Privacy policy

Kavalu is operated by Urban Folklore Ltd. This policy explains what Kavalu stores about you, which companies it sends data to in order to work, and how you can get a copy of your data or have your account deleted.

Urban Folklore Ltd is a company registered in England and Wales (company number 15418082), with its registered office at 2 Tadley Close, Fleet, GU51 1DS, England. It is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. In this policy, "we" and "us" mean Urban Folklore Ltd. You can contact us at support@kavalu.com.

How Kavalu handles a request

When you ask Kavalu to explain, summarize, translate, read aloud or research something, this is what happens:

1. The extension sends your request to Kavalu's server over an encrypted connection: the text you selected (or the page's text, if you asked about the whole page), your question, or an image you asked about, with the title and address of the page for context.
2. Kavalu checks your plan. It confirms that you are signed in and within your plan's limits. Only then does it pass the request to the company whose AI answers it (see "Who we share data with"). Some actions also pass the page's title to that company, and Diagram passes its address too.
3. The answer comes back to the side panel.
4. Kavalu does not store your text or the answer. It records only numbers about the request (see "What Kavalu stores").
5. Cards you save stay on your device, not on our servers.

Your text goes only to the company that answers the request.

What the extension can do in Chrome

Kavalu asks Chrome for these permissions, and reads a page only when you ask it to:

• Side panel: where Kavalu's results appear. It is Kavalu's only interface.
• Reading the current tab: Kavalu reads the selection or the text of a tab only when you ask. You start it on that tab (the toolbar button, a keyboard shortcut or the right-click menu), or you ask from the panel on a site you've allowed or once you've allowed all sites.
• Right-click menu: the Kavalu entries for selected text, pages and images.
• Storage: keeps your sign-in, your saved cards and your settings on your device, and a tab's conversation in memory until the tab closes.
• Sign-in: lets you sign in with Google.
• Network access: sends your requests to Kavalu's server and refreshes your sign-in.
• Optional access to sites: Kavalu asks Chrome for access to all sites only when you choose "Allow on all sites", switch on "Read any page I ask about" in Settings, or turn on the selection button, which is off by default. It asks for one site only when you press "Allow on this site" or "Only on" a site's name. You can take either back in Settings.

Kavalu does not read pages as they load, in the background or when you switch tabs.

What Kavalu stores

Your account

You sign in with Google. Kavalu's database, hosted by Supabase, then holds:

• Your email address, and the name and picture your Google account shares with apps
• An account ID, your plan, and your subscription's status and dates
• Your preferences, such as your language, and the settings you choose in the dashboard

Billing

Paddle sells Kavalu Pro. Paddle collects your payment details and billing information, and Kavalu never sees your card number. Kavalu receives from Paddle the plan you bought, the amount, the dates and Paddle's IDs for you and your subscription, and keeps them with your account.

Usage records

Each time you use an action, Kavalu records which action it was, how many credits it cost, how much text or audio was processed (token or character counts), which AI model and, for Listen, which voice and language, an estimated cost to us, a request ID, your browser's user-agent text and the time. It never records the text itself. We use these records to apply your plan's limits, to show you your usage, and to keep track of what the service costs to run.

Technical logs

Kavalu's server keeps technical logs: the time of a request, the route it asked for, the response and your IP address. They are kept for 30 days, to fix problems and stop abuse. Rate limiting also keeps a counter for some public routes, keyed by your IP address, for about a day. Our hosting providers may keep their own logs under their own privacy policies.

What stays on your device

• Cards you save, with the title and address of the page each came from, in the extension's storage in your Chrome profile. Kavalu does not upload them.
• Your settings: language, auto-translate, the selection button and the sites where it is hidden, and Listen's speed. Your language and auto-translate setting also go to your account, so the extension and the dashboard match.
• Your sign-in session, so you stay signed in.
• A tab's conversation, in memory (not on disk), until you close the tab, sign out or restart the browser.

How we use your information

We use the information above to:

• Answer your requests and apply your plan's limits
• Keep you signed in and manage your subscription
• Send you notices about your account, your plan or these policies
• Review usage counts, never your text, to keep limits fair and costs under control
• Help you when you contact support
• Meet our legal obligations

We do not use your text to train AI models, and we do not use your data for advertising.

Who we share data with

Kavalu uses these companies to do its work. Each receives only what its job needs:

• Anthropic: Writes the answers for Explain, Summarize, Ask (including questions about an image), Translate, Quiz me and Diagram. Privacy policy
• OpenAI: Writes those answers when Anthropic is unavailable, makes your cards, grades your quiz answers, and answers Deeper dive with web search. Privacy policy
• Google: Signs you in with your Google account. Through Google Cloud Text-to-Speech it also reads text aloud in Listen, for every language Kavalu can read aloud. Privacy policy
• Supabase: Runs sign-in and holds Kavalu's database: your account, plan, preferences and usage records. Privacy policy
• Amazon Web Services (AWS): Runs Kavalu's server, which receives your requests. Privacy policy
• Vercel: Hosts this website. Privacy policy
• Paddle: Sells Kavalu Pro as the seller of record: takes your payment, issues your receipt and handles tax. Privacy policy
• Zoho: Handles the email you send to support@kavalu.com. Privacy policy

We use the AI companies' business API services, not their consumer apps. OpenAI states in its API terms that it does not use API data to train its models. AI companies may keep requests for a limited time to detect abuse, under their own policies, which we do not control. Read their privacy policies if that matters to you.

Transfers outside the UK

Some of the companies named under "Who we share data with" process data outside the UK, mainly in the United States. Where they do, it happens under the safeguards UK data protection law requires: the UK's adequacy regulations, including the UK–US data bridge for certified companies, or the international data transfer addendum to the standard contractual clauses in their data processing terms.

Chrome Web Store Limited Use

Kavalu's use of information it receives through its Chrome extension follows the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular:

• We use it only to provide the features you ask for and to run the service behind them, as listed under "How we use your information".
• We do not sell it.
• We do not use it for advertising, or to decide creditworthiness or lending.
• Nobody at Kavalu reads it, except with your permission, to keep Kavalu secure or investigate abuse, where the law requires it, or in totals that identify no one.

Cookies and similar technologies

This website sets only the cookies that keep you signed in. The Chrome extension does not use cookies. Paddle's checkout script loads from Paddle's servers on this website so that checkout can open, and runs under Paddle's privacy policy. We do not run advertising or analytics scripts on this website or in the extension.

Security

We protect your information in these ways:

• Encryption in transit: all traffic between the extension, this website and Kavalu's server uses HTTPS.
• Keys stay on our server: the keys for the AI companies never reach the extension or this website.
• Sign-in comes first: every AI request needs you to be signed in, and your plan's limits are checked before any AI company is called.
• Cards stay in the extension: your cards and settings sit in the extension's own storage in your Chrome profile, which web pages cannot read.
• No stored content: Kavalu does not store your text or the answers.
• Limited collection: we keep only what this policy lists.

Your rights and choices

Get a copy of your data, or delete your account

Email support@kavalu.com to get a copy of the data we hold about you, or to have your account deleted. Put "Privacy request" in the subject line. Deleting your account removes your profile, preferences, subscription and usage records. Copies in backups and logs, and the payment records Paddle keeps as the seller of record, may remain, as the law and those companies' policies allow.

What you can do yourself

• Export your cards for Anki from the Cards library (Export for Anki). Anki can sync them to your other devices.
• Download a diagram as an image (SVG or PNG) from its Download menu.
• Edit or delete any card in the Cards library.
• Change your language and other settings in the extension's Settings and in the dashboard.
• Remove the sites you allowed under Page access in Settings.
• Clear everything the extension keeps by removing the extension, or its data, in Chrome.

UK GDPR, EU GDPR and CCPA

Your rights in the UK and the EU (UK GDPR and EU GDPR)

We process your data to provide Kavalu to you, which is the agreement between us, and for our legitimate interests in keeping it working and secure. You have the right to:

• Access your data
• Have it corrected
• Have it erased
• Restrict how we use it
• Take it with you (data portability)
• Object to our use of it
• Withdraw consent, where we rely on it
• Complain to your data protection authority

Email us to use any of these rights. We will answer within one month of receiving your request.

If you are unhappy with how we have used your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you live in the EU, to the data protection authority where you live.

For California residents (CCPA)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information we collect (this page)
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell your data, and we do not share it for advertising)
• Not be treated differently for using these rights

Email us to use these rights.

Children's privacy

Kavalu is not intended for children under 13 years of age, or under the minimum age to consent to data processing where they live, if that is higher. We do not knowingly collect personal information from these children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Changes to this policy

We may update this policy to reflect changes in how Kavalu works or in the law. When we do, we update the "Last updated" date at the top. If a change affects how we handle your data, we will tell registered users by email.

Contact us

If you have any questions about this policy or our data practices, please contact us:

To ask a privacy question or use your data rights, email support@kavalu.com with "Privacy request" in the subject line.