Privacy Policy

1. Who we are

Kikai (“we”, “us”) operates an AI-powered customer messaging platform (the “Service”) that businesses use to handle inbound messages across WhatsApp, Instagram, Facebook Messenger, website chat, and voice calls. We act as a data processor on behalf of the businesses that use the Service, and as data controller in respect of our own operational logs and account records.

For the purposes of UK GDPR and the EU GDPR, the Data Controller is:

2. What we collect

When you send a message to a business that uses our Service, or place a phone call to a business’s AI voice agent, we process the following categories of data:

• Message content — text of messages you send or receive via WhatsApp, Instagram, Facebook Messenger, or website chat.
• Contact identifiers — your phone number (for WhatsApp and voice), Instagram scoped user id, Messenger PSID, website session id, and where voluntarily provided: name, email, company.
• Voice call data — the number you rang from, the time and length of the call, and what it came to (for example, an appointment booked or moved, or a message left for the business to ring you back, with that message). Calls are not recorded and no transcript is kept: what you say is turned into text and answered as the call happens, and is not stored by us.
• Technical metadata — timestamps, delivery status, message ids issued by the underlying platform.

We do not intentionally collect special category data (health, biometric, political opinion, etc.). If you voluntarily share special category data in a message, please be aware it is stored alongside the rest of the conversation.

3. Why we process it

• To deliver the Service: route your message to the correct business tenant, store conversation history, and generate an AI-assisted reply where the business has enabled auto-response.
• To maintain a record of prior interactions so future replies are contextual and consistent.
• To provide analytics and operational metrics to the business you are communicating with.

Lawful basis (UK/EU GDPR):contract performance with the business (Art. 6(1)(b)) and the business’s legitimate interest in operating a messaging channel (Art. 6(1)(f)). Where legally required, consent (Art. 6(1)(a)) is obtained by the business before you contact them.

4. Third parties who process data on our behalf

• Anthropic, PBC (USA) — generates AI replies from conversation history. Data is transmitted to the Anthropic Claude API; Anthropic acts as a sub-processor.
• Meta Platforms Ireland Ltd — delivers WhatsApp, Instagram, and Facebook Messenger messages to/from our platform.
• Twilio Inc. (USA) — carries phone calls to the AI voice agent, and sends appointment confirmation and reminder text messages.
• Deepgram, Inc. (USA) — turns what a caller says into text during a phone call, so the AI voice agent can answer.
• ElevenLabs Inc.(USA) — turns the AI voice agent’s replies into speech during a phone call.
• netcup GmbH (Germany) — hosts our application and PostgreSQL database. Data is stored at rest in the EU.
• Google LLC (USA) — optional calendar integration, used only when a business keeps its diary in Google Calendar.
• Cal.com, Inc. (USA) — optional calendar booking integration, used only when a business enables it.

International transfers to the USA are covered by Standard Contractual Clauses (SCCs) with each sub-processor or, where available, the EU-US Data Privacy Framework.

5. Retention

We retain conversation data for as long as the business tenant you are communicating with remains an active customer of the Service, plus up to 30 days after their account is closed for operational backup purposes. Individual records are deleted earlier on request — see section 7.

6. How we protect it

• Transport: all traffic is HTTPS / TLS 1.2+.
• At rest: data is stored in a PostgreSQL database on a private network.
• Access: limited to a named list of administrators; super-admin actions are tenant-gated.
• Authentication: credential-based with bcrypt-hashed passwords; no plaintext storage.

7. Your rights

Under UK and EU GDPR you have the right to:

• Request access to a copy of your personal data
• Request rectification of inaccurate data
• Request erasure of your data (“right to be forgotten”) — see our data-deletion procedure
• Restrict or object to processing
• Data portability (receive your data in a portable format)
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or your local EU supervisory authority

To exercise any of these rights, email roy962002@hotmail.com. We respond within 30 days as required by law.

8. Changes to this policy

We may update this policy from time to time. Material changes will be flagged at the top of this page with the new “Last updated” date. Your continued use of the Service after an update signals acceptance.

9. Contact

Questions about this policy or about how your data is handled: roy962002@hotmail.com