Privacy Policy

1 Introduction

Welcome to Kevv (the "Service"), operated by Kevv AI Labs Inc. ("we," "us," or "our"), a company incorporated in the State of New York, United States. We are committed to protecting the privacy of our users ("you" or "your") and handling your data with transparency and care.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our AI-powered CRM platform, including our website at kevv.ai, our mobile applications (iOS and Android), and all related services.

By accessing or using Kevv, you agree to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our Service.

2 Information We Collect

2.1 Information You Provide Directly

• Account information: name, email address, phone number, brokerage name, license number, and profile photo.
• CRM data: contacts, leads, client notes, transaction details, pipeline stage information, and communication logs you manually create.
• Payment information: billing details processed through our third-party payment provider (Stripe). We do not store your full credit card numbers on our servers.
• Voice data: audio recordings and transcriptions when you use our voice-to-action features (processed in real-time and discarded after action execution, unless you explicitly enable persistent logging).
• Communications: messages you send to us via support channels, feedback forms, or email.

2.2 Information Collected Automatically

• Device information: device type, operating system version, browser type, screen resolution, and unique device identifiers.
• Usage data: pages visited, features used, actions taken, session duration, timestamps, and referral URLs.
• Log data: IP addresses, server logs, error reports, and diagnostic data.
• Cookies & similar technologies: session cookies, analytics cookies, and local storage for preferences (e.g., theme settings). We do not use cookies for third-party advertising.

2.3 Information from Third-Party Integrations

When you connect third-party services — such as Google (Gmail, Calendar) or Microsoft (Outlook, Calendar) — we receive limited data as described in Sections 3 and 4 below. We only request the minimum permissions necessary to provide the CRM features you have authorized.

3 Google User Data & Gmail Integration

3.1 What We Access

When you authorize Kevv to connect with your Google account, we request the following permissions:

• Gmail Send (gmail.send): To send follow-up emails to your real estate clients and leads on your behalf directly from your Gmail account.
• Gmail Read (gmail.readonly): To read incoming email messages in order to track client replies, detect engagement, and update your CRM pipeline automatically.
• Gmail Metadata: To access email headers (sender, recipient, subject line, date/time) for organizing communication logs within your CRM.
• User Profile (userinfo.email, userinfo.profile): To identify your account and display your name and profile picture within Kevv.

3.2 How We Use Your Gmail Data

We use your Gmail data exclusively for the following purposes:

• Sending follow-up emails: When you instruct Kevv (via voice command, manual trigger, or automated schedule), we send emails from your Gmail account to your designated clients and leads. Every email is sent as you and on your behalf.
• Tracking client engagement: We monitor replies and read receipts to update lead scores and pipeline stages in your CRM.
• AI-drafted communications: Our AI generates email drafts for your review based on your contacts' history, pipeline stage, and your preferred communication style. You always have the option to review, edit, or approve before sending.
• Communication logging: Email metadata (subject, date, participants) is stored in your CRM to provide a complete client timeline.

3.3 What We Do NOT Do with Your Gmail Data

• We do not sell, rent, or lease your Gmail data to any third party.
• We do not use your Gmail data for advertising, market research, or for building user profiles for ad targeting.
• We do not share your Gmail content with other Kevv users or any unrelated services.
• We do not train general-purpose AI/ML models on your Gmail data. Any machine learning is applied solely to improve your individual CRM experience (e.g., learning your preferred drafting style).
• We do not retain the full body of emails longer than necessary to perform the requested CRM function.
• We do not allow human employees to read your Gmail content unless you provide affirmative consent, it is required for security purposes, or it is required by applicable law.

3.4 Data Minimization

We follow the principle of data minimization for Gmail data. We only access the specific emails, threads, and metadata necessary to perform the CRM functions you have requested. We do not bulk-download or index your entire Gmail inbox.

4 Microsoft Email Data & Outlook Integration

4.1 What We Access

When you authorize Kevv to connect with your Microsoft account (Outlook / Microsoft 365), we request the following permissions:

• Mail.Send: To send follow-up emails to your real estate clients and leads on your behalf from your Outlook account.
• Mail.Read: To read incoming messages for tracking client replies, detecting engagement, and updating your CRM pipeline.
• User.Read: To retrieve your profile information (name, email) for account identification.

4.2 How We Use Your Microsoft Email Data

We use your Microsoft email data in the same manner as described in Section 3.2 for Gmail data. All uses are strictly limited to CRM functions that you have authorized — sending follow-up emails on your behalf, tracking engagement, AI-drafted communications, and communication logging.

4.3 What We Do NOT Do with Your Microsoft Email Data

The same restrictions described in Section 3.3 apply equally to your Microsoft email data. We do not sell, share for advertising, or use your email content for purposes beyond the CRM features you have authorized.

5 How We Use Your Information

Beyond the email-specific uses described above, we use your information for:

• Providing the Service: Operating your CRM, managing contacts, tracking pipelines, processing transactions, and enabling referral matching.
• AI Features: Powering proactive priority engine suggestions, deal scoring, voice-to-action, and intelligent follow-up scheduling — all personalized to your real estate practice.
• Communication: Sending you service-related notifications, billing confirmations, product updates, and security alerts.
• Improvement: Analyzing anonymized, aggregated usage patterns to improve Service reliability, performance, and features.
• Security: Detecting and preventing fraud, abuse, and unauthorized access.
• Legal compliance: Meeting regulatory obligations and responding to lawful requests.

6 Data Sharing & Disclosure

We may share information only in the following limited circumstances:

• Service providers: We use trusted sub-processors (e.g., cloud hosting, payment processing, email delivery infrastructure) who are contractually bound to protect your data and use it only for providing services to us. Our current sub-processors include Amazon Web Services (hosting), Stripe (payments), and OpenAI (AI features — only anonymized, non-email data).
• With your consent: When you explicitly authorize sharing, such as connecting integrations or sharing referrals with other agents on the Kevv platform.
• Team members: If you are part of a brokerage team on Kevv, your team administrator may have access to certain team-level activity and pipeline data, as configured by your team admin.
• Legal obligations: When required by law, subpoena, court order, or to protect the rights, property, or safety of Kevv AI Labs Inc., our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and/or prominent notice before your data is transferred and becomes subject to a different privacy policy.

7 Data Storage & Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2+ (HTTPS).
• Encryption at rest: Sensitive data stored in our databases is encrypted using AES-256 encryption.
• Access controls: Role-based access controls (RBAC) limit employee access to user data to only those who need it for support or operations. Access is logged and audited.
• Infrastructure: Our services are hosted on SOC 2 Type II compliant cloud infrastructure in the United States.
• OAuth tokens: Gmail and Microsoft OAuth tokens are encrypted and stored securely. We never store your email account password.
• Regular audits: We conduct periodic security reviews, penetration testing, and vulnerability assessments.
• Incident response: We maintain an incident response plan and designated security team for prompt breach detection and remediation.

8 Data Retention

We retain your data only as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:

• Account data: Retained for the duration of your active account plus 30 days after deletion request to allow for recovery.
• CRM data: Retained as long as your account is active. Deleted or anonymized within 90 days of account closure.
• Email content: Email metadata is retained in your CRM timeline. Full email bodies are cached temporarily (up to 72 hours) for processing and then discarded; only metadata and AI-generated summaries are permanently retained.
• Voice data: Audio is processed in real-time and discarded immediately after action execution. Transcriptions may be retained in activity logs only if you have explicitly enabled this feature.
• Logs & analytics: Server logs are retained for 90 days. Analytics data is anonymized after 12 months.
• Legal holds: Data may be retained longer if required by law, regulation, or legal proceedings.

9 Your Rights & Choices

Regardless of where you reside, you have the following rights regarding your personal data:

• Access & portability: Request a copy of all personal data we hold about you in a portable, machine-readable format (CSV, JSON).
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and all associated data.
• Revoke integrations: Disconnect your Gmail or Microsoft account at any time from Settings → Integrations. This immediately revokes our access to your email data.
• Opt out of communications: Unsubscribe from marketing emails at any time (service-critical communications such as security alerts may still be sent).
• Cookie preferences: Control cookie usage through your browser settings.
• Restrict processing: Request that we limit how we use your data in certain circumstances.

To exercise any of these rights, contact us at support@kevv.ai. We will acknowledge your request within 10 business days and fulfill verifiable requests within 45 days (extendable by an additional 45 days for complex requests, with notice to you).

We will not discriminate against you for exercising any of your privacy rights. You will not receive different pricing, a different quality of service, or be denied service for exercising these rights.

10 California Privacy Rights (CCPA/CPRA)

10.1 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information (as defined by the CCPA):

• Identifiers: name, email address, phone number, IP address, device identifiers.
• Commercial information: subscription plan, billing history, transaction records within the CRM.
• Internet or electronic network activity: browsing history on our site, feature usage, interaction data.
• Professional information: brokerage name, real estate license number, professional role.
• Audio/visual information: voice recordings when using voice-to-action (transient processing only).
• Inferences: AI-generated lead scores, priority rankings, and client engagement insights.

10.2 Right to Know

You have the right to request that we disclose: (a) the categories of personal information we have collected about you; (b) the categories of sources; (c) the business or commercial purpose for collecting or selling the information; (d) the categories of third parties with whom we share the information; and (e) the specific pieces of personal information we have collected about you.

10.3 Right to Delete

You have the right to request that we delete any personal information we have collected about you, subject to certain exceptions provided by law (e.g., completing a transaction, detecting security incidents, complying with legal obligations).

10.4 Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

10.5 Right to Opt-Out of the Sale or Sharing of Personal Information

We do not sell your personal information. We do not "share" your personal information (as defined by the CPRA) for cross-context behavioral advertising purposes. Because we do not engage in these activities, there is no need for a "Do Not Sell or Share My Personal Information" mechanism, but we will honor any such request received.

10.6 Right to Limit Use of Sensitive Personal Information

We do not use or disclose sensitive personal information for purposes other than those permitted under the CPRA (i.e., providing the Service you requested).

10.7 Non-Discrimination

We will not deny you services, charge different prices, provide a different level of quality, or suggest any of the above as a consequence of exercising your CCPA/CPRA rights.

10.8 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We will require verification of both your identity and the agent's authority to act on your behalf (e.g., a signed written authorization or power of attorney).

10.9 How to Submit Requests

California residents may submit requests by emailing support@kevv.ai with the subject line "California Privacy Request." We will verify your identity before fulfilling any request and respond within 45 days.

11 Additional U.S. State Privacy Rights

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or other U.S. states with comprehensive privacy laws, you may have additional rights including:

• The right to confirm whether we are processing your personal data.
• The right to access, correct, or delete your personal data.
• The right to obtain a copy of your personal data in a portable format.
• The right to opt out of the processing of personal data for targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

As noted throughout this policy, we do not sell personal data or use it for targeted advertising. To exercise any state-specific privacy rights, contact us at support@kevv.ai. If you are unsatisfied with our response, you may have the right to appeal our decision by contacting us, or to lodge a complaint with your state's Attorney General.

12 Google API Services User Data Policy Compliance

Specifically, we certify that:

1. We only use Google user data for the purposes described in this Privacy Policy and as permitted by the Limited Use requirements.
2. We only transfer Google user data to third parties when (a) necessary to provide or improve user-facing features that are prominent in your use of Kevv, (b) with your affirmative consent, (c) for security purposes (e.g., investigating abuse), or (d) to comply with applicable law.
3. We do not use Google user data to serve advertisements.
4. We do not allow humans to read Google user data unless (a) we have your affirmative agreement for specific messages, (b) it is necessary for security purposes, (c) required to comply with applicable law, or (d) the data has been aggregated and anonymized for internal operations and no longer identifies individual users.

13 Data Breach Notification

In the event of a security breach involving your personal information, we will:

• Investigate promptly: Our security team will immediately investigate the scope and nature of the breach.
• Notify affected users: We will notify you via email and/or prominent notice on the Service without unreasonable delay and, in any event, within the timeframes required by applicable federal and state law (e.g., within 72 hours where required).
• Notification content: Our notification will include: a description of the incident, the types of data affected, steps we have taken to address the breach, steps you can take to protect yourself, and contact information for our security team.
• Notify regulators: We will notify applicable state Attorneys General and other regulatory authorities as required by applicable law (including laws in California, New York, and all other U.S. states with breach notification requirements).
• Mitigate harm: We will take all reasonable steps to mitigate any harm resulting from the breach, which may include resetting affected OAuth tokens and revoking compromised access.

14 Children's Privacy

Kevv is designed exclusively for real estate professionals and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 13 (or under 16 in certain jurisdictions). If we learn that we have collected data from a child, we will promptly delete that information. If you believe a child has provided us with personal information, please contact us at support@kevv.ai.

15 International Data Transfers

Our servers are located in the United States. If you access Kevv from outside the United States, your data will be transferred to, stored, and processed in the United States. By using our Service, you acknowledge and consent to this transfer. We take steps to ensure that your data receives an adequate level of protection in accordance with applicable data protection laws, including implementing appropriate safeguards for any international transfers.

16 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will:

• Notify you via email to the address associated with your account.
• Post a prominent notice on our Service.
• Update the "Last Updated" date at the top of this page.
• Provide at least 30 days' notice before material changes take effect.

Your continued use of Kevv after the effective date constitutes acceptance of the updated policy. If you do not agree, you should stop using the Service before the changes take effect.

17 Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

• Company: Kevv AI Labs Inc.
• Email: support@kevv.ai
• General Inquiries: info@kevv.ai
• Website: https://kevv.ai

We aim to respond to all privacy-related inquiries within 10 business days.