Privacy Policy

How Kuklabs Inc. collects, uses, protects, and handles your personal and business data across KukBook and KukERP applications.

Last updated August 30, 2026 · Effective August 30, 2026

Effective Date: August 30, 2026 Last Updated: November 3, 2026 Entity: Kuklabs Inc. (Delaware, USA, File No. 10663242, D-U-N-S: 145068569)

At Kuklabs Inc. ("Kuklabs", "we", "us", or "our"), we are committed to protecting the privacy, confidentiality, and security of your business and personal data. This Privacy Policy describes our practices regarding the collection, use, disclosure, and protection of information when you use our commercial SaaS enterprise resource planning (ERP) platform, including KukBook, KukERP, and related applications (collectively, the "Services").

1. Roles and Scope

For the purposes of applicable data protection laws (including GDPR, UK GDPR, and India's Digital Personal Data Protection Act):

• Customer as Data Controller: When you enter and manage business data—such as customer records, vendor details, invoices, employee payroll, and financial ledgers—within your tenant organization, you are the Data Controller.
• Kuklabs as Data Processor: Kuklabs processes your business data strictly on your behalf and in accordance with your documented instructions, our Terms of Service, and our Data Processing Addendum (DPA).
• Kuklabs as Data Controller for Account Data: We act as a Controller solely for account administrative data (e.g., account owner email, billing details, and login telemetry).

2. Information We Collect

A. Information You Provide

• Account & Profile Data: Name, work email address, company legal name, tax identification number, phone number, and billing address.
• Business & Transactional Data: Chart of accounts, journal entries, customer and supplier directories, inventory records, purchase orders, sales invoices, and payroll structures entered into your tenant workspace.
• Support & Feedback: Communications, error logs, and tickets submitted to our customer support team.

B. Information Collected Automatically

• System & Usage Telemetry: IP address, browser type, operating system version, page load performance, access timestamps, and UI interaction telemetry.
• Audit Logs: Immutable audit logs of administrative actions, user logins, role modifications, and export operations for your organization's compliance trail.

3. How We Use Your Information

We process information strictly for the following purposes:

1. Service Delivery: Provisioning tenant isolation, executing accounting calculations, generating tax and financial reports, and syncing authorized e-commerce/banking channels.
2. Security & Abuse Prevention: Authenticating user sessions, enforcing role-based access control (RBAC), detecting unauthorized access spikes, and validating webhook signatures.
3. Billing & Subscriptions: Managing recurring software licenses, generating VAT/GST-compliant tax invoices, and processing payments via authorized gateways (Stripe, Razorpay).
4. Legal Compliance: Complying with statutory accounting record retention rules and cooperating with lawful government inquiries where mandated.

We never sell your business data, and we do not use your confidential customer transaction ledgers to train public generative AI models without explicit, opt-in consent.

4. Multi-Tenant Data Isolation & Security

• Logical Tenant Partitioning: Every database query in our platform is cryptographically and logically scoped to your specific `companyId`. Cross-tenant data leakage is prevented via compile-time query policies and regression test gates.
• Encryption:
• In Transit: All traffic is encrypted using TLS (HTTPS) with Strict-Transport-Security (HSTS).
• At Rest: Production data is held on managed cloud infrastructure (see Subprocessors below). We do not publish storage-encryption specifics until they are documented in our security evidence register; contact [email protected] for current details.
• Credential Vault: Third-party integration keys (e.g., payment gateway API secrets) are stored as AES-256-GCM encrypted envelopes in a dedicated credential vault; the encryption keys are held in the application environment, not in the database.

5. Subprocessors & Data Transfers

We share data only with vetted third-party infrastructure and service providers necessary to operate the Services:

• Cloud Infrastructure: Microsoft Azure (application and MySQL database hosting) and an S3-compatible object-storage provider (uploaded files and offsite database backups).
• Payment Processors: Stripe Inc. and Razorpay Software Pvt. Ltd. (PCI-DSS Level 1 compliant).
• Transactional Communications: Google Firebase, Resend, and Cloudflare.

A complete and current list of subprocessors is available at our Subprocessors Page.

6. Data Retention & Deletion

• Active Subscriptions: Your tenant data is retained for the active duration of your subscription.
• Post-Termination Grace Period: Upon contract expiration or tenant cancellation, your data remains accessible in read-only mode for 30 calendar days to allow self-service export.
• Hard Deletion: Following the 30-day grace period, all tenant operational records and primary database entries are permanently scheduled for purge from production systems within 60 days.

7. Your Rights

Depending on your jurisdiction, you have the right to:

• Access and obtain a portable copy of your tenant data in standard formats (JSON, CSV, PDF).
• Rectify inaccurate account or corporate profile details.
• Request erasure of personal account administrative data (subject to statutory financial recordkeeping requirements).
• Restrict or object to non-essential automated data processing.

To exercise your rights or make a privacy inquiry, contact our Data Protection Officer at [email protected] or [email protected].

8. Contact Information

Kuklabs Inc. Delaware Stock Corporation (File No. 10663242, D-U-N-S: 145068569) Registered Office: 8 The Green, Suite B, Dover, DE 19901, United States Executive Leadership: Amit Kumar Kuklod, Chief Executive Officer Inquiries: [email protected] | [email protected]