Privacy Policy

Last updated: October 17, 2026

This policy explains how Kovet ("we", "us") collects, uses, and protects personal data across kovet.ai, our products, and our services. Questions or requests: [email protected] — that address reaches our privacy contact.

1. What we collect, and why

• Enquiries and free tools — your name, email, company, and what you send us, so we can reply and provide the tool or report you asked for. Lawful basis: your consent, and our legitimate interest in answering enquiries.
• Newsletters and communities — your email and engagement with what we send, on the basis of your subscription consent. Every email carries a one-click unsubscribe.
• Accounts and paid services — account and business details needed to provide the service (contract). Payments are handled by Shopify, Stripe, or Whop: we never receive or store your card number.
• Data we process for our customers — for example, a merchant's store data inside Kovet SCM. There we act as a processor on the customer's instructions; see section 6.
• Server and security logs — IP address, browser details, and timestamps, kept to secure and operate the service (legitimate interests), retained for 12 months.

2. Cookies and tracking

kovet.ai sets no non-essential cookies and runs no advertising or analytics trackers. If that ever changes, we will update this policy first and ask for consent where the law requires it.

3. How we use personal data

To provide the product or service you asked for, to communicate with you about it, to keep our systems secure, and — only where you have subscribed or enquired — to tell you about our products. We never sell personal data, and customer data is never used to train AI models.

4. Who we share it with

A short list of service providers who process data on our behalf under contract: our hosting provider, Google (email and workspace), and the payment and platform providers named above. We may disclose data where the law compels it. Nothing is shared with third parties for their own marketing.

5. International transfers

Our systems are hosted in the United States. Where European or UK personal data is transferred to us, we rely on the European Commission's Standard Contractual Clauses (and the UK equivalent) where an adequacy decision does not apply.

6. Kovet SCM and merchant data

For Kovet SCM, merchants are the controller of their store data and Kovet is the processor. The SCM-specific policy is at scm.kovet.ai/privacy, and our Data Processing Addendum (GDPR Article 28 terms, including the Standard Contractual Clauses) is available to merchants on request at [email protected]. If a merchant connects their own OpenAI or Anthropic key inside SCM, that provider processes data under the merchant's own account, at the merchant's direction.

7. Retention

Account data is kept for the life of the account plus 12 months. Enquiries are kept until resolved, plus 12 months. Security logs are kept 12 months. Product-specific retention (for example, call recordings and engagement files) is stated in the relevant product terms, and deletion requests are honoured at any time under section 8.

8. Your rights

Under the GDPR and UK GDPR you may: access your data; have it corrected; have it erased; restrict or object to its processing; receive it in a portable format; and withdraw consent at any time. Email [email protected] and we will respond within one month. You may also complain to your local data protection authority (in the UK, the ICO). California residents: we do not sell or share personal information as those terms are defined in the CCPA/CPRA, and the rights above are extended to you on request.

9. Changes

We may update this policy; the date at the top will change and material changes will be noted here.