Privacy Policy

Last updated: August 23, 2026

Kutuli ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Kutuli platform at www.kutuli.com, including the web application and all related services (the "Service").

1. Information We Collect

1.1 Information You Provide

  • Account Information: Name, email address, and password when you register
  • Profile & Branding: Business name, tagline, brand colors, and logo URL (Business plan)
  • Business Data: Contacts, projects, invoices, transactions, sponsorships, expenses, snippets, and approval requests you create within the Service
  • Payment Information: Billing details processed securely through Stripe — we do not store your credit card numbers
  • Communications: Messages you send to our support team

1.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, and actions taken within the Service
  • Device Information: Browser type, operating system, and device identifiers
  • Log Data: IP address, access times, and referring URLs
  • Cookies: Session cookies for authentication (HttpOnly, SameSite). We use a single essential cookie to maintain your login session — no tracking cookies or third-party advertising cookies are used

2. How We Use Your Information

We use your information to:

  • Provide the Service: Operate, maintain, and deliver the features of Kutuli
  • Authenticate You: Manage your account and login sessions
  • Process Payments: Handle subscription billing through Stripe
  • Communicate: Send service-related notifications, respond to support requests, and provide product updates
  • Improve the Service: Analyze usage patterns to enhance features and fix issues
  • Ensure Security: Detect and prevent fraud, abuse, and unauthorized access
  • Comply with Law: Meet legal obligations and respond to lawful requests

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information with:

  • Stripe: For payment processing — subject to Stripe's Privacy Policy
  • Cloudflare: For hosting and infrastructure — subject to Cloudflare's Privacy Policy
  • Your Clients: When you create approval portal links, the linked content (deliverable preview, your business name and branding) is visible to anyone with the link
  • Legal Requirements: When required by law, regulation, legal process, or governmental request
  • Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction

4. Data Security

We implement industry-standard security measures to protect your data:

  • Encryption in Transit: All connections use TLS/SSL encryption
  • Password Hashing: Passwords are hashed with PBKDF2 (100,000 iterations, SHA-256) using the Web Crypto API — we never store plaintext passwords
  • Secure Sessions: HttpOnly cookies with SameSite protection prevent cross-site scripting and request forgery
  • Infrastructure: Hosted on Cloudflare's globally distributed edge network with enterprise-grade security and DDoS protection
  • Payment Security: Credit card information is processed entirely by Stripe (PCI DSS Level 1 certified) and never touches our servers

While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure.

5. Data Retention

  • Account Data: Retained as long as your account is active
  • Business Data: Retained as long as your account is active, including during downgrades (your data is preserved even on the free tier)
  • Session Data: Login sessions expire after 30 days of inactivity
  • Deleted Accounts: Upon account deletion request, we will delete your personal data within 30 days, except where we are required by law to retain it

6. Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you
  • Correction: Request correction of inaccurate or incomplete data
  • Deletion: Request deletion of your personal data
  • Portability: Request your data in a structured, machine-readable format
  • Restriction: Request restriction of processing in certain circumstances
  • Objection: Object to processing of your data for certain purposes

To exercise any of these rights, contact us at support@kutuli.com. We will respond within 30 days.

7. Cookies

We use only essential cookies required for the Service to function:

  • Session Cookie (session): An HttpOnly, SameSite cookie that maintains your authenticated session. It expires after 30 days or when you log out. No personal data is stored in the cookie itself — only a random session identifier.

We do not use advertising cookies, analytics cookies, or tracking pixels. We do not participate in cross-site tracking.

8. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete it.

9. International Data Transfers

Your data may be processed and stored in locations outside your country of residence, including in the United States, through Cloudflare's global network. By using the Service, you consent to such transfers. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

10. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing any personal information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service prior to the change becoming effective. Your continued use of the Service after the effective date constitutes your acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: