we may automatically collect:

• IP address and approximate geolocation (country/city level)
• Browser type, version, and language setting
• Device type and operating system
• Pages visited, referral URL, and time spent on site
• Date and time of visits
• Cookies, pixels, and similar tracking technologies (see Section 3)

If you email us, submit a contact form, schedule a demo via kchat.live/book-demo, or communicate with us on LinkedIn or other channels, we collect the content of those communications and any contact details you provide.

Under UK GDPR, we process personal data under one or more of the following lawful bases:

• Contract performance: to provide, manage, and support the KChat platform and related services you have subscribed to.
• Legitimate interests: to improve our products, prevent fraud, conduct marketing to business contacts, and protect our legal rights — where our interests are not overridden by your rights.
• Legal obligation: to comply with applicable laws, including tax, accounting, anti-money-laundering, and data-protection regulations.
• Consent: where we rely on your freely given, specific, informed consent — for example, for newsletter subscriptions or marketing cookies. You may withdraw consent at any time.

Specifically, we use your information to:

• Provision and operate the KChat platform, including AI-assisted inbox, call management, ticketing, analytics, and reporting features
• Authenticate users and manage account security
• Process subscriptions, invoices, and payments
• Respond to support requests, demo bookings, and sales enquiries
• Provide AI-powered assistance through our ChatGPT App for product enquiries
• Send transactional notifications (invoices, downtime alerts, security notifications)
• Send newsletters, product updates, and marketing communications (with consent or under legitimate interest where permitted by law — with an easy opt-out in every message)
• Conduct analytics to understand usage patterns and improve the platform
• Ensure security, prevent unauthorised access, and detect fraud
• Comply with legal and regulatory obligations under UK law, NDPR, POPIA, Kenya DPA, and other applicable legislation
• Transfer or disclose data where required in connection with a merger, acquisition, or sale of the business

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

Our websites use cookies and similar technologies to improve functionality, remember preferences, and understand how visitors interact with our content. We use Google Analytics to analyse website traffic; you may opt out using the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).

We may also use marketing cookies (e.g., LinkedIn Insight Tag, Meta Pixel) to measure the effectiveness of our advertising campaigns. Where required by law (including UK PECR), we obtain your consent before placing non-essential cookies via our cookie consent banner.

You can manage or withdraw your cookie consent at any time through our cookie preference centre or by adjusting your browser settings. Note that disabling cookies may affect some website features.

We do not sell or rent personal information. We may share data with the following categories of trusted third parties, who are contractually bound to process data only on our documented instructions:

• Cloud hosting & infrastructure: Our platform is hosted on major cloud providers (such as AWS or equivalent) with data centres in the UK and/or EEA.
• AI platform – OpenAI: Inputs submitted through our ChatGPT App are processed by OpenAI, LP under OpenAI's terms and privacy policy.
• CRM & helpdesk integrations: KChat integrates with Zoho CRM, Zoho Desk, Salesforce, and Freshdesk. Data flows between these systems only under Client instruction and configuration.
• Payment processors: We use PCI-DSS-compliant payment gateway providers to process subscription payments.
• Email & communication platforms: We use transactional email services for notifications and newsletters.
• Analytics providers: Google Analytics and similar tools receive anonymised/pseudonymised usage data.
• Scheduling & booking tools: Zoho Bookings is used for demo scheduling; relevant contact details are shared accordingly.
• Professional advisers: Legal, accounting, and auditing firms, under duties of confidentiality.
• Regulatory & law enforcement authorities: Where required by applicable law, court order, or to protect our rights, safety, or property.

Yuave Limited is headquartered in the United Kingdom. We serve customers across Africa (including Nigeria, South Africa, Kenya, Côte d'Ivoire, Benin, and the Democratic Republic of Congo), the Middle East, Canada, and other regions. Your data may be transferred to and processed in countries outside your country of residence — including the United Kingdom, the European Economic Area, and the United States (e.g., via OpenAI's infrastructure).

Where we transfer personal data internationally, we rely on appropriate safeguards, including:

• UK International Data Transfer Agreements (IDTAs) or equivalent Standard Contractual Clauses
• Adequacy decisions by the UK Information Commissioner's Office (ICO)
• Binding Corporate Rules or other legally recognised transfer mechanisms

For transfers to and from African jurisdictions, we also seek to respect the NDPR's cross-border transfer provisions (Nigeria), POPIA's operator and transborder flow requirements (South Africa), and Kenya DPA's equivalent provisions. You may request details of the safeguards applicable to your specific transfer by contacting help@kasookoo.com.

We retain personal information only as long as necessary to fulfil the purposes described in this policy and to comply with our legal obligations. Indicative retention periods are:

• Customer account & contract data: Duration of the subscription plus 7 years for tax and legal compliance (UK statutory requirement).
• Support ticket & contact data: 3 years from ticket closure or last contact, unless a longer period is required for ongoing legal proceedings.
• Voice call recordings: Up to 6 months, unless the Client configures a longer retention period within the platform (Clients are responsible for ensuring their retention meets applicable law).
• Chat & messaging transcripts: Up to 12 months by default on our infrastructure; Clients may configure longer periods within their account.
• Demo booking & CRM lead data: 2 years from the date of last meaningful contact.
• Email marketing data: Until you unsubscribe or withdraw consent.
• Cookie & analytics data: As defined by provider settings (Google Analytics default: 14 months).
• ChatGPT App conversational data: Up to 30 days on our systems, unless required longer for security investigation or legal compliance. OpenAI's own retention applies to data processed on their infrastructure.
• Financial & invoicing records: 7 years in accordance with UK Companies Act and HMRC requirements.

When personal data is no longer required, we securely delete or irreversibly anonymise it.

We implement appropriate technical and organisational security measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. Our measures include:

• TLS/SSL encryption for all data in transit
• Encryption at rest for stored data on our cloud infrastructure
• Role-based access controls and multi-factor authentication for platform users
• Regular vulnerability assessments and security testing
• Incident response procedures aligned with UK GDPR Article 33 notification requirements (72-hour notification to the ICO in the event of a qualifying breach)
• Staff training on data protection and security awareness

No method of electronic transmission or storage is completely secure. While we strive to apply commercially reasonable protections, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you as required by law.

Depending on your location, you may have the following rights in respect of your personal data:

• Right of access (UK GDPR Art. 15 / NDPR / POPIA s.23): Request a copy of the personal data we hold about you.
• Right to rectification (UK GDPR Art. 16): Request correction of inaccurate or incomplete information.
• Right to erasure / 'right to be forgotten' (UK GDPR Art. 17): Request deletion of your personal data in certain circumstances.
• Right to restrict processing (UK GDPR Art. 18): Ask us to pause processing of your data in specific situations.
• Right to data portability (UK GDPR Art. 20): Receive your data in a machine-readable format.
• Right to object (UK GDPR Art. 21): Object to processing based on legitimate interests, including direct marketing.
• Right not to be subject to automated decision-making (UK GDPR Art. 22): Not to be subject solely to automated decisions that significantly affect you.
• Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.
• ChatGPT App conversational data: Request deletion of any conversational data held from your use of our ChatGPT App.

To exercise any of these rights, contact us at help@kasookoo.com. We will respond within 30 days (or within 72 hours for NDPR-related breach notifications in Nigeria). We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with your relevant supervisory authority. In the UK: the Information Commissioner's Office (ico.org.uk). In Nigeria: the Nigeria Data Protection Commission (ndpc.gov.ng). In South Africa: the Information Regulator (justice.gov.za/inforeg). In Kenya: the Office of the Data Protection Commissioner (odpc.go.ke).

KChat is a business-to-business (B2B) platform. Our services and the kchat.live website are directed at business professionals and organisations, not at children under the age of 16 (or under 18 in jurisdictions where that threshold applies). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at help@kasookoo.com and we will delete it promptly.

Our website and the KChat platform may contain links to third-party websites or services (including OpenAI, Zoho, Salesforce, Freshdesk, WhatsApp Business API, Instagram, and others). We are not responsible for the privacy practices or content of those external services. We encourage you to review their privacy policies before providing personal information.

We may update this Privacy Policy periodically to reflect changes to our practices, legal requirements, or new product features. We will post the revised policy on this page with an updated effective date. For material changes, we will provide reasonable notice — for example, by email to registered Clients or via an in-platform notification. Continued use of our services after changes are posted constitutes acceptance of the revised policy.

For any privacy-related questions, data subject rights requests, or concerns, please contact:

• Company: Yuave Limited (trading as Kasookoo / KChat)
• Registered address: 4th Floor Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom
• Privacy enquiries: help@kasookoo.com
• General enquiries: sales@kasookoo.com
• Websites: www.kasookoo.com | www.kasookoo.ai | kchat.live

We aim to acknowledge all privacy enquiries within 2 business days and to provide a full response within 30 calendar days.