Privacy Policy

This Privacy Policy applies to business customers, administrators, team members, website visitors, and end users whose conversations are processed through connected channels.

For customer conversations and contact data that a business manages in Kuitan, the business is responsible for deciding why and how that data is processed. Kuitan processes that data on the business's behalf to provide the Service, unless applicable law requires a different role for a specific activity.

Each business customer is responsible for obtaining any required consent, providing appropriate notices to its own customers, and using Kuitan in compliance with applicable privacy, consumer protection, marketing, and platform rules.

2.1 Information from Businesses (Our Customers)

• Account information: Name, email address, organization name, and password when you register.
• Payment information: Billing details processed through our payment providers.
• Channel credentials: Access tokens and page identifiers for connected platforms, stored on our servers and used to provide the integration you authorize. Available channels currently include LINE, Facebook, and Instagram.

2.2 Information from End Users (Your Customers)

When your customers send messages through connected platforms, we process:

• Profile information: Name and profile picture as provided by the messaging platform.
• Message content: Text, images, videos, audio, files, stickers, and locations sent through the conversation.
• Platform identifiers: User IDs assigned by the messaging platform (e.g., Facebook PSID, LINE User ID).

2.3 Automatically Collected Information

• Usage data: Pages visited, features used, timestamps, and interaction patterns.
• Device information: Browser type, operating system, and IP address.

• To provide, operate, and maintain the Service, including receiving and sending messages across connected platforms.
• To display customer names and profile pictures in the chat inbox for identification purposes.
• To send typing indicators and read receipts to improve the communication experience.
• To generate analytics and reports (e.g., response times, chat volume) for our business customers.
• To send customer satisfaction (CSAT) surveys on supported channels, within the connected platform's permitted messaging window and rules.
• To process broadcast messages only on supported channels and where the platform permits this use.
• To improve and develop our Service.
• To communicate with you about your account, updates, and support.

When you connect Facebook Messenger or Instagram DM, Kuitan may receive data from Meta APIs only as needed to provide messaging features you request.

• We use Meta-derived data to authenticate connected Pages or Instagram Business Accounts, receive incoming messages, send replies, show conversation context, and maintain connection health.
• We do not sell Meta platform data, use it to build advertising profiles, or use it for unrelated marketing purposes.
• We do not transfer Meta platform data to third parties except to service providers that help us operate the Service, to Meta or connected platforms as required to provide the integration, when required by law, or with your authorization.
• Access to tokens and channel credentials is restricted to providing the integration for the connected account and organization.
• AI replies are not currently enabled for Facebook Messenger or Instagram conversations in Kuitan.
• Where Meta authorizes Human Agent access, an authorized staff member may manually continue the customer's existing support inquiry after 24 hours and within seven days of the customer's latest message. Human Agent is not used for AI or automated replies, scheduled messages, broadcasts, advertising, or unrelated content.

TikTok messaging is not currently available in Kuitan. We are preparing the integration and seeking the required permissions. This section describes the intended use of TikTok data when an approved integration becomes available and you choose to connect an eligible TikTok Business Account.

• With your authorization, account identifiers, display names, usernames, and profile images would identify the Business Account you connect.
• Direct message identifiers, participants, content, supported attachments, and timestamps would be processed to show conversations and allow your authorized staff to respond to customers.
• The initial messaging integration is intended for staff-operated customer support. TikTok messages will not be used to train AI models, create advertising profiles, or provide unrelated marketing services.
• TikTok account data would be shared only with the connected business's authorized users, TikTok for the requested integration, and service providers needed to operate it, subject to the disclosures below.
• If you withdraw authorization, we will stop using that authorization and arrange deletion of TikTok personal data that is no longer needed. Contact us using the Data Deletion Instructions to request deletion or exercise your data rights.

Availability will depend on TikTok approval, account eligibility, and supported regions. TikTok Direct Messages and TikTok Shop messages are separate services; this planned integration concerns Direct Messages.

We do not sell, rent, or trade personal information to third parties. We may share information only in the following cases:

• With messaging platforms: To send and receive messages on your behalf (e.g., Facebook Graph API, LINE Messaging API).
• With cloud infrastructure providers: For data storage and processing (e.g., Cloudflare R2 for file storage).
• As required by law: To comply with legal obligations, regulations, or valid legal processes.

• Our public website and application use HTTPS to protect data in transit.
• Channel credentials are handled by our servers and restricted to integration operations; users should not send tokens or passwords in support requests.
• Supported messaging integrations validate webhook signatures before processing incoming events.
• Chat attachments are stored using our cloud storage providers and are subject to access and retention controls.
• We implement role-based access controls to restrict data access within organizations.

• Conversation data and messages are retained while needed to provide the business's customer support service, subject to deletion requests and applicable retention obligations.
• Attachment availability depends on the applicable plan, file size, and configured retention period. Expiration of an attachment does not by itself delete the conversation or its text messages.
• Disconnecting a channel removes its active connection from Kuitan. It does not by itself confirm that historical messages, connection records, or backup copies have been erased. To request erasure, follow our Data Deletion Instructions.
• Operational logs, backups, billing records, and security records may be retained for a limited period according to our internal retention, legal, and audit requirements.
• Upon verified account deletion, associated active product data will be removed or anonymized within 30 days where technically and legally feasible.

We review the scope of each deletion request, explain any records that must be retained, and distinguish removal from active systems from expiration of restricted backup copies.

We may use cookies, local storage, pixels, and similar technologies to keep the website and Service working, remember preferences, secure sessions, understand usage, and improve product experience.

• Essential technologies: Required for login, security, routing, and core platform functionality.
• Analytics technologies: Help us understand aggregate website or product usage so we can improve the Service.
• Marketing technologies: May be used to measure campaign performance or show relevant content where permitted.

Where required by law, we will request consent before using non-essential analytics or marketing technologies. You can control cookies through your browser settings and any cookie controls we provide.

Kuitan and our service providers may process data in countries other than your country of residence. Where required, we use reasonable safeguards designed to protect personal data during such transfers.

Depending on your jurisdiction, you may have the right to:

• Access and receive a copy of your personal data.
• Request correction of inaccurate data.
• Request deletion of your data.
• Withdraw consent for data processing.
• Lodge a complaint with a data protection authority.

To exercise these rights, contact us at the email below or see our Data Deletion Instructions.

Our Service integrates with third-party messaging platforms including Meta (Facebook Messenger, Instagram) and LINE. Your use of these platforms is governed by their respective privacy policies:

• Meta Privacy Policy
• LINE Privacy Policy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a new "Last updated" date.

If you have questions about this Privacy Policy, please contact us: