1. Overview
This Privacy Policy applies from 12 June 2026 and was last updated on 12 June 2026. It explains how KUGA AI LTD ("Kuga", "we", "us", or "our") collects, uses, discloses, transfers, stores and protects personal data when people visit our websites, create or use Kuga accounts, use our dashboards, agents, widgets, scripts, APIs, integrations, support, marketing, communications, previews, demos and related services.
Kuga provides white-label AI infrastructure for businesses, agencies and their clients. Depending on the context, Kuga may act as a controller of personal data, a processor on behalf of a customer, or both for different parts of the same service. This Policy explains those roles and how privacy rights can be exercised.
If you use a Kuga-powered agent, widget, preview, dashboard or client portal provided by one of our customers, that customer may be the controller of your personal data. In that situation, you should review that customer's own privacy notice and contact them first for questions about their use of your data. We will support our customer where required by law and contract.
2. Who we are
2.1 Controller identity
Kuga is operated by KUGA AI LTD, a company registered in England and Wales under company number 16189235. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom.
2.2 ICO registration
KUGA AI LTD is registered with the Information Commissioner's Office under registration number ZC015340.
2.3 Contact details
For privacy questions, requests or notices, contact legal@kuga.ai or write to KUGA AI LTD at our registered office. Please include enough information for us to identify the relevant account, customer, agent, communication or request.
3. Scope of this Policy
3.1 Services covered
This Policy covers personal data processed through Kuga websites, product pages, accounts, agency and customer dashboards, client portals, hosted agents, chat widgets, scripts, APIs, integrations, demos, preview links, support channels, billing processes, operational communications, marketing and events.
3.2 Customer services and white-label use
Kuga customers may deploy agents under their own brand, domain, client relationship or instructions. Where the customer determines the purposes and means of processing, that customer is responsible for giving appropriate privacy information, obtaining any required consent, choosing lawful bases, responding to data subject requests and complying with sector-specific obligations.
3.3 Third-party services
The Services may contain links to third-party websites, platforms, tools or integrations. This Policy does not cover third-party privacy practices. Where you choose to connect or use a third-party integration, that third party may process data under its own terms and privacy notice.
4. Personal data we collect
4.1 Account and profile data
We may collect names, business names, job titles, email addresses, phone numbers, login credentials or authentication identifiers, account preferences, workspace details, user roles, permissions, profile settings and similar account information.
4.2 Business, agency and client data
We may collect information about agencies, customers, client organisations, team members, assigned workspaces, plan type, usage limits, onboarding details, business profiles, deployment settings, billing contacts, contracts, invoices, tax information and commercial correspondence.
4.3 Customer content and agent data
Customers may submit, upload, generate, configure or connect content, prompts, knowledge sources, business information, documents, URLs, instructions, workflows, conversation logs, transcripts, support messages, user questions, answer outputs, metadata, and integration payloads. This data may include personal data depending on how a customer uses the Services.
4.4 End-user interaction data
If a person interacts with a Kuga-powered agent, widget or preview, we may process chat messages, form submissions, contact details, interaction timestamps, session identifiers, routing data, feedback, agent responses, conversation context and technical metadata. The customer deploying the agent may control the purposes for this processing.
4.5 Payment and transaction data
We may process plan selections, billing status, invoices, payment confirmation, failed payment information, refunds, credits, subscription history and limited payment-related identifiers. Full payment card details are normally processed by payment service providers rather than stored directly by Kuga.
4.6 Device, usage and log data
We may collect IP addresses, device identifiers, browser type, operating system, pages viewed, referring URLs, approximate location derived from IP address, timestamps, feature usage, clickstream data, error logs, diagnostic data, performance data, security logs and other telemetry necessary to operate, secure and improve the Services.
4.7 Communications and support data
We may collect messages, emails, call notes, attachments, support tickets, survey responses, sales enquiries, demo requests, feedback, complaint records and information provided in correspondence with us.
4.8 Marketing data
We may collect marketing preferences, consent records, event attendance, campaign interactions, unsubscribe details, lead source, website interaction data and business contact information for prospective customers.
4.9 Sensitive and special category data
Kuga does not require customers or users to submit special category data, criminal offence data, government identifiers, payment card numbers, passwords for third-party services, health data, biometric data or highly sensitive data unless explicitly agreed in writing and lawfully configured. Customers and users must avoid submitting unnecessary sensitive information.
5. Sources of personal data
We collect personal data directly from you, from your organisation, from Kuga customers and their authorised users, from end users who interact with deployed agents, from connected integrations you or a customer authorise, from payment and identity verification processes, from website and product usage, from communications with us, from public business sources, and from service providers that support our operations.
Where we receive data from a customer, the customer is responsible for ensuring it has the necessary rights, notices, lawful bases, permissions and instructions to provide that data to Kuga.
6. How we use personal data
6.1 Provide and operate the Services
We use personal data to create and manage accounts, authenticate users, configure workspaces, host and run agents, process prompts and responses, provide dashboards, maintain client portals, support integrations, process billing, deliver support, send service communications and administer contracts.
6.2 Secure the Services
We use personal data to detect, prevent, investigate and respond to fraud, abuse, spam, malware, unauthorised access, misuse, suspicious activity, policy violations, security incidents and attempts to disrupt or compromise the Services.
6.3 Improve and develop Kuga
We may use data to troubleshoot, debug, measure performance, improve reliability, test features, analyse usage, train staff, develop product improvements, conduct quality assurance, improve safety systems and understand customer needs. Where possible, we use aggregated or anonymised information for these purposes.
6.4 Communicate with you
We use contact information to send transactional notices, product updates, onboarding messages, security alerts, support responses, billing notices, legal notices, renewal reminders and administrative communications.
6.5 Marketing and sales
We may use business contact data to send marketing communications, respond to enquiries, provide demos, offer relevant product information, measure campaign performance and manage sales relationships. You can opt out of marketing communications at any time.
6.6 Legal, compliance and enforcement
We use personal data to comply with law, tax, accounting, data protection, corporate governance, regulatory requests, dispute resolution, debt collection, contract enforcement, audit, insurance and record-keeping obligations.
7. Lawful bases
Where UK GDPR or similar laws apply and Kuga acts as controller, we rely on one or more lawful bases depending on the context:
- Contract: to provide the Services, manage accounts, process subscriptions, deliver support and perform agreements with customers or users.
- Legitimate interests: to secure, operate, improve, market and protect Kuga, investigate misuse, prevent fraud, manage business relationships and enforce legal rights, provided those interests are not overridden by individual rights.
- Consent: for certain marketing, cookies, optional analytics, or other processing where consent is required. Consent can be withdrawn at any time.
- Legal obligation: to comply with tax, accounting, corporate, regulatory, data protection, security and lawful request obligations.
- Vital interests or public interest: only where strictly necessary and legally applicable.
Where Kuga acts as processor, the customer is responsible for identifying the lawful basis for its own processing and for giving lawful instructions to Kuga.
8. AI-specific privacy terms
8.1 AI inputs and outputs
Kuga may process prompts, conversation context, knowledge sources, customer instructions, end-user messages and generated outputs to provide agent functionality. AI outputs may be probabilistic and may contain inaccuracies. Customers are responsible for configuring agents appropriately for their use case and for reviewing outputs where required.
8.2 No unnecessary sensitive data
Users and customers should not submit sensitive personal data, confidential third-party data or regulated information unless they have authority to do so, have completed any required assessments and have configured appropriate safeguards.
8.3 Model and service improvement
Kuga may use aggregated, de-identified, anonymised or diagnostic information to improve performance, safety, reliability and product quality. Kuga does not publish customer confidential content or personal data as training material. Any use of customer content for product improvement is subject to the applicable agreement, privacy law and customer settings.
8.4 Automated decisions
Kuga does not intend its Services to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals unless expressly agreed in writing and lawfully configured by the customer. Customers must not use the Services for such decisions without appropriate human review, notices, rights and safeguards.
10. International transfers
Kuga is based in the United Kingdom, but personal data may be processed in other countries where Kuga, customers, users, service providers or integration providers operate. Those countries may have data protection laws different from the country where you live.
Where required, Kuga uses lawful transfer mechanisms such as UK adequacy regulations, EU adequacy decisions, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, EU Standard Contractual Clauses, transfer risk assessments, contractual safeguards or another valid mechanism.
11. Retention
We retain personal data for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain accounts, comply with legal obligations, resolve disputes, enforce agreements, maintain security, keep business records, support backups and audit activity.
Retention periods depend on the type of data, customer settings, account status, plan, legal requirements, backup cycles, dispute risk, security needs and whether the data belongs to a customer-controlled workspace. We may delete, anonymise or aggregate data when it is no longer required.
12. Security
Kuga uses technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss and misuse. Measures may include access controls, authentication, encryption in transit, logging, monitoring, backups, secure development practices, vulnerability management, incident response, personnel confidentiality controls and least-privilege access.
No online service can guarantee absolute security. Customers and users must protect account credentials, configure roles carefully, keep connected systems secure, use appropriate access controls and promptly notify Kuga of suspected unauthorised access or security incidents.
13. Your privacy rights
Depending on where you live and the context of processing, you may have rights to access, correct, delete, restrict, object to processing, request portability, withdraw consent, opt out of marketing, complain to a supervisory authority, or challenge certain automated decisions.
To exercise rights where Kuga is controller, contact legal@kuga.ai. We may need to verify your identity and clarify the scope of your request. Some rights are subject to legal limits, exemptions and competing obligations.
You have the right to object to processing based on legitimate interests, including certain direct marketing. Marketing emails will include an unsubscribe mechanism where required.
If your request relates to data controlled by a Kuga customer, we may direct you to that customer or process the request on the customer's instructions.
If you are in the United Kingdom, you may complain to the Information Commissioner's Office. We encourage you to contact us first so we can try to resolve the issue.
14. Customer-controlled data
14.1 Customer responsibilities
Customers are responsible for the personal data they submit to Kuga or collect through Kuga-powered agents, widgets, forms, scripts, integrations and dashboards. Customers must provide required notices, obtain required consents, choose lawful bases, honour privacy rights, avoid unnecessary data collection and ensure their instructions to Kuga are lawful.
14.2 End users of customer agents
If you interact with a Kuga-powered agent deployed by a customer, that customer may decide what data is collected, why it is collected, how long it is retained, who can access it and how it is used. Kuga processes that data to provide the Services and according to the applicable customer agreement.
14.3 White-label deployments
Some deployments may not visibly identify Kuga because customers use white-label functionality. This does not change the customer's responsibility for its own privacy notices, lawful bases, end-user communications and compliance obligations.
15. Children
The Services are intended for business and professional use and are not directed to children. Customers must not deploy Kuga in a way that knowingly collects personal data from children without all required permissions, notices, safeguards and lawful bases.
16. Changes to this Policy
We may update this Policy from time to time to reflect changes to the Services, law, security practices or business operations. The updated version will be posted on this page with a revised "Last updated" date. Where required by law or contract, we will provide additional notice.
17. Contact
For privacy questions, requests or notices, contact legal@kuga.ai or write to KUGA AI LTD, 128 City Road, London, EC1V 2NX, United Kingdom.