Privacy and data
What Kumoda stores, who else handles it, which cookies are used, and the optional campaign tag choice.
This page is a plain summary. The Privacy Policy is the authoritative text, and it is what applies if the two ever differ. For the legal terms see the Terms of Service and the Data Processing Addendum.
Kumoda is operated by Restart Integrated Systems Ltd. (Restart Inc.), a company based in Lagos, Nigeria. Questions about your data go to privacy@restart.ng.
Two roles
- For your account (your name, email, plan and payments), Kumoda decides how the data is used, so Kumoda is the controller.
- For your customers' messages, your contacts and the documents you give your agents, you decide how the data is used and Kumoda handles it for you, so you are the controller and Kumoda is the processor. The Data Processing Addendum covers that.
What is stored
| What | Details |
|---|---|
| Your account | Name, email address, sign-in details (a password, or sign-in with Google) and a profile photo if you add one. |
| Your plan and payments | Which plan you are on, credits used, and payment records and invoices. Card details are taken by the payment provider, not by Kumoda. |
| What you build | Your agents' instructions, rules and skills, and the documents, pages and files you give them to answer from. |
| Conversations | The messages your customers send through WhatsApp, your website chat window or the API, the replies (from an agent or from you), delivery status, and what customers give about themselves, such as a name, phone number or email address. |
| Contacts | People created in your workspace from those conversations, or added by you. |
| Use of the service | Which agent ran, when, how many credits it used, and technical records needed to run and protect the service, such as network addresses used to limit abuse. |
Kumoda does not sell personal data, and does not use your customers' messages or your documents to train AI models.
How long it is kept
- Your account data is kept while your account is open, and afterwards for as long as the law requires for payment and accounting records.
- Conversations are kept until you delete them, or delete the agent or channel they belong to, which removes its conversations.
- The detailed records of each AI run are kept for 14 days, then deleted.
- When you ask for your account to be deleted, your data is deleted within 30 days. Backups can hold a copy for a short time longer, and are then overwritten.
Who else handles it
Each of these handles data only to run Kumoda.
- AI model providers. To write a reply, the text of the conversation and the parts of your documents that apply are sent to the model you or your plan choose: Anthropic, and OpenAI or Google where those models are switched on.
- Meta (WhatsApp). If you connect the official WhatsApp Business connection, messages pass through Meta's WhatsApp Business Platform under your own Meta account. The quick start pairs a number by QR code through software Kumoda runs.
- Payments. Flutterwave takes payments for paid plans.
- Email and messaging providers, which deliver what Kumoda sends you.
- Hosting, on servers Kumoda operates or rents, which hold the database and files.
- Analytics, which Kumoda hosts itself, without advertising cookies.
Some of these providers are outside Nigeria. Where personal data leaves Nigeria, Kumoda relies on the safeguards the law allows, such as contracts with the provider.
Protections that matter day to day
- Connection keys and secrets (webhook tokens, MCP server keys, the official WhatsApp token) are stored encrypted and are never shown again.
- Access to your data is limited to your own account by the database itself.
- Keys and passwords found in messages or in tool results are hidden before an agent or your own AI client reads them.
- Agent screening of messages for attempts to take over an agent is an option you turn on per agent. See Agents.
- When Kumoda's team needs to see the app as you to fix a problem you reported, an owner on the team can view it as you. Each time is recorded (who, whose account and when), and it is done only to help.
Cookies and browser storage
Most of what Kumoda keeps in your browser is needed for the app to work and needs no consent. There are no advertising or retargeting cookies.
| What | Why |
|---|---|
| Your sign-in session | Kept in the browser's own storage so you stay signed in. |
| Two small cookies on kumoda.io and its subdomains | One records whether you are signed in (so the website can show a Dashboard link), and one records whether you chose light or dark mode. Neither holds your session or personal data. This documentation site reads the light or dark choice, so it matches the app. |
| Your country and currency | What you choose is saved in your browser so prices stay in your currency. For a first guess, your internet address is sent once to a country lookup service (api.country.is), which sees that address and answers with a country code. Only the country code is kept, in your browser, for 30 days. |
| The chat window on a website | A random visitor id in that visitor's browser, so a conversation continues when they come back. |
The optional campaign tag choice
The first time you visit, Kumoda asks about one optional thing: remembering where you came from.
- If you tick the box, Kumoda remembers the campaign tags in the link you used, the website that sent you and the page you landed on. They are kept in your browser, and sent to Kumoda together with your email when you send a form, so a reply can have context.
- If you do not tick it, or choose Not now, or close the prompt, none of this is stored or sent. Not now asks again after a week.
- You can change your choice at any time, from the change your cookie choice link in the privacy policy. Clearing the site's data in your browser removes everything above.
Analytics on these docs and on Kumoda
Kumoda counts visits and product events with OpenPanel, hosted by Kumoda itself. It is cookieless: it sets no cookies. This documentation site uses the same analytics and no other tracker.
Kumoda's rules for those events: no names, emails, phone numbers, company names, workspace names or message text are sent. Pages in the app are counted by route name (for example an agent page, never a workspace's name), and from a link only the campaign tags (utm_*) and a ref value are kept.
Your rights
Under the Nigeria Data Protection Act and similar laws you can ask what personal data Kumoda holds about you and get a copy, ask for it to be corrected or deleted, object to or limit how it is used, and withdraw consent where Kumoda relies on it. Email privacy@restart.ng. Kumoda answers within 30 days. If you are a customer of one of Kumoda's customers, your request goes to that business, which decides about your data. You can also complain to the Nigeria Data Protection Commission.
Kumoda is for businesses and is not meant for anyone under 18.