Privacy policy

KPAI is a marketing analytics assistant operated by Zuti Digital (“we”, “us”). It answers questions about a business’s marketing performance using data from the accounts its users connect. This policy explains what we collect, how we use it, and the choices you have. Questions or requests: support@kpai.com.

Information we collect

• Account information: your name and email address, and, if you sign in with Google, the basic profile Google shares (name, email, and profile picture).
• Connected data sources: when you connect an account, we read marketing and sales data from it, read-only. Depending on what you connect this includes Google Analytics (sessions, conversions, revenue, and traffic sources), Google Ads (campaign spend, clicks, conversions), Google Search Console (search queries, clicks, impressions, positions), Google Drive (only the documents you pick, as context for answers), Shopify, Meta Ads, Triple Whale, Klaviyo, Microsoft Ads, Semrush, Foreplay, and Lebesgue.
• Access credentials: the OAuth tokens or API keys that let us read those accounts.
• What you create in KPAI: projects and their settings, questions you ask, the answers we produce, reports and templates, and feedback you give on answers.
• Technical information: logs needed to run and secure the service (for example, request times and error details). Logs never contain your passwords, tokens, or API keys.

How we use information

• To answer your questions and build the reports you ask for, from the accounts connected to your project.
• To keep connections working (refreshing access tokens) and to show which sources are connected.
• To email report editions to the recipients you choose, and to create a Google Slides copy of a report in your Drive when you ask.
• To check and improve answer quality, using the answers and feedback within your workspace.
• To secure the service and fix problems.

We do not sell your information, use it for advertising, or use it to build profiles of people.

Google user data

When you connect Google, we request read-only access: Google Analytics (analytics.readonly), Google Search Console (webmasters.readonly), Google Ads (adwords, used only to read reports), and Google Drive (drive.file, which gives access only to the documents you pick in Google’s file picker). We use this data only to provide KPAI’s features to you: answering questions, building reports, and showing your connection status. The only thing KPAI ever writes to Google is a new presentation in your own Google Drive, and only when you choose Open in Google Slides on a report; it never changes or deletes anything else.

KPAI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data for advertising, we do not sell it, we do not use it to develop or train generalized AI or machine-learning models, and people at Zuti Digital do not read it unless you ask us to (for support), it is needed for security, or the law requires it.

AI processing

To write answers, KPAI sends your question, your project’s guidance, and the figures it computed from your data (summaries and top rows, not full exports) to OpenAI’s API. Every number in an answer is calculated by KPAI itself, not by the model. OpenAI processes this data on our behalf under its API terms and does not use it to train its models.

Who processes data for us

• Supabase: database and sign-in.
• Vercel: hosting.
• OpenAI: writing answers, as described above.
• Resend: sending report emails.
• The services you connect (Google, Shopify, Meta, and the others above), which we call to read your data.

We share information with these providers only as needed to run KPAI. We may also disclose information if the law requires it.

Security

Access tokens and API keys are encrypted with AES-256-GCM before they are stored, are used only on our servers, and are never sent to your browser. Data is stored in a database where each workspace can read only its own projects. Every connection is read-only.

Retention and deletion

• Results read from your sources are cached so repeat questions are fast. A cached result is reused for at most a day and is kept with its project. Answers and reports keep the figures they showed.
• Project data (connections, conversations, reports, documents, and cached results) is kept until you delete it or the project.
• Disconnecting a source deletes its stored credentials. Deleting a project deletes its connections, conversations, reports, and documents.
• You can revoke KPAI’s Google access at any time at myaccount.google.com/permissions.
• To delete your account and all of its data, email support@kpai.com. We act on requests within 30 days.

Your rights

You can ask to access, correct, export, or delete your personal information by emailing support@kpai.com. Depending on where you live, you may have further rights under local law.

Changes

If we change this policy, we will post the new version here and update the date above.