This policy explains how Kirora Technologies Limited (“Kirora”, “we”, “us”) handles personal data. Kirora is a customer engagement platform at kirora.io: businesses use it to send email and push campaigns, transactional messages and automated journeys, design emails, collect sign-ups through forms, draft content with our AI assistant Kiro AI, and connect their own systems through our public API.
We handle personal data in two different roles, and this policy is organised around them:
- As a controller, for people whose data we decide how to use: visitors to kirora.io, people who sign up for and use the Kirora dashboard, people who contact us, and contacts at our partners. Sections 1 to 13 cover this.
- As a processor, for the people our customers message through Kirora (their “contacts”). Here the business that messaged you decides what happens to your data, and we act on its instructions. Section 14 covers this.
Our service is hosted in the EU; section 11 of our Data Processing Agreement sets out where. It is used by businesses around the world. We have written this policy with the EU and UK General Data Protection Regulation (GDPR and UK GDPR), the Nigeria Data Protection Act 2023 (NDPA) and the California Consumer Privacy Act as amended by the CPRA (CCPA) in mind.
1. Who we are and how to reach us
The controller for the data described in sections 1 to 13 is Kirora Technologies Limited, Woodland Court, DPK Estate, Orchid, Lagos, Nigeria.
- Privacy questions and requests: privacy@kirora.io
2. What we collect
Account holders (people who sign up for and use the dashboard)
- Account details: your first and last name, email address, the name of your workspace, and optionally your country and timezone. We confirm your email address with a one-time code before your account exists.
- Sign-in credentials: your password, which we store only as a one-way hash, never in readable form. If you turn on two-step sign-in, we store your authenticator secret encrypted.
- Sessions: when you sign in we create a session and record the IP address and browser (user agent) it was started from and when it was last used, so you can stay signed in and so we can protect your account.
- Workspace membership: which workspaces you belong to, your role in each, invitations you send or accept, and when you accepted our Terms (which include this policy).
- Activity in the product: an audit trail of significant actions you take (for example, sending a campaign, exporting or erasing contacts, changing settings), with your name and the time, and logs of requests made to our API (the route, method, result and timing).
- Content you create: templates, campaigns, journeys, forms, segments, brand settings and conversations with Kiro AI. This is usually business content, but it can contain personal data you choose to include.
- Support and correspondence: what you tell us when you email us or ask for help.
- Billing data: billing contact details, plan, payment and invoice history. Payments by card or mobile money are collected by our payment provider, Bachs; we do not store card details.
Website visitors (kirora.io)
The marketing site and documentation are a static website. Today we run no analytics on it and set no cookies. Our hosting infrastructure processes your IP address and request details to deliver the pages and protect the service. The documentation remembers which programming language you picked for code samples in your browser’s local storage; that never leaves your device. See our Cookie Policy.
Waitlist
Until the Kirora app opens to everyone, you can join our waitlist through a form hosted by Tally BV, in Belgium. It asks for your name, company name, email address and country, and whether you want product news. We use these to contact you about access to Kirora and, only if you answered yes, to send you occasional product news, which you can unsubscribe from at any time.
Prospects and partner contacts
If you contact us about Kirora, or you work for a business that partners with us (for example, a platform that creates Kirora workspaces for its own customers through our partner API), we keep your name, work email, company, role and our correspondence.
Where the data comes from
Mostly from you. Some comes from your use of the service (sessions, audit trail, request logs). If a colleague invites you to a workspace, they give us your email address. If a partner creates a workspace on your behalf, the partner gives us the details it needs to do so.
3. Why we use it and our lawful bases
| Purpose | Data | Lawful basis (GDPR / UK GDPR / NDPA) |
|---|---|---|
| Create and run your account, sign you in, provide the service you signed up for | Account details, credentials, sessions, workspace membership, content | Contract |
| Send service emails: sign-up codes, password resets, invitations, security and deletion notices | Name, email | Contract |
| Keep the service and your account secure: rate limiting, preventing abuse, detecting suspicious sign-ins, enforcing our acceptable-use rules | Sessions, IP address, request logs, audit trail | Legitimate interests (protecting our users, our sending reputation and our platform) |
| Keep an audit trail of significant actions in a workspace | Audit trail | Legitimate interests (accountability for workspace owners and for us); legal obligation where records are required |
| Provide Kiro AI when you use it | Your prompts and workspace content | Contract |
| Answer questions and give support | Correspondence | Contract, or legitimate interests where you are not yet a customer |
| Improve and fix the product | Aggregated usage, error logs | Legitimate interests |
| Tell you about product changes that affect you | Name, email | Contract (service notices) |
| Send you marketing about Kirora | Name, email | Consent, or where the law allows, legitimate interests for existing customers; you can opt out at any time |
| Contact you about access when you join the waitlist | Name, company name, email, country | Steps you asked us to take before a contract (legitimate interests where that does not apply) |
| Send you product news after you join the waitlist | Name, email | Consent (your yes on the form); you can unsubscribe at any time |
| Billing, tax and accounting (once billing launches) | Billing details, invoices | Contract; legal obligation |
| Respond to lawful requests and enforce our rights | Any relevant data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and you can object (see section 9). We do not use your data for automated decisions that have legal or similarly significant effects on you.
4. Kiro AI
Kiro AI is the drafting and analysis assistant in the dashboard. It helps you write templates, campaigns, segments, journeys and forms, and explains how your campaigns performed.
- What it sees: your prompts and the workspace content needed to answer them, such as templates, campaign settings and aggregate statistics, segment rules and the names of contact attributes. It cannot read individual contact records, and it never changes contacts or consent.
- Who processes it: we send this content to OpenAI to generate responses, with storage on OpenAI’s side switched off (
store: false). - It only drafts: Kiro AI never saves, sends, schedules or publishes anything. A person reviews and saves every draft.
- Conversations: we keep Kiro AI conversations for 90 days after the last message, then delete them.
- Switching it off: a workspace owner or admin can turn AI features off for the whole workspace.
5. How long we keep it
We keep personal data only as long as we need it for the purposes above. Automated jobs apply these limits every hour.
| Data | How long |
|---|---|
| Account details and workspace content | While your account exists. When you delete your account or workspace, see below. |
| Expired sign-in sessions | Deleted 7 days after they expire (a session lasts up to 14 days) |
| Audit trail | 2 years |
| API request logs | 30 days |
| Kiro AI conversations | 90 days after the last message |
| Webhook delivery records | 30 days if delivered, 90 days if failed |
| Contact export files | 7 days |
| Waitlist sign-ups | Until we invite you to Kirora, or sooner if you ask us to remove you |
| Support correspondence | 3 years after the last contact |
| Billing and tax records | As long as tax and accounting law requires |
Deleting your workspace. A workspace owner can ask for deletion in the dashboard, confirming with their password and two-step code if enabled. The workspace and everything in it is then deleted after a 14-day grace period, as described in section 16 of our Terms and section 12 of our Data Processing Agreement.
Deleting your account. You can delete your login in the dashboard once it no longer owns a workspace (delete the workspace first, as each workspace has one owner). Audit records of actions you took in other workspaces keep your name, so that their owners can still see who did what.
6. Who we share it with
We share personal data only as needed to run the service:
- Sub-processors that host and operate parts of Kirora on our behalf, such as hosting, email delivery, file storage and Kiro AI, under contracts that require them to protect the data. Push notifications are delivered through Apple, Google and browser push services. Our sub-processors page lists each one and explains how each is treated.
- Our payment provider, Bachs (bachs.io), which collects payments for paid plans by card or mobile money and receives the billing details it needs to do so.
- Tally BV (Belgium), which hosts our waitlist form and stores the sign-ups for us.
- Other members of your workspace, who can see your name, role and the actions you took.
- A partner, if your workspace was created through one, to the extent the partner API exposes it.
- Professional advisers such as lawyers and accountants, under confidentiality.
- Authorities, where the law requires it, and only after checking the request is lawful.
- A buyer or successor, if Kirora is involved in a merger or sale, under this policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising. In CCPA terms, we do not “sell” or “share” personal information, and have not done so in the last 12 months, so there is nothing to opt out of. We do not knowingly sell or share the personal information of anyone under 16.
7. International transfers
Our main infrastructure is in the EU. Some sub-processors, such as OpenAI, process data in the United States and elsewhere, and our team or partners may access data from other countries.
When personal data leaves the EEA or the UK for a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, together with an assessment of the transfer and any extra safeguards it needs. For data covered by the NDPA, we transfer it outside Nigeria only on a basis allowed by sections 41 to 43 of the Act. You can ask us for a copy of the relevant safeguards.
8. How we protect it
- Data is encrypted in transit (HTTPS/TLS).
- Secrets such as authenticator keys, webhook signing secrets and integration credentials are encrypted at rest.
- Passwords are hashed. API keys and session tokens are stored only as hashes, so a copy of our database would not let anyone use them.
- Two-step sign-in with an authenticator app is available for every account, and sensitive actions such as deleting a workspace ask for your password and code again.
- Sign-in attempts are rate-limited per IP address and per account, and failed sign-ins look the same whether or not an account exists.
- Exports and erasures of contact data are recorded in the workspace’s audit trail.
- Access to production systems is limited to staff who need it.
If a personal data breach puts your rights at risk, we will tell the relevant regulator within 72 hours of becoming aware of it, as GDPR article 33 and NDPA section 40 require, and tell you without undue delay where the law requires it.
9. Your rights
Depending on where you live, you have some or all of these rights over the personal data we hold about you as controller:
- Access: get a copy of your data.
- Correction: have inaccurate data fixed.
- Deletion: have your data deleted, unless we must keep it.
- Portability: get your data in a machine-readable format.
- Objection: object to processing based on legitimate interests, and to direct marketing at any time.
- Restriction: ask us to pause processing while a dispute is resolved.
- Withdraw consent: where we rely on consent, withdraw it at any time, without affecting what happened before.
- Complain to a regulator: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the data protection authority where you live or work; in Nigeria, the Nigeria Data Protection Commission (ndpc.gov.ng).
California residents also have the right to know what categories of personal information we collect, use and disclose (described in sections 2, 3 and 6), to delete and correct it, to limit the use of sensitive personal information (we use it only to provide the service, for example your password to sign you in), and not to be discriminated against for using these rights. You can use an authorised agent; we will verify the request with you.
10. How to use your rights
Many requests you can do yourself in the dashboard:
- Export your account data: download your profile, workspace memberships and your own activity as a JSON file from your account settings.
- Correct your details: edit your name and other profile details in your account settings.
- Delete your account or workspace: from your account and workspace settings, as described in section 5.
- Stop marketing emails: use the unsubscribe link in any marketing email from us.
For anything else, email privacy@kirora.io . We will confirm your identity, usually by asking you to write from the email address on your account, and reply within one month (45 days for California requests). We may extend this where the law allows and will tell you if we do. Requests are free unless they are clearly unfounded or excessive.
If you are a contact of one of our customers, see section 14: please contact that business first.
11. Children
Kirora is a business tool for people aged 18 or over acting for a business. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Our customers must not use Kirora to message children without the safeguards the law requires; our acceptable-use terms say so.
12. Changes to this policy
We will update this policy when our practices change. The date at the top shows the latest version. If a change is significant, we will tell account holders by email or in the dashboard before it takes effect.
13. Contact
Kirora Technologies Limited, Woodland Court, DPK Estate, Orchid, Lagos, Nigeria Email: privacy@kirora.io
14. When we process data for our customers
Our role
When a business uses Kirora to message you, that business is the controller of your data and Kirora is its processor. We process your data only on the business’s instructions, under our Data Processing Agreement, and not for our own purposes. We do not sell it, use it to advertise to you, or combine it with data from other customers.
If you have a question or request about messages you received, contact the business that sent them. Its name and postal address are in the footer of every marketing email sent through Kirora. If you contact us directly, we will pass your request to that business where we can identify it, and help it respond.
What we process for our customers
- Contact profile: email address, phone number, name, country, timezone, and any other attributes the business stores, such as plan or city.
- Consent history: when and how you subscribed or unsubscribed, per channel and topic, including the source (for example, a sign-up form and the wording it showed), the IP address, and the time.
- Events: actions the business sends to Kirora, such as “signed up” or “placed an order”, used to trigger messages and build audiences. Some come from the business’s own systems through integrations such as Paystack, Stripe or Zapier.
- Messages: which messages you were sent, delivery results (delivered, bounced, complained), and, where tracking is on, opens and clicks.
- Form submissions: what you entered into a sign-up form built with Kirora.
- Push devices: if you allow notifications in an app or browser, a device token so the business can send you push messages through Apple, Google or your browser’s push service. Web push needs you to grant permission in your browser, and you can withdraw it there at any time.
Open and click tracking
Unless the business turns it off, emails sent through Kirora contain a tiny image that tells the sender when the email was opened, and links that pass through Kirora so the sender can see which were clicked. Each workspace can switch open tracking and click tracking off.
We never track opens or clicks for contacts in the EEA or the UK, whatever the workspace settings, because the law there requires consent for it. This depends on the country the business has recorded for you, or that we infer from your phone number or timezone; where no country is known, the workspace’s settings apply. See our Cookie Policy for more.
How we help businesses honour your rights
- Unsubscribing: every marketing email has an unsubscribe link and supports one-click unsubscribe in your mail app. It takes effect immediately.
- Access and portability: the business can export everything Kirora holds about you as one file: profile, consent history, events, messages, form submissions and more. Each export is recorded in its audit trail.
- Erasure: the business can erase you. We delete your profile and events and anonymise your message history (removing your address, the content sent to you and any identifiers), keeping only anonymous totals so the business’s campaign figures stay accurate.
- Suppression after erasure: if you unsubscribed, bounced or marked a message as spam, the business may keep your email address on a suppression list after erasure, so that you are not messaged again. This is the minimum needed to respect your objection. A hard bounce or spam complaint can also block sends from other workspaces belonging to the same business.
How long data is kept for our customers
The business decides how long it keeps your data, within the default limits listed in Annex 1 of our Data Processing Agreement, and can delete your contact profile at any time. When a business deletes its workspace, everything in it is deleted as described in section 12 of the Data Processing Agreement.