Privacy Policy

Kawaru Tech Ltd

Last Updated: 15 September 2026

This Privacy Policy explains how Kawaru Tech Ltd ("kawaru", "we", "us", or "our") collects, uses, and protects personal data when you use the kawaru platform, website, and services (collectively, the "Service"). It applies to visitors of our website, holders of kawaru Accounts, and team members who participate in AI-led interviews through the Service.

We designed the Service around data minimization: we do not ask for your name, we do not build individual profiles, and we do not use your data to train AI models. We collect only what is needed to run the Service.

This Privacy Policy is incorporated by reference into our Terms and Conditions. Capitalized terms not defined here have the meaning given in the Terms.

1. Who Is Responsible for Your Data

1.1 kawaru as Data Controller

For the following data, kawaru acts as the data controller:

• Account registration data (work email, role, password)
• Website visitor data and cookies
• Billing and correspondence data
• Usage and technical data about how the Service is accessed

1.2 kawaru as Data Processor

For the content our customers submit to the Service — including interview responses, process descriptions, and connected tool data ("Customer Data") — the customer is the data controller and kawaru acts as a data processor. We process this data only on the customer's instructions and only to provide the Service.

If you participated in an AI-led interview through the Service, your employer (or the organization that invited you) is the data controller for your interview responses. Questions or requests about that data should be directed to them; we will assist them in fulfilling your requests as required by law. For business customers, a Data Processing Agreement (DPA) is available on request.

During the current beta, Accounts are single-user and do not support inviting colleagues: the only person interviewed is the Account holder. The processor arrangements above apply in full once multi-user access and team interviews are enabled.

2. What Data We Collect

2.1 Account Data

When you create an Account, we collect:

• Work email address
• Role (job function — e.g. "Head of Operations")
• Password (stored in hashed form only; we cannot see it)

We deliberately do not ask for your name, photo, phone number, or other identifiers.

2.2 Customer Data (Processed on Behalf of Customers)

In the course of providing the Service, we process content submitted by customers and their teams:

• Responses given to kawaru's AI agents during interviews (text and, where applicable, transcripts)
• Descriptions of business processes, tools, and ways of working
• Documents uploaded to the Service
• Data retrieved from Third-Party Services the customer chooses to connect

Interview responses are linked to the participant's work email and role. While we do not request names, this data may still constitute personal data under applicable law, and we treat it accordingly.

2.3 Usage and Technical Data

When you use the authenticated Service, technical data may include:

• IP address and approximate location (country/region level)
• Browser type, device type, and operating system
• Pages visited, features used, and interaction events
• Log data, timestamps, and error reports

Public website logs and statistics

For kawaru.ai, www.kawaru.ai and dev.kawaru.ai, our Caddy web server records JSON access logs containing connection IP addresses, request timestamps, requested URLs (including query strings), request headers such as User-Agent and referrer, response status and technical response information. Request and response bodies are not logged. Caddy redacts Cookie and Authorization header values by default. Avoid putting personal information or secrets in website URLs.

Once a day, a script on each hosting server processes closed log files into statistics by UTC date, domain, page, source category and shared mailing-batch code. Reports also contain requests and page views per IP address and approximate country. Country lookup uses a locally stored DB-IP Lite database; visitor IP addresses are not sent to a geolocation service. Reports exclude full User-Agent strings, full referrer URLs, arbitrary query parameters and request bodies. They contain IP addresses and are not anonymous while those addresses are retained.

This processing runs independently of the Google Analytics cookie choice, including before any choice and after Reject Optional Cookies. It does not add analytics cookies, browser storage, pixels, fingerprinting or generated visitor identifiers. It uses the connection information received by the server. We do not join these reports with Google Analytics, customer accounts or recipient lists. Mailing codes must be shared by a whole mailing batch, not assigned to individual recipients; they attribute the tagged request only.

We use the reports to understand website traffic, page and mailing performance, and recognise automated traffic. “Unique visitors” in these reports means different IP addresses with qualifying page views per domain per UTC day. It is an estimate: shared networks can combine people, changing addresses can count one person more than once, and VPNs affect country estimates. Known bots, prefetches, assets, redirects and failed requests are excluded from page-view counts. Reloads can count again; client-side navigation without a server request is not visible to Caddy. Undetected bots can inflate counts.

Raw files are deleted only after their statistics have been successfully saved. Normally this happens in the daily run; failures retain the affected files for retry. Daily reports, including IP details, are retained until deleted by authorised operators. There is no automatic expiry of these reports. Reports are stored as server files and, for the production website, in our PostgreSQL database. Access is restricted to authorised server operators and authenticated internal analytics users; the statistics are not publicly accessible.

Cookie-free processing is not automatically exempt from privacy rules. Our basis for ordinary server traffic analysis is our legitimate interest in operating and improving the website, subject to the necessity and balancing requirements of UK GDPR/GDPR and applicable PECR/ePrivacy rules. In particular, IP-based analysis and tagged mailing links require separate assessment; we do not claim a universal consent exemption. To object to this processing or request access or deletion, contact privacy@kawaru.ai. Cookie preferences control Google Analytics separately.

Optional Google Analytics

Google Analytics 4 (G-Y3QQLRX8TD) loads on known public pages only after you enable the Analytics category, including through Accept All Cookies. No Google tag or consent-mode ping is sent before this choice or after Reject. GA uses its own cookies and processes usage and device information through Google. Our manual page-view events exclude query strings, fragments and referrer URLs. GA is disabled on unknown page paths. Google signals and advertising personalisation signals are disabled. You can withdraw through Your Privacy Choices; we disable GA and delete accessible _ga cookies. GPC also overrides Analytics consent. Information already sent while consent was active cannot be recalled by deleting a cookie.

Other infrastructure logs

The public website application does not produce request access logs. Production render failures use a fixed diagnostic message. Website access logs are directed to the dedicated files described above, and duplicate website request-error records are excluded from Caddy's default logger. Other Caddy operational logs, such as proxy connection failures, can still include request information in host journals. Historical shared proxy logs can also contain earlier website request information. Those historical records and hosting-provider security logs or backups are separate from this daily processing pipeline; deleting a dedicated access-log file does not erase those copies.

2.4 Cookies

We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are used only with your consent where required by law.

2.5 Communications

If you contact us (email, support, feedback forms), we keep the correspondence and the contact details you provide in it.

3. How and Why We Use Data

3.1 AI Processing

The Service uses artificial intelligence to analyze Customer Data and generate process maps, analyses, and recommendations. We do not use your data to train our AI models, and our AI subprocessors are contractually prohibited from using your data to train theirs. Your data is processed by AI solely to deliver the Service to you.

3.2 No Profiling or Automated Decisions About Individuals

The Service analyzes business processes, not people. We do not build profiles of individuals, evaluate individual performance, or make automated decisions that produce legal or similarly significant effects on individuals.

4. Who We Share Data With

We do not sell personal data. We share data only with:

• Subprocessors — service providers who help us run the Service (cloud hosting, AI model providers, email delivery, analytics). All subprocessors are bound by data protection agreements and, in the case of AI providers, by prohibitions on training on your data. A current list of subprocessors is available on request at privacy@kawaru.ai.
• Third-Party Services you connect — if you choose to connect external tools, data flows to and from them under their own terms and privacy policies.
• Legal and safety — authorities or third parties where required by law, or to protect the rights, safety, or property of kawaru, our customers, or others.
• Business transfers — a successor entity in the event of a merger, acquisition, or sale of assets, subject to this Privacy Policy.

5. International Data Transfers

We are based in the United Kingdom. Some of our subprocessors (including cloud and AI providers) may process data in other countries, including the United States. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards: UK adequacy regulations, the EU–US / UK–US Data Privacy Framework where applicable, or Standard Contractual Clauses (with the UK Addendum).

6. How Long We Keep Data

• Account Data and Customer Data: retained for the duration of your access to the Service. If you close your Account or request deletion, we retain your data for a further 30 days — during which you can export your data or restore your Account — and then permanently delete it.
• Exceptions: we may retain limited data longer where required by law or for legitimate business purposes (such as transaction records, security logs, or legal claims).
• Public website logs: deleted after successful daily processing; failed processing retains files for retry.
• Website statistics, including IP details: retained until deleted by authorised operators; the daily job does not automatically expire reports.

7. How We Protect Data

We implement appropriate technical and organizational measures, including:

• Encryption of data in transit and at rest
• Access controls and least-privilege access for our personnel
• Passwords stored only in hashed form
• Regular security assessments

Please note that the Service is currently offered as a beta version. While we apply the safeguards above, we recommend regularly exporting outputs you wish to keep, as described in our Terms and Conditions.

8. Your Rights

Depending on where you are, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Export your data in a portable format
• Restrict or object to certain processing
• Withdraw consent at any time (for processing based on consent, such as marketing)
• Complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO, ico.org.uk); in the EU, your local data protection authority

To exercise your rights, email us at privacy@kawaru.ai. We respond within one month (UK/EU) or the timeframe required by applicable law. If your request concerns interview responses processed on behalf of your employer, we may redirect the request to them as the data controller and assist them in fulfilling it.

US state residents (California and others): you additionally have the rights to know, delete, correct, opt out of sale/sharing (we do not sell or share personal data for cross-context behavioral advertising), and not to be discriminated against for exercising your rights. We honor Global Privacy Control (GPC) signals.

9. Children

The Service is intended for business use by adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us personal data, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect. The "Last Updated" date at the top shows the current version.

11. Contact

Kawaru Tech Ltd

Registered in England & Wales, company no. 17413506

Navigation Point, 2 Hale Wharf, London, United Kingdom

Email: privacy@kawaru.ai

Website: www.kawaru.ai