Privacy Policy

1. Information We Collect

We collect the following categories of information depending on how you interact with our service:

Account Data

When you sign up, we receive your name, email address, profile image, and organisation membership details.

Support Ticket Data

Tickets submitted by your customers include sender email, name, subject, and message content. When you connect an email account via IMAP, we access incoming email to create tickets.

Widget Data

End-users interacting with the Keva chat widget may provide their email, name, message content, and browser locale.

Platform Access Data

If you connect platform connectors (WordPress, Shopify, Vercel, Railway, Supabase), we store encrypted API credentials and access data necessary to perform actions on your behalf.

Analytics & Feedback

We collect CSAT survey responses, customer health scores, sentiment analysis results, and A/B experiment assignments.

Audit Logs

We log administrative actions including the user, action type, IP address, and user agent for security and compliance.

Device Information

Keva has no publicly released iOS app and no proved push-notification delivery. The deferred source preview includes device-token registration code, but it is not a current live collection channel.

Billing Data

Payment processing is handled entirely by Stripe. We store your Stripe customer ID, subscription status, and usage records — but never your credit card number or bank details.

2. How We Use Your Information

We use your information to:

• Classify support tickets using AI (category, sentiment, priority, confidence)
• Generate AI-powered responses and suggested replies
• Execute platform actions on connected services (e.g. updating a Shopify product)
• Send notifications via email, Slack, or Microsoft Teams
• Process billing and track usage against your subscription plan
• Deliver and analyse CSAT surveys
• Provide analytics dashboards, health scoring, and reports
• Run A/B experiments to improve AI response quality
• Evaluate and execute automation rules you configure
• Maintain audit trails for compliance
• Improve and develop the service

3. AI Processing & Automated Decision-Making

Keva uses artificial intelligence to process support tickets. You should be aware of the following:

AI Providers

• Anthropic Claude — Full ticket content is sent for classification, response generation, and browser agent analysis (accessibility trees and screenshots).
• Voyage AI — Ticket text and knowledge base content are sent for vector embedding generation used in semantic search.
• OpenAI / Google — May be used as fallback providers if configured.

Your Controls

You have meaningful control over AI behaviour. You can set confidence thresholds below which AI responses require human approval, configure triage rules to escalate certain ticket categories, and require explicit approval for all AI-generated responses before they are sent to customers. Platform actions (e.g. modifying a Shopify product) always include diff previews and can require approval.

4. Third-Party Services

We share data with the following third-party service providers to operate Keva:

5. Cookies & Tracking

Essential Cookies

• Session cookies — Required for authentication.
• keva_workspace_id — Stores your active workspace selection.
• NEXT_LOCALE — Stores your language preference.

Functional Storage

• Theme preference — Stored in localStorage (light/dark/system).

Monitoring & Planned Analytics

Sentry telemetry and Browser Session Replay are disabled. PostHog and Google Analytics are planned and are not currently enabled. We will update this policy and provide any required consent controls before enabling additional analytics or Replay.

6. Data Storage & Security

• Application data is stored in PostgreSQL. The configured hosting provider, region, residency, backup, and deletion behavior require current deployment verification.
• Selected application credential envelopes created by current source paths use AES-256-GCM with per-encryption initialisation vectors and authentication tags. Ordinary support content is not application-encrypted by that helper; complete encrypted-store, provider, backup, and deployed coverage remains under verification.
• Public application URLs are intended to use HTTPS/TLS. Configured service-to-service, database, provider, and deployed transport coverage requires current verification.
• Tenant-scoping and selected workspace guards exist across audited product paths; full route and database isolation remains under readiness verification.
• Organisation roles and granular permissions are enforced on mapped product paths. RBAC coverage is not yet universal.
• Source applies Content Security Policy (CSP) and HTTP Strict Transport Security (HSTS) headers. Eight selected public route calls use strict Redis-backed throttling and reject at their documented cutoffs when Redis is unavailable; configured Redis behavior, trusted-edge attribution, deployed abuse protection, and universal route coverage remain unverified.
• Support ticket message content is stored unencrypted in the database to enable full-text search and AI processing.

7. Data Retention

• Account and ticket data is stored while the service operates. Exact retention, closure, backup, and deletion timing must be confirmed for the applicable request.
• Audit logs are stored for security and compliance. A configurable 365-day enforcement and complete archive/deletion lifecycle are not yet product-verified.
• Account deletion is handled as a supervised request. Keva does not currently promise immediate or complete cascading deletion; scope, legal hold, backups, connected providers, and independent read-back must be confirmed.
• You may request a data export. Export coverage and timing must be confirmed before account closure; a complete self-service pre-closure export is not yet product-verified.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

Under the GDPR (EU/EEA)

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Not be subject to solely automated decision-making

Under the CCPA (California)

• Know what personal information is collected
• Request deletion of your data
• Opt out of the sale of personal information — we do not sell your data

Under the NZ Privacy Act 2020

New Zealand residents have the right to access and request correction of their personal information under the Privacy Act 2020. You may also lodge a complaint with the NZ Office of the Privacy Commissioner.

To exercise any of these rights, contact us at privacy@keva.support.

To exercise these rights, email support@keva.support; we act within 30 days.

9. International Data Transfers

Your data is processed in the United States via our cloud providers (Google Cloud, Anthropic, Voyage AI, Stripe, and others). Where required, we rely on Standard Contractual Clauses (SCCs) and other lawful transfer mechanisms to ensure adequate protection of your data when it is transferred outside your jurisdiction.

10. Children's Privacy

Keva is a business-to-business service and is not directed at children under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email or via an in-app notification. The "Last updated" date at the top of this page indicates when the policy was most recently revised.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: