Privacy Policy

1. Scope and our role

This policy covers personal information we handle as a business — visitors to our website, people who create a Kuudo account, and people who contact us. It does not change the terms of any agreement between Kuudo and a customer organization.

Kuudo plays two different roles depending on the data:

• For your account, billing, website, and support data, Kuudo is the “controller” — we decide why and how that information is used, and this policy governs it.
• For Customer Data (the Amazon and business data processed through the Service), your organization controls the processing. Because the Service runs in your own cloud, Kuudo does not receive or have access to that data and does not act as its processor in the standard deployment. See Section 3 and our Data Processing Addendum (“DPA”).
• For cloud orchestration and Amazon authorization data, Kuudo acts as your processor. We process limited cloud account details, deployment configuration, service status, scoped cloud keys or tokens, and—when you use our Amazon authorization service—OAuth credentials and connected-account metadata needed to operate those control-plane services.

2. Information we collect

Information you give us

• Account information — name, work email, company name, and credentials when you register at app.kuudo.com. Passwords are stored only as salted hashes.
• Billing information — plan, billing contact, and transaction records. Card details are handled by our payment processor; we do not store full card numbers.
• Communications — messages you send us for support, sales, or other requests, including their contents and attachments.
• Cloud orchestration data — cloud account, tenant, subscription, project, region, resource, and role identifiers; deployment configuration; and scoped keys, tokens, service identities, or role-assumption details you authorize us to use to deploy and orchestrate the Service in your cloud account.
• Amazon authorization data — OAuth authorization codes and state records; encrypted Amazon refresh tokens and, for bring-your-own-app connections, encrypted client secrets; short-lived access tokens; Amazon user, seller, advertising-profile, marketplace, region, account, and connection metadata; and authorization audit records.

Information we collect automatically

• Usage and device data — pages viewed, features used, referring URLs, approximate location derived from IP, browser and device type, and timestamps.
• Service telemetry — operational logs and metadata (for example, that a deployment is healthy or that a job ran), used to operate, secure, and support the Service. This is metadata about the Service, not the contents of your Customer Data.
• Cookies and similar technologies — see Section 11.

Information from third parties

• Identity and login providers — if you sign in through a third-party identity provider, we receive the limited profile details needed to authenticate you. Amazon account authorization is described separately above and in Section 3.
• Service providers — vendors such as our payment processor or analytics provider may share limited information with us to deliver their part of the Service.

3. Customer Data and Amazon data

“Customer Data” means the data your organization connects to or processes through the Service — including data drawn from Amazon Ads, Amazon Marketing Cloud, the Selling Partner API, Vendor Central, your data warehouse, and other sources you connect, along with the outputs created from it.

Because Kuudo is deployed inside your own cloud account, Customer Data is processed within your environment and under your control. The client tools you choose connect directly to resources deployed in your private cloud account; their requests and the resulting Amazon data or outputs are exchanged on that direct connection. Kuudo is not in that data path and does not receive or have access to that data in the standard deployment. Specifically:

• We do not use Customer Data to train, fine-tune, or improve any artificial-intelligence model — ours or any third party's.
• We do not sell Customer Data or share it with other customers.
• We do not host, copy, cache, inspect, retrieve, or otherwise access Amazon business data or outputs.
• You must redact Customer Data from any support material you voluntarily send to us.

Control-plane information is separate. Kuudo stores and uses limited cloud-management information and scoped credentials needed to deploy and orchestrate resources in your cloud account. If you use Kuudo's Amazon authorization service, we also receive and encrypt Amazon refresh tokens (and customer application secrets in bring-your-own-app mode), exchange them for short-lived access tokens, and issue those access tokens to authenticated service runtimes you authorize. We may retain limited account, advertising-profile, seller, marketplace, region, connection-status, and audit metadata needed to identify and operate the connection. This authorization service does not proxy your substantive Amazon API requests or responses.

Amazon Information. Where the Service processes information obtained through Amazon's APIs, that information is used solely to provide the Service to the customer it belongs to, whether within Customer's deployment or as limited authorization metadata in Kuudo's control plane, and is handled in accordance with applicable Amazon policies, including the Amazon Acceptable Use Policy and the Amazon Selling Partner API Data Protection Policy. We do not use Amazon Information for advertising or to build profiles for any party other than the customer it belongs to.

4. How we use information

We use the information described in Section 2 to:

• provide, maintain, and improve the website and the Service;
• create and administer your account and authenticate you;
• process payments and manage billing;
• respond to your requests and provide support;
• send service and administrative messages, and — where permitted — relevant product updates you can opt out of;
• monitor, secure, and troubleshoot the Service, and detect and prevent fraud or abuse;
• comply with legal obligations and enforce our terms.

We do not use your personal information to train AI models, and we do not sell it.

5. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

• Contract — to provide the Service and your account.
• Legitimate interests — to secure, operate, and improve the Service and communicate with you, balanced against your rights.
• Consent — for certain cookies and marketing communications, where required; you may withdraw consent at any time.
• Legal obligation — to meet our legal and regulatory duties.

6. Who we share information with

We share personal information only in these circumstances:

• Service providers / subprocessors — vendors who process information on our behalf under contract (for example, website hosting, payment processing, email delivery, and customer support). A current list is on our Subprocessors page.
• Legal and safety — where required by law, legal process, or to protect the rights, safety, and security of Kuudo, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your direction — when you ask us to share information or enable an integration.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7. Data retention

We keep personal information only as long as needed for the purposes in this policy — typically for the life of your account and for a limited period afterward to meet legal, accounting, or security obligations ([specify retention periods]). Customer Data is retained and deleted under your organization's agreement and DPA; because it lives in your cloud, you control its lifecycle.

8. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and least-privilege practices. No system is perfectly secure, but we work to protect your information and to notify you and regulators of incidents as required by law.

9. International data transfers

We may process information in countries other than your own. Where we transfer personal information across borders, we use appropriate safeguards — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — and take additional measures where required.

10. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal information; to object to or restrict certain processing; and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

California residents. Under the CCPA/CPRA you have the rights to know, delete, correct, and to opt out of the “sale” or “sharing” of personal information and to limit use of sensitive personal information. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for purposes that require a limitation right. We will not discriminate against you for exercising your rights.

To exercise any right, contact us at contact@kuudo.com. We will verify your request and respond within the timeframes required by law. If our Service processes your information on behalf of a customer organization (as a processor), we will refer your request to that organization.

11. Cookies and tracking

We use strictly necessary cookies to run the website and the Service, and — with consent where required — analytics cookies to understand usage so we can improve. You can control cookies through your browser settings and, where offered, our cookie controls. We honor Global Privacy Control (GPC) signals where applicable.

12. Children's privacy

The Service is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “last updated” date above and, where appropriate, notify you. Your continued use of the Service after an update means you accept the revised policy.

14. How to contact us

For privacy questions or to exercise your rights, contact:

• Kuudo, an Openbridge Inc. company
• 145 Tremont Street
  Suite 201 -1185
  Boston, MA 02111
  United States
• Email: contact@kuudo.com
• Data Protection Officer / EU & UK representative: [if applicable]

See also our Terms.