Legal

Privacy policy

This page details what data we process, why, how long we keep it, and what you can ask of us.

1. Data controller

Art. 13.1.a GDPR

Calltek Network SL, with CIF B75700005 and registered address at Lugar Cantaraba 3, 15313 Irixoa, A Coruña, Spain, processes your data. For any question, write to us at soporte@kujira.so.

2. What data, and why

Art. 13.1.c GDPR

If you register: your name, your email, and your encrypted password, to give you access to your account.

If you subscribe: the billing details we need to charge you and issue the invoice. Your card details never reach our servers; the payment gateway handles them.

While you use the platform: what you do inside is logged — what you create, what you change, who reveals a credential — because that's what lets us audit your organization and respond when something goes wrong.

When you visit this website: the page you open, the address you arrive from, your country, language, and device type. It's measured by a program of ours, hosted on our own infrastructure, that doesn't set cookies or store your IP address. It's there to know what gets read, and it's detailed in the cookie policy.

In your agents' conversations: messages are stored so the agent has memory and so you can review them as an operator. This is the most sensitive part, so you should know it goes through our control plane even when the agent runs on your own machine.

4. Retention period

Art. 13.2.a GDPR

We keep your data while your account is active. When you close it, we delete it, except for what we must retain under a legal obligation — billing data in particular — for as long as that obligation requires.

Website visit statistics are kept indefinitely, because they're aggregated and not tied to any identifiable person.

5. Recipients

Art. 13.1.e GDPR

We don't share your data with anyone who doesn't need it to operate the platform. These are the services that process it on our behalf:

  • Stripe — Payments and subscriptions.
  • Resend — Sends the platform's emails.
  • Cloudflare R2 — File storage.
  • Sentry — Monitoring and error logging for the platform.

Website analytics isn't on this list either, and that's deliberate: the program that measures visits runs on our own infrastructure, so no third party receives that data. The AI model provider you use for your agents isn't on this list: you choose and contract it directly, not us, so it isn't a service that processes data on our behalf.

6. International transfers

Art. 13.1.f GDPR

Some of the services in the previous clause may process data outside the European Economic Area. When that happens, we rely on the European Union's standard contractual clauses or another equivalent safeguard offered by that provider.

7. Your rights

Arts. 15 to 21 GDPR

You can access your data, correct it, delete it, restrict or object to its processing, and take it elsewhere. To exercise any of these rights, write to us at soporte@kujira.so and prove your identity.

If you believe we haven't handled this properly, you can file a complaint with the Spanish Data Protection Agency (AEPD), under Article 77 of the GDPR.

8. Your own customers

The above covers your relationship with us as the account holder. If your organization processes its own customers' data through your agents, that makes you the data controller for that processing and us the data processor, with the obligations set out in Article 28 of the GDPR and covered in the data processing agreement.