Scope and responsibilities
This policy covers the KivoHelp website, dashboard, embedded customer assistant, public website scanning, and ticket portal. A business that installs an assistant decides which sources it adds, which websites it scans, and how it uses visitor conversations. That business is responsible for lawful collection, a suitable visitor notice, and responding to requests about its own customer data. KivoHelp processes workspace information to provide the service; the operator is responsible for KivoHelp account and service administration.
Information processed
- Account and workspace details: account identity, email, display name, profile image, membership, business contact email, settings, billing and access records, and assistant configuration. Supabase Auth handles passwords and account sessions.
- Knowledge: uploaded documents and extracted text, manual sources, scanned public page text, page titles and URLs, scan status and timestamps, and the index used to retrieve relevant excerpts. Raw uploaded files are not publicly browsable. Relevant indexed excerpts may be quoted in visitor replies and citations, so upload only business information you intend to share with visitors.
- Assistant conversations: visitor messages, replies, bounded conversation history, source citations, and essential conversation/session identifiers. The widget may send the current website origin and path to match a scanned product page; it omits query parameters and fragments and does not read the host page DOM, cookies, or private business APIs.
- Support: ticket name, email, subject, messages, portal verification data, delivery status, and support correspondence. Ticket content is not automatically sent to AI. Starter business email links open your own email application; what you send is handled by the business and its email provider.
- Technical information: essential request and security data, session cookies, and provider operational logs needed to host, secure, and troubleshoot the service.
Use and model processing
We use information to provide accounts, enforce workspace access and quotas, store and index sources, generate replies, operate support, and protect reliability and security. Questions, bounded recent conversation history, and relevant source excerpts are sent to the assigned model. Depending on configuration, this uses OpenRouter and its downstream model provider, or an operator-hosted Qwen model running on the operator's PC through an authenticated ngrok connection. Public availability questions may trigger a fresh, limited fetch of a matching public product page. Public pages are untrusted reference data and are not an authoritative inventory feed.
KivoHelp does not use customer content to train its own models. External providers' retention, training, and processing policies apply to data they receive; we do not promise that every downstream provider has identical practices. Avoid submitting passwords, payment card details, health information, government identifiers, or other sensitive personal information to an assistant or source library.
Providers and international processing
Supabase provides authentication, database, and private storage; the current project is in Singapore. Vercel hosts the website and server routes. OpenRouter and downstream providers process cloud model requests. ngrok carries traffic to the operator-hosted model in Bangladesh when that model is assigned. Brevo delivers transactional account or ticket emails when configured. Configured checkout providers process payment information through their checkout. These providers may process information in other countries under their own policies. Using a workspace can involve cross-border processing. We use practical access controls and limited context, but cannot guarantee that any online service is risk-free.
Essential storage and retention
KivoHelp uses essential account/session cookies. The embedded widget stores an anonymous random visitor identifier in localStorage on the visitor's website origin, with expiry within two UTC days, and uses sessionStorage as a fallback. It also uses sessionStorage on that origin to keep a bounded history and an anonymous session identifier in the same browser tab; it does not store provider credentials or authenticated dashboard tokens. New chat and Clear on this device reset that local history and start a new conversation. These controls do not delete the business's server conversation records. Each conversation has a 30-message allowance; New chat starts a fresh conversation. Separate workspace-scoped keyed hashes for visitor and, on trusted hosting requests, network abuse limits help prevent rapid resets and request floods; raw IP addresses are not stored in these limit tables. Short-lived abuse rows are removed after their active window when the workspace makes further requests. Anonymous identities and shared networks cannot prove a unique person and may affect visitors sharing a network. We do not use advertising trackers or sell visitor data for advertising.
Account, source, conversation, and ticket records are retained as needed to operate the workspace, handle support, prevent misuse, and meet legal obligations. Operational backups and provider logs may retain copies for their own necessary periods. There is no promised fixed automatic deletion deadline. Administrators can remove individual sources; deletion and access requests for other records are handled through contact and identity verification.
Your rights and contact
Contact the business operating the assistant about its conversations and support records. You may also ask KivoHelp for access, correction, deletion, or information about processing at nihalstar1000@gmail.com. Include enough information to identify the workspace or conversation without sending passwords. Depending on applicable law, you may have additional rights, including objection, restriction, portability, withdrawal of consent where consent is the basis, or a complaint to an appropriate regulator. We consider requests under applicable law and may verify identity or explain lawful retention requirements.
Policy changes
The effective date identifies this version. Material changes will be reflected on this page and communicated where required by applicable law.
Website updates and conversation insights
Workspace owners may enable weekly public website updates or request a manual sync. Imported pages remain subject to permissions, website rules and bounded scanning. Manual edits pause automatic replacement until an administrator explicitly allows fresh website text.
Owners and administrators can review unanswered business questions and ratings of saved replies. These insights are associated with the workspace and conversation. Missing questions may be used to add business knowledge; automated classification is imperfect. Visitors can change or remove their reply rating.
Optional inquiry collection is off by default. When enabled, a visitor may explicitly submit their name, email, optional phone, inquiry and consent to business follow-up. These form details are stored for the business separately from AI chat and are not automatically passed to the model or used to send marketing email. Inquiry submission does not book a service, place an order or guarantee a response. Workspace administrators can change inquiry status or delete its contact record. Contact the business to withdraw follow-up consent or request deletion.