Kulu Privacy Policy

1. Introduction and scope

This Privacy Policy explains how Kulu ("Kulu," "we," "us" or "our") collects, uses, shares and protects personal information when you visit our website at kulu.io (the "Site"), request a demo, contact us, or use our messaging platform, messaging API, branded customer portal and related managed services (together, the "Services").

Kulu provides messaging technology and managed services to businesses, including software platforms and enterprises ("Customers"). This Policy applies in two different ways depending on the information involved:

• Kulu as controller. For information we collect through the Site, demo requests, sales and support communications, and Customer account administration, Kulu decides how the information is used and is responsible for it under this Policy.
• Kulu as service provider or processor. When Customers use the Services to send and receive messages, Kulu processes the phone numbers, message content and related data of the people those Customers communicate with ("End Users") on the Customer's behalf and under the Customer's instructions. In that role, the Customer's own privacy policy governs, and Kulu handles the data as described in our agreement with that Customer. If you are an End User and want to exercise a privacy right, please contact the business that messaged you. We will assist that business as required.

By using the Site or Services, you acknowledge the practices described here. If you do not agree, please do not use the Site or Services.

2. Information we collect

Information you give us

• Demo and contact requests: name, work email, company name, company website, company type, the services you are interested in, estimated message volume, current messaging vendor, launch timeline, and anything else you choose to include.
• Account and onboarding information: business contact details, user names, login credentials, billing contacts, and the business registration details we need to vet partners and file brand and campaign registrations (for example legal business name, EIN or other tax identifier, business address, website, authorized representative, use case descriptions, sample messages and opt-in descriptions).
• Billing information: billing address and payment details. Card payments are processed by our third-party payment processor, and we do not store full card numbers.
• Communications: emails, support tickets, call notes and feedback you send us.

Information we collect automatically

• Device and usage data: IP address, browser type, operating system, referring URLs, pages viewed, and the date and time of your visit.
• Platform logs: API requests, portal activity, sub-account configuration, and security logs used to operate, secure and troubleshoot the Services.
• Cookies and similar technologies: described in Section 5.

Information processed on behalf of Customers

• End User data: mobile phone numbers, message content, delivery receipts, inbound replies, opt-in and opt-out records, timestamps, and carrier metadata.
• Consent records: documentation Customers provide showing how End Users opted in to receive messages.

Information from third parties

• Carriers, aggregators and registration bodies (such as The Campaign Registry) may share vetting results, registration status, delivery data and complaint or filtering feedback.
• Business verification and fraud prevention providers may give us information that helps us confirm a company's identity and assess risk.

3. How we use information

We use the information we collect to:

• Respond to demo requests and inquiries, and schedule calls about strategy, launch, pricing and partner vetting.
• Vet prospective partners and sending brands before onboarding, and decline high-risk content or use cases.
• Provide, operate and maintain the Services, including sending and receiving messages, provisioning short code, toll-free and 10DLC numbers, delivering webhooks, and running sub-accounts and reporting.
• Prepare, file and maintain brand and campaign registrations with carriers, aggregators and registration bodies.
• Review campaigns before launch, verify consent records, process opt-outs, and monitor traffic for complaints, filtering, fraud and misuse.
• Bill Customers and support rebilling features Customers configure for their own customers.
• Provide customer support and send service, security and administrative notices.
• Analyze and improve the Site and Services, including program reviews of delivery, opt-out and response data.
• Send marketing communications about Kulu to business contacts, where permitted. You can unsubscribe at any time using the link in our emails.
• Comply with law, carrier requirements and industry standards such as the CTIA Messaging Principles, enforce our Terms of Service and Acceptable Use Policy, and protect the rights, safety and property of Kulu, our Customers, End Users and others.

We do not sell personal information, and we do not use End User phone numbers or message content for our own marketing. We do not share mobile opt-in data or consent records with third parties or affiliates for their marketing purposes.

4. How we share information

We share personal information only as described below:

• Carriers, aggregators and registration bodies: to route and deliver messages, register brands and campaigns, verify toll-free numbers, apply for short codes, and respond to vetting questions, complaints and filtering feedback.
• Service providers: hosting, cloud infrastructure, payment processing, email delivery, analytics, customer support, and business verification vendors that work on our behalf under contractual confidentiality and data protection obligations.
• Customers: End User data, delivery data and reporting are made available to the Customer that sent or received the messages. Where a Customer operates sub-accounts for its own customers, data in a sub-account is available to that sub-account and to the parent Customer.
• Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or court order, or is needed to protect the rights, property or safety of Kulu, Customers, End Users or the public, or to investigate fraud, spam or abuse.
• Business transfers: in connection with a merger, acquisition, financing, reorganization or sale of assets, subject to the recipient honoring this Policy.
• With your consent: when you direct us to share information.

5. Cookies and tracking

The Site and portal use cookies and similar technologies to keep you signed in, remember preferences, secure accounts, and understand how visitors use the Site. These include:

• Strictly necessary cookies: required for login, security and core functionality. These cannot be turned off.
• Analytics cookies: help us measure traffic and improve the Site.
• Hosting provider cookies: our website host may set cookies needed to serve and protect the Site.

You can control cookies through your browser settings. Blocking some cookies may affect how the Site works. Where required by law, we ask for your consent before setting non-essential cookies. We honor Global Privacy Control signals as a request to opt out of any sharing for targeted advertising where applicable law treats it that way.

6. Retention, security and children

Retention. We keep personal information for as long as needed to provide the Services, meet carrier and registration requirements, resolve disputes, enforce our agreements, and comply with legal obligations. Opt-out and consent records are kept for at least as long as carriers, industry standards or applicable law (including the Telephone Consumer Protection Act) require. Message content and End User data are retained according to our agreement with the relevant Customer, and are deleted or returned at the end of that agreement except where we must keep them by law. Demo request information is kept for as long as it is useful for the sales relationship, after which it is deleted or anonymized.

Security. We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit, role-based access controls, restricted access to accounts and data, logging and continuous monitoring. No system is completely secure, and we cannot guarantee the security of information transmitted to or stored on our systems. If we learn of a security incident affecting your personal information, we will notify you and the relevant authorities as required by law.

Children. The Site and Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will delete it.

International transfers. Kulu is based in the United States, and information is processed in the United States and other countries where our service providers operate. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. Your privacy rights

Depending on where you live, you may have the right to:

• Know what personal information we have collected about you and how we use and share it.
• Access or receive a copy of your personal information.
• Correct inaccurate personal information.
• Delete your personal information.
• Opt out of the sale of personal information or sharing for targeted advertising. Kulu does not sell personal information or share it for targeted advertising.
• Limit the use of sensitive personal information. Kulu does not use sensitive personal information for purposes that require this right.
• Object to or restrict certain processing, and withdraw consent where processing is based on consent.
• Appeal our decision on a request you made.

United States. Residents of California, Colorado, Connecticut, Texas, Virginia and other states with comprehensive privacy laws may exercise the rights above. We will not discriminate against you for exercising them. You may use an authorized agent, and we may ask the agent for proof of authorization. California residents: in the past 12 months we collected the categories of information described in Section 2 (identifiers, commercial information, internet or network activity, and professional information) for the purposes in Section 3, and disclosed them to the categories of recipients in Section 4. We have not sold or shared personal information as those terms are defined under California law.

EEA, UK and Switzerland. We process personal information as a controller on these legal bases: performance of a contract, our legitimate interests in operating, securing and marketing our business-to-business Services, compliance with legal obligations, and your consent where we ask for it. You may lodge a complaint with your local data protection authority.

How to make a request. Email help@kulu.io with the subject line "Privacy Request." We will verify your identity before responding, and respond within the time required by applicable law (generally 30 to 45 days). If your request concerns messages you received from a Kulu Customer, we will forward it to that Customer or direct you to them.

Text message opt-out. To stop receiving text messages from any program running on Kulu, reply STOP to the message. Reply HELP for help.

8. Changes and contact

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page, and if the changes are material we will notify Customers by email or through the Services before they take effect.

Questions about this Policy or our privacy practices:

Kulu Email: help@kulu.io

Related policies: Terms of Service and Acceptable Use Policy.