Privacy Policy
Kulit
Last updated: May 18, 2026
Kulit ("we," "our," "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use our life management assistant and companion web application (together, the "Services"). This Policy applies only to our Services, not to any third-party websites or services that may be linked from or integrated with our platform.
Your use of the Services, registration with the Services, or your providing us with any content or personal information constitutes your agreement to this Privacy Policy and our Terms of Use, which are incorporated herein by reference. If you do not agree to this Privacy Policy or the Terms of Use, you must immediately stop using the Services.
Each time you use the Services, the then-current version of this Privacy Policy will apply.
1. Changes to This Privacy Policy
We may update this Privacy Policy by posting a revised version on our website and/or by sending a notification to the messaging platform account or email address associated with your account. The updated Privacy Policy will be effective immediately and apply to any continued or new use of the Services.
2. Information We Collect
We collect several categories of information in order to provide and improve the Services.
2a. Account Information
When you register for the Services, we collect your name and email address (from your Google account), your phone number or messaging platform identifier (WhatsApp or Telegram), your preferred time zone and home city, and your digest time preference.
2b. Google Account Data
With your explicit consent, we access data from your connected Google accounts. The specific data we access depends on the permissions you grant during onboarding:
Calendar: We read your calendar events to build your morning digest and answer scheduling questions. If you grant write permission, we can also create and modify events on your behalf.
Gmail: We periodically scan your email for travel bookings, package deliveries, and appointment confirmations. We may also search your email to answer specific questions you ask (for example, "what's the hotel wifi password?"). We do not read, store, or index the full contents of your inbox. Kulit requests read-only access to Gmail and does not send, modify, or delete emails.
Tasks: We read and sync your Google Tasks to provide a unified view of your to-do items.
You can revoke any of these permissions at any time through the web application settings. Revoking a permission will immediately disable the features that depend on it.
Kulit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can review Google's policy at https://developers.google.com/terms/api-services-user-data-policy.
2c. Messages and Interactions
We store messages you send to Kulit through WhatsApp or Telegram, along with Kulit's responses, to maintain conversational context and enable you to reference prior interactions. Messages are retained for 90 days and then automatically deleted.
2d. Payment Information
Payments to Kulit are handled through Stripe (for USD transactions) and PayMongo (for PHP transactions). These processors collect your credit card information and billing details. We do not store or have direct access to your full payment card numbers. Payment processing is governed by the terms and policies of Stripe (https://stripe.com/legal) and PayMongo (https://www.paymongo.com/legal).
2e. Automatically Collected Information
When you use the web application, we collect standard technical information including IP address, browser type, operating system, referring pages, and timestamps. We use this information to administer the Services and analyze usage trends in aggregate. We do not link this data to your personal identity except as necessary for security and fraud prevention.
2f. Cookies
The web application uses session cookies for authentication. These are strictly necessary for the web application to function and do not track you across other websites. We do not use advertising cookies or third-party tracking cookies.
2g. Third-Party Personal Data in Your Accounts
When Kulit accesses your Gmail, Calendar, or Tasks, the data retrieved may contain personal information belonging to individuals who are not Kulit users (for example, names, email addresses, phone numbers, or other details of people who appear in your email or calendar). We process this information solely as it appears within your authorized data and only for the purpose of providing the Services to you. We do not independently collect, index, store, or build profiles from this third-party information. Such data is subject to the same retention, security, and deletion policies that apply to your personal data.
3. How We Use Your Information
We use your information for the following purposes:
Providing the Services: Generating your morning digest, processing your messages, managing your tasks and lists, setting reminders, creating calendar entries, identifying actionable information in your email, and coordinating with your group members.
AI Processing: Your messages and relevant context (such as calendar events or email excerpts) are sent to our AI model provider (currently Google Gemini) to understand your requests and generate responses. We do not permit third-party AI providers to use your personal data to train AI models.
Communication: Sending you service-related messages through your chosen messaging platform, including your daily digest, reminders, coordination alerts, and billing notifications.
Account Management: Processing payments, managing your subscription, and responding to support requests.
Service Improvement: Analyzing aggregated, de-identified usage patterns to improve the Services.
De-Identified Data
We may create de-identified, anonymized data from the information we collect such that it does not identify any individual. We may use this de-identified data for our lawful business purposes, including analyzing and improving the Services. If we use de-identified data to train AI models that support our Services, we will provide the ability to opt out of this use through the web application settings. De-identified data will not be re-identified or linked back to any individual.
4. Consent and Your Choices
Every processing activity that touches your data requires your explicit consent. We collect consent during onboarding and you can modify your consent at any time through the web application settings.
The following table describes the consent purposes we define:
| Purpose | Description | Required? |
|---|---|---|
| Calendar Read | Kulit reads your calendar events to build your morning digest and answer scheduling questions. | Yes (core functionality) |
| Calendar Write | Kulit creates and modifies calendar events on your behalf. | No |
| Gmail Scan | Kulit periodically scans your email for travel bookings, deliveries, and appointments. | No |
| Gmail Query | Kulit searches your email to answer specific questions you ask. | No |
| Tasks Sync | Kulit reads and syncs your Google Tasks. | No |
| Messaging | Kulit sends you messages via your chosen platform (WhatsApp or Telegram) including your digest, reminders, and responses. | Yes |
| Group Data Sharing | Your shared lists and coordination responses are visible to members of your group. | No |
| AI Processing | Your messages and data are processed by an AI model to understand requests and generate responses. | Yes |
Revoking a required consent (Calendar Read, Messaging, or AI Processing) effectively disables the product. You will be informed of this before revoking.
5. How We Share Your Information
5a. Third-Party Service Providers
We share your information with third-party providers solely to operate the Services:
Google: To access your Calendar, Gmail, and Tasks data per your granted permissions.
Meta (WhatsApp Business Platform): To send and receive messages on your behalf if you have selected WhatsApp as your messaging channel.
Telegram (Bot API): To send and receive messages on your behalf if you have selected Telegram as your messaging channel.
Google Gemini: Your messages and relevant context are sent for AI processing.
Stripe and PayMongo: To process subscription payments.
Render: Our hosting provider, where your data is stored and processed.
5b. Group Members
If you join a group, your shared lists and responses to coordination questions are visible to other members of that group. Your personal tasks, reminders, and email-discovered events are never shared with group members.
5c. Aggregated and De-Identified Data
We may share anonymized, aggregated data that does not identify any individual user for research, analysis, or business purposes. See the De-Identified Data section above for details on how this data is created and used.
5d. Legal Requirements
We may disclose your information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to (a) comply with the law or legal process, (b) protect our rights and property or the safety of our users, or (c) investigate fraud or security issues.
5e. Business Transfers
If Kulit is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified of any change in ownership or uses of your personal information. Continued use of the Services following such a transfer constitutes consent to disclosure of your information to the resulting entity.
6. Data Retention
We retain different categories of data for different periods, based on their utility and our legal obligations:
| Data Category | Retention | Rationale |
|---|---|---|
| Messages (WhatsApp/Telegram) | 90 days | Needed for conversational context and debugging. |
| Completed tasks | While account active | Users expect their task history to persist. |
| Delivered reminders | 90 days | No ongoing utility after delivery. |
| Discovered events (past) | 12 months | Users may reference past travel or appointments. |
| Audit log | 24 months | Required for accountability and compliance. |
Data is automatically purged after its retention period by an automated process.
7. Data Security
We take the security of your data seriously. We employ the following measures:
Encryption at rest: Google OAuth tokens are encrypted before being stored in our database.
Encryption in transit: All communications between your devices and our servers, and between our servers and third-party providers, are encrypted using TLS.
Access controls: Your data is scoped to your verified identity. There is no mechanism for one user to access another user's personal data through the Services.
Audit logging: Every access to your data is logged, recording what type of data was accessed and why, without recording the actual content of the data.
No system is perfectly secure. While we implement commercially reasonable safeguards, we cannot guarantee absolute security. You are responsible for maintaining the security of your devices and accounts.
8. Data Breach Notification
In the event of a security breach that results in unauthorized access to, or disclosure of, your personal data, we will notify affected users without unreasonable delay and no later than required by applicable law. Washington State law requires notification within 30 days of discovering a breach, and we will comply with this and any other applicable notification requirements. Notification will be sent to the email address associated with your account and, where appropriate, through your chosen messaging platform. The notification will describe the nature of the breach, the categories of data affected, and the steps we are taking in response.
9. Your Rights
9a. Access and Export
You have the right to access and export all personal data we hold about you. You can request a data export through the web application at any time. The export includes your profile information, connected accounts, consent records, tasks, reminders, discovered events, shared list contributions, message history, and audit log.
9b. Rectification
You can correct your personal information (name, email, phone number) through the web application settings. You can edit or delete your tasks, lists, and reminders through your messaging platform or the web application at any time.
9c. Deletion (Right to Erasure)
You may request deletion of your account at any time through the web application. Account deletion is a complete, cascading purge of all your personal data. We provide a 72-hour grace period during which you may reverse the request. After this period, deletion is irreversible. To prevent accidental or malicious deletion, the request must be confirmed through an authenticated web session.
9d. Consent Withdrawal
You can withdraw any consent you have granted at any time through the web application settings. Withdrawal of consent takes effect immediately and disables the processing activities that depended on that consent.
9e. Data Portability
Your data export is provided in a standard, machine-readable JSON format to allow you to transfer your data to another service.
10. Google API Services Compliance
Kulit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
We will only use read-only access to Gmail message bodies (including attachments), metadata, and headers to provide the features described in this Privacy Policy (email scanning for actionable information and contextual queries). We will not transfer this data to others unless doing so is necessary to provide and improve the features described here, to comply with applicable law, or as part of a merger, acquisition, or asset sale with notice to users. We will not use this data for serving advertisements. We will not allow humans to read this data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, to comply with applicable law, or the data has been aggregated and anonymized and is used for internal operations.
11. Children
The Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and learn that your child has provided us with personal information, please contact us and we will delete that information.
12. International Data Transfers
Your data may be processed and stored in countries outside your country of residence, including Singapore. We ensure that appropriate safeguards are in place for such transfers. For transfers from the European Economic Area, we rely on applicable legal mechanisms including the EU-US Data Privacy Framework and standard contractual clauses where required.
13. California Residents
If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA) to request information about the categories of personal information we collect, the purposes for which we use it, and the categories of third parties with whom we share it. We do not sell your personal information. To exercise your rights, contact us at support@kulit.ai.
14. Communications and Marketing
Kulit sends service-related messages through your chosen messaging platform as part of the core product experience, including your morning digest, reminders, and responses to your messages. You cannot opt out of these messages without downgrading to the free tier or deleting your account, as they are integral to the paid Services.
We may occasionally send you product announcements or tips for getting more out of Kulit. You can opt out of these non-essential messages at any time by replying "stop marketing" or adjusting your preferences in the web application.
15. Third-Party Websites
Our Services may link to websites or services operated by third parties. We do not control these websites and are not responsible for their privacy practices or content. We encourage you to review the privacy policies of any third-party websites you visit.
16. How to Contact Us
If you have any questions or concerns about this Privacy Policy, to request access to or correction of your personal information, to request a data export, or to request account deletion, please contact us at support@kulit.ai.