Privacy Policy

1. Controller

KUKI (Mehdi Bouktache), Berlin 10119, Germany.
Contact: hello@kukilab.tech

2. What KUKI is, in plain terms

KUKI simulates decisions against synthetic personas — statistical profiles built from three data sources:

• Public data — census, open government statistics, published polling, electoral data.
• Licensed datasets — commercial data we purchase from providers such as Kantar under the terms of their licenses.
• Client-proprietary data — if your organization brings its own first-party data into its KUKI tenant, that data stays scoped to your tenant and is never exposed to any other customer.

KUKI does not process your personal information, your contacts, or private information about individual people through a large language model.

When you run a simulation, the text prompt you write is combined with these synthetic personas to produce a result. The content of what you type is treated as your own intellectual output; we don’t train any model on it.

3. What we store about you

• Account: email, name, Google account identifier (if you sign in with Google), role in your org, timestamps.
• Usage: the prompts you submit, the runs you create (tool + inputs + result), your thumbs-up / thumbs-down feedback, and assets you upload while the run is active.
• Audit trail: a record of actions you take (create run, replay, filter, delete account). Used for org-level compliance review and to answer “who did what when” if your org asks.
• Credit usage counters: how many credits you’ve consumed today and this month (for billing + the $15/day cap).

Legal basis: contract performance (Art. 6(1)(b) GDPR — you create an account to use the product). We do not use this data for marketing unless you explicitly opt in.

4. Where data is stored

All data lives on European cloud infrastructure (Neon Postgres EU region, Fly.io Frankfurt). No personal data is transferred outside the European Economic Area.

5. Retention

Account + usage data are retained for the lifetime of your account. When you delete your account (see section 7), your personally identifiable information (name, email, Google identifier) is anonymized immediately; anonymized run/scenario records remain with your organization so collaborative work isn’t lost.

Audit events are retained for 2 years for compliance review, as permitted by GDPR Recital 75.

6. Your rights (GDPR Art. 15–22)

You can at any time:

• Export everything we hold about you as a single JSON file (account settings → Export my data, which calls POST /api/account/export).
• Delete your account, which anonymizes your identifiable information while keeping collaborative records with your organization (account settings → Delete my account).
• Request rectification, restrict processing, or object to processing by emailing us.

You may also lodge a complaint with a supervisory authority (for Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit).

7. Who we share data with

We use a short list of EU-hosted subprocessors to run the service:

• Neon (EU region) — Postgres database
• Fly.io (Frankfurt) — application hosting
• Vercel (EU edge) — frontend delivery
• Google — authentication only (Sign in with Google). No additional data shared back.
• Kantar and other commercial data providers — we are their customer and hold the licensed datasets they produce. Your personal information is not sent to them; the dataflow is one-way inbound.

We do not sell, rent, or share your personal data with advertisers or data brokers.

8. Cookies

The product uses only essential session cookies for authentication. No analytics or marketing cookies. See the Cookie Policy for the full list.

9. Contact

Data-protection questions: hello@kukilab.tech.