Privacy Policy

KAV Labs, LLC ("KAV Labs," "we," "us," or "our") operates the website kavlabs.co (the "Service").

This Privacy Policy explains how we collect, use, and protect your personal data when you use our Service, as well as the choices you have in relation to that data. By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Scope of This Policy

This policy covers two distinct categories of data, and it is important not to confuse them:

• Website and business contact data. Information about visitors to kavlabs.co and the people who contact us, sign up, or subscribe to a KAV Labs plan. KAV Labs is the controller of this data, and this Privacy Policy governs it.
• Customer integration data. The end-customer records — profiles, orders, bookings, events — that flow through our integrations between a customer's source system and their Klaviyo account. For this data our customer is the controller and KAV Labs is the processor. It is governed by our Data Processing Agreement, not by this Privacy Policy.

If you are an end customer of a business that uses KAV Labs and you want your data accessed, corrected, or deleted, please contact that business directly. We act only on their instructions.

2. Data We Collect

2.1 Personal Data

While using our Service, we may ask you to provide certain personally identifiable information ("Personal Data"). This may include:

• Email address
• First and last name
• Company name and role
• Cookies and usage data

2.2 Usage Data

We automatically collect information on how the Service is accessed and used ("Usage Data"). This may include:

• IP address
• Browser type and version
• Pages visited and time spent on them
• Date and time of access
• Unique device identifiers and other diagnostic data

2.3 Cookies & Tracking

We use cookies and similar tracking technologies (beacons, tags, and scripts) to operate the Service and, with your permission, to understand how it is used.

Types of cookies we use:

• Essential cookies – required to operate the Service, remember your settings, and provide security features. These are always active.
• Analytics cookies – used by Google Analytics to understand aggregate site usage. These are optional.

Analytics cookies do not load until you accept them. Visitors are shown a cookie banner on first visit and no non-essential cookies or analytics scripts are set until consent is given. This means visitors in the EEA and the UK are not tracked by analytics unless they explicitly opt in. You may change your choice at any time using the Cookie Preferences link in the footer or the button below, and you may also configure your browser to refuse cookies, though some parts of the Service may then not function properly.

3. Legal Bases for Processing

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract – to provide the Service, manage your account, and handle billing.
• Legitimate interests – to secure and improve the Service, prevent abuse, and respond to business enquiries, balanced against your rights.
• Consent – for analytics cookies and marketing communications. You may withdraw consent at any time.
• Legal obligation – to meet tax, accounting, and other legal requirements.

4. How We Use Data

We use the information we collect to:

• Provide and maintain the Service
• Notify you about changes to the Service
• Enable interactive features
• Provide customer support
• Monitor and analyze usage
• Improve Service performance
• Detect, prevent, and address technical issues

We do not sell your Personal Data, and we do not use customer integration data to train artificial intelligence or machine learning models.

5. Transfer of Data

Your information may be transferred to and maintained on servers located outside your state, province, or country, where data protection laws may differ. By providing information to us, you consent to the transfer of data to the United States for processing.

Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Addendum.

6. Disclosure of Data

We may disclose your information in good faith when necessary to:

• Comply with legal obligations
• Protect and defend our rights or property
• Prevent or investigate potential wrongdoing
• Ensure the safety of users and the public
• Protect against legal liability

7. Retention

We keep personal data only as long as we need it for the purpose it was collected:

• Website analytics data – retained in aggregate by our analytics provider, and only collected where you have consented.
• Enquiry and support correspondence – retained while we are in contact with you and for a reasonable period afterwards for reference.
• Account and billing records – retained for the life of the account and afterwards for as long as required by law.
• Customer integration data – retained according to the schedule published in our Data Processing Agreement, including 7-day retention of raw webhook payloads and 30-day retention of application logs.

8. Your Rights

Depending on where you live, you may have the following rights over your Personal Data:

If you are in the EEA or the UK (GDPR / UK GDPR)

• Access a copy of the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, without affecting prior processing
• Lodge a complaint with your local supervisory authority

If you are a California resident (CCPA / CPRA)

• Know what personal information we collect, use, and disclose
• Request deletion or correction of your personal information
• Opt out of the sale or sharing of personal information — note that we do not sell or share personal information as those terms are defined by the CPRA
• Limit the use of sensitive personal information
• Be free from discrimination for exercising these rights

To exercise any of these rights, email teamkav@kavlabs.co. We will verify your request and respond within the timeframe required by applicable law. Requests about data we process on behalf of a customer are forwarded to that customer, who is the controller.

9. Security of Data

We encrypt data in transit using TLS 1.2 or higher and at rest using AES-256, and apply the controls described in our Information Security Policy. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

10. Service Providers

We may employ third-party providers to support our Service. These providers only access Personal Data as necessary to perform their tasks on our behalf and are contractually obligated not to use it for other purposes. Our current subprocessors are listed at kavlabs.co/subprocessors.

10.1 Analytics

We use Google Analytics to monitor and analyze usage of our Service, and only after you accept analytics cookies. You can also opt out by installing the Google Analytics opt-out browser add-on. For more details, see Google's Privacy Policy.

10.2 Payments

We use Stripe to process payments. Stripe may collect payment details as needed to complete transactions. KAV Labs does not store payment card numbers. For details, please see Stripe's Privacy Policy.

10.3 Communications

We use Google Meet for video conferencing and communications, and Google Drive for secure file storage and sharing, with data protections outlined in Google's Privacy Policy.

11. Links to Other Sites

Our Service may link to external sites not operated by us. We are not responsible for the privacy practices or content of those third-party sites. We strongly encourage you to review their privacy policies.

12. Children's Privacy

Our Service is not directed to anyone under 18. We do not knowingly collect Personal Data from children. If you believe a child has provided us Personal Data, please contact us so we can remove it.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Updates will be posted here with a revised version number and effective date. Significant changes may also be communicated via email or a notice on our website.

14. Contact Us

If you have questions about this Privacy Policy, please contact us: