1. Introduction
This Privacy Policy explains how Kwill (“we”, “us”, “our”) collects, uses, and discloses your information when you use our website and services.
2. What Data We Collect
We collect the following types of information when you interact with Kwill:
- Account Data: Your name, email address, and business name provided during registration.
- Usage Data: Information about the pages you visit and actions you take within our product, collected via PostHog.
- Payment Data: Payments are handled entirely by Stripe. Kwill does not store payment card details.
- Cookies: Information collected via strictly necessary and analytics cookies (see Section 7 below).
3. How We Use Your Data
We use the data we collect for the following purposes:
- To provide, maintain, and deliver the core Kwill service.
- To send essential transactional emails (e.g., account updates, security alerts).
- To analyze usage and improve product functionality and performance.
- To run web and product analytics.
AI Model Training: We do not use your client data or personal information to train any artificial intelligence (AI) models.
4. Data Storage & Security
We take data protection seriously and enforce strict security measures to protect your information:
- SOC 2: We are pursuing SOC 2 certification and already operate to those security standards. Our cloud infrastructure providers also maintain SOC 2 compliance for the systems that host Kwill.
- Encryption in Transit: All data transmitted to and from our services is encrypted using TLS 1.3/SSL.
- Encryption at Rest: Database and backup contents are encrypted using industry-standard AES-256 encryption.
- Row-Level Security (RLS): We utilize strict Row-Level Security policies to ensure user data isolation at the database level.
5. Third-Party Services & Subprocessors
We share relevant data with trusted third-party subprocessors to help operate, analyze, and improve our services:
- Supabase: User authentication, session management, database hosting, and data storage with Row-Level Security.
- Vercel: Application hosting, deployment, and serverless compute infrastructure.
- Resend: Delivery of transactional emails.
- Stripe: Payment processing and billing.
- PostHog: Product analytics and user interaction tracking. PostHog may record anonymized session replays (mouse movement, clicks, and scrolls) to help us improve the website experience. Input fields containing personal data (email, name) are masked. Session replay is only active for visitors who accept analytics cookies.
6. Your Rights (GDPR / CCPA)
We do not sell your personal information. Depending on your location, you may have specific rights under laws like the General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA):
- Right to Access: You can request a copy of the personal data we hold about you.
- Right to Delete: You can request the deletion of your account and associated personal data.
- Right to Data Portability: You can request an export of your personal data in a structured, machine-readable format.
- Right to Opt Out of Analytics: California residents may opt out of non-essential analytics where applicable.
To exercise any of these rights, please email us at support@getkwill.com.
7. Cookies
We use cookies and similar technologies to ensure our application functions properly and to help us understand how it is used:
- Strictly Necessary: Session management and user authentication, your cookie choice itself (
cookie_consent), and interface state such as a banner you have dismissed (founding_banner_dismissed). These are always active and are not covered by the consent banner. - Analytics: Set by the Google tag (
_ga,_ga_*), PostHog (ph_*, which may also record anonymized session replays) and Plausible (which sets no cookies at all), to understand user engagement and site performance. - Marketing: Set by the Meta Pixel (
_fbp,_fbc) to measure advertising performance, along with a first-party attribution cookie recording how you first reached us.
Advertising and measurement cookies
We use cookies and similar technologies from Google (Google tag, including Google Ads) and Meta (Meta Pixel) to measure which of our ads lead to sign-ups and to improve our advertising. These tools may collect information such as device identifiers, IP address, pages visited and the actions you take on our site, and share it with Google and Meta.
These cookies are active by default. You can decline them at any time by selecting “Decline” on our cookie banner or on this page; declining switches them off and clears them. Declining does not affect your ability to use Kwill. Google and Meta process this data under their own privacy policies: Google Privacy Policy · Meta Privacy Policy.
PostHog, Plausible and our first-party attribution cookie are only used if you select “Accept”. You can also clear any of these cookies through your browser settings.
8. Data Retention
We retain your account data for the active duration of your subscription plus 30 days following cancellation, after which your account information and associated personal data are permanently deleted or anonymized.
9. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify registered users directly via email prior to the changes taking effect.
10. Contact
If you have questions, concerns, or inquiries regarding this Privacy Policy, please contact us at support@getkwill.com.