Legal

Privacy Policy

How Kudovi collects, uses, and protects personal information when you use our website and services, including the review content we process on behalf of merchants.

Effective date: September 6, 2026

This Privacy Policy explains how Kudovi ("Kudovi", "we", "us") collects, uses, and protects personal information when you use kudovi.com and the Kudovi service (together, the "Service"). Kudovi turns your customers' product reviews into ready-to-post social media Stories.

If you have any questions, contact us at hello@mail.kudovi.com.

Who this policy covers

  • Merchants — people who create a Kudovi account and connect their store, review platform, and social media accounts.
  • Reviewers — your store's customers, whose reviews we receive from your review platform. We process reviewer information on your behalf (see "Our two roles" below).
  • Visitors — anyone browsing kudovi.com.

Our two roles

For merchant account data (your name, email, settings, usage), Kudovi decides how and why data is processed — we act as the data controller.

For reviewer data (the reviews we fetch from your review platform), you, the merchant, decide what happens: you connected the platform, and you approve what gets published. Kudovi acts as your data processor. You are responsible for having a lawful basis to share review content with us and to republish it to social media.

Information we collect

From merchants, directly

  • Account information: name, email address, and a password (stored only as a secure hash), or your Google account profile (name, email, avatar) if you sign in with Google. Two-factor authentication secrets if you enable 2FA.
  • Store and brand settings: your storefront domain, brand handle, typeface choice, scene direction preferences, and posting settings.
  • Connection credentials: API tokens or OAuth tokens for your review platform (for example Judge.me). These are encrypted at rest.
  • Support communications: anything you send us by email.

From merchants, automatically

  • Usage data: pages viewed, features used, and interaction events, collected through PostHog analytics (only if you consent to measurement cookies — see our Cookie Policy).
  • Ad measurement data: if you consent to advertising cookies, the Meta Pixel records that your visit or sign-up followed one of our Meta ads (see our Cookie Policy for the cookies involved).
  • Device and log data: IP address, browser type, and request logs generated by our hosting infrastructure.
  • Cost and generation records: an internal ledger of the Stories, scenes, and publishes your account generates, used for billing, abuse prevention, and service health.

From third parties

  • Reviews: when you connect a review platform, we fetch reviews for your store — reviewer display name, review text, star rating, review title, verified-buyer status, and timestamps. We store review text verbatim and never alter it. We strip data we do not need from the raw platform payload before storing it.
  • Product data: product titles, handles, and product photos fetched from your public storefront.
  • Social account data: when you connect Instagram or TikTok through our publishing partner Zernio, we receive account identifiers, usernames, and connection health status. We never see or store your social media passwords.

Billing data

Subscription payments are processed by Polar Software Inc. ("Polar") as merchant of record. When you buy a plan, Polar collects your name, email, billing address, and payment details directly, under Polar's privacy policy. We never receive or store your card number. From Polar we receive only subscription status, the plan and billing period, and non-card billing metadata (such as an order identifier), which we use to determine your store's entitlements.

What we do NOT collect

  • We do not receive or store card details — payment processing happens entirely at Polar (see "Billing data" above).
  • We do not collect data about children — the Service is for businesses and is not directed at anyone under 18.
  • We do not buy data from data brokers.

How we use information

  • Provide the Service: fetch and qualify reviews, fetch your product photo, compose a scene around it with AI image models, render the Story, and — with your approval — publish it to your connected social accounts.
  • AI scene composition: your product photo and a short scene description are sent to image-generation models (currently Black Forest Labs and Google models, via Vercel AI Gateway) to compose the background scene. The product photo is real; only the setting is generated. Review text is not sent to image models; it is rendered onto the image by our own renderer.
  • Communicate with you: account emails (verification, magic sign-in links, security notices) and operational alerts. We do not send marketing emails without a separate opt-in.
  • Improve the Service: aggregate analytics about which features are used, only with your consent.
  • Security and abuse prevention: rate limits, spend monitoring, and fraud detection.
  • Legal compliance: where we are required to by law.

We do not use your reviews, photos, or Stories to train AI models.

Legal bases (for EU/EEA/UK merchants)

Where the GDPR applies, we rely on:

  • Contract — processing needed to provide the Service you signed up for (account data, connections, review processing, publishing).
  • Consent — measurement/analytics cookies, advertising cookies (Meta Pixel), and any future marketing emails. You can withdraw consent at any time.
  • Legitimate interests — security logging, abuse prevention, and service health monitoring.
  • Legal obligation — where retention or disclosure is required by law.

Who we share data with

We share data only with service providers who help us run the Service, under their own contractual confidentiality and security obligations:

  • Vercel — web hosting and AI model gateway (United States / global edge)
  • Neon — database hosting (United States)
  • Amazon Web Services (S3) — image storage (United States, us-east-1)
  • Trigger.dev — background job processing (United States)
  • Black Forest Labs / Google — AI image composition: receives your product photo and a scene prompt (United States / EU)
  • Zernio — publishing to Instagram and TikTok (see Zernio's policy)
  • Meta (Instagram) / TikTok — receive the Stories you approve for publishing (global)
  • Meta — ad measurement via the Meta Pixel, only if you consent to advertising cookies: receives visit and sign-up events with associated browser identifiers, in Limited Data Use mode for US states with privacy laws (United States)
  • Resend — transactional email delivery (United States)
  • PostHog — product analytics, consent-based (United States)
  • Google — Sign-in with Google (global)
  • Polar Software Inc. — subscription billing and payment processing as merchant of record: receives your name, email, billing address, and payment details when you purchase a plan (United States)

We also disclose information if required by law, court order, or to protect the rights, safety, or property of Kudovi, our merchants, or others.

We do not sell personal information. Where you consent to advertising cookies, the Meta Pixel sends visit and sign-up data to Meta for ad measurement; for residents of US states with privacy laws we enable Meta's Limited Data Use mode, which restricts Meta to acting as our service provider, and elsewhere the pixel runs only on the consent basis described above. You can withdraw advertising consent at any time via the cookie banner.

Published content is public

When you approve a Story, it is published to your Instagram and/or TikTok account and becomes public under those platforms' terms. The Story contains the review text (verbatim), the reviewer's display name as provided by your review platform, your product photo, and an AI-composed background. Stories are labeled as AI-assisted content where the platform provides such a label. Rendered Story images are hosted at publicly reachable URLs, because Instagram's API requires fetching the image from a public URL at publish time.

If a reviewer asks you to remove their review from social media, you are responsible for deleting the post on the platform; we will delete our stored copy on request.

International data transfers

Kudovi operates from Israel; our infrastructure providers are primarily in the United States. Israel benefits from an EU adequacy decision. Transfers to US providers rely on the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses.

Data retention

  • Account data: kept while your account is active. Deleted within 30 days after you delete your account.
  • Reviews and products: kept while the source connection is active; deleted within 30 days after you disconnect the source or delete your account.
  • Rendered Stories and scenes: kept while your account is active so you can reuse them; deleted with your account.
  • Connection credentials: deleted immediately when you disconnect a platform.
  • Generation/cost ledger and security logs: kept up to 24 months for billing integrity and abuse prevention, then deleted or anonymized.
  • Billing records: subscription status and non-card billing metadata are kept with the ledger (up to 24 months); invoices and tax records are retained by Polar, as merchant of record, for as long as the law requires.
  • Emails and support threads: kept up to 24 months.

Your rights

Depending on where you live, you have the right to:

  • Access the personal data we hold about you and receive a copy (portability).
  • Correct inaccurate data.
  • Delete your data ("right to be forgotten").
  • Restrict or object to certain processing.
  • Withdraw consent at any time (e.g., analytics cookies), without affecting past processing.
  • Opt out of any future marketing communications.
  • Not be discriminated against for exercising these rights (California).
  • Complain to a supervisory authority — your local EU/UK data protection authority, the California Attorney General, or the Israeli Privacy Protection Authority.

To exercise any right, email hello@mail.kudovi.com. We respond within 30 days. If you are a reviewer whose review appears in our systems, you can contact us directly or contact the merchant who published your review; we will honor deletion requests for reviewer data and inform the relevant merchant.

Security

  • All traffic is encrypted in transit (TLS). Data is encrypted at rest by our database and storage providers.
  • Review-platform credentials are additionally encrypted at the application level before storage.
  • Passwords are stored only as salted hashes. Two-factor authentication (TOTP) is available on every account.
  • Access to production systems is limited and logged.

No system is 100% secure. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

Cookies

We use strictly necessary cookies (sign-in sessions, consent preferences) and, only with your consent, measurement cookies (PostHog analytics) and advertising cookies (Meta Pixel). Details, names, and how to change your choice are in our Cookie Policy.

Children

The Service is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the effective date. For material changes, we will notify merchants by email or an in-app notice at least 14 days before the change takes effect.

Contact

Kudovi Email: hello@mail.kudovi.com