LEGAL
Privacy Policy.
Effective 25 October 2026
Pending legal review. This Privacy Policy is in effect and describes our current practices. It has not yet been reviewed by a lawyer, and we will post any changes that review produces here.
This policy explains how Kevara AI (“Kevara AI”, “we”, “us”), the trading name of KEVARA LLC, an Indiana limited liability company, Indiana Secretary of State record 202508061915034, handles personal information. Questions or requests: t.thomas@kevarallc.com or +1 769-610-3958. Postal address: Kevara AI, 3250 W 86th St, Indianapolis, IN 46268, United States.
Our two roles
- For our own business (website visitors, enquiries, our text messages and email, prospects and our clients’ account and billing contacts), Kevara AI decides how information is used.
- For our clients’ customers (people who chat with a client’s website assistant, call a client’s AI receptionist, or whose details a client sends to its automations), Kevara AI processes information on the client’s behalf and under the client’s instructions, as described in our Data Processing Agreement. If you are a client’s customer, please also read that business’s privacy notice and contact them first.
Information we collect
- Enquiries: name, email, business name, selected service and budget, message and, if given, phone number.
- Text message consent records (only if you tick the optional box): mobile number, the exact consent wording and version, date and time, page, IP address, browser user agent and the time zone your browser reports (so we only text during reasonable local hours); and when and how you opted out.
- Our website AI assistant (the chat on kevarallc.com): the messages you type, the page you were on, a random session identifier, and any contact or appointment details you choose to give (name, email, phone, business, topic and the time you book). If you tick the optional box we record that you agreed to email about your enquiry, with the exact wording and the time. Booked appointments are added to our Google Calendar.
- Messages and calls with us: text messages you send to our number, delivery status of messages we send, and emails you send us.
- Prospect information: publicly available business contact details (for example business name, website, business phone and email) that we use for business-to-business outreach. We find businesses through Google Maps listings (name, address, website, business phone, published opening hours and time zone) and find or verify business email addresses with Hunter.io. Every email offers an unsubscribe link and we honour opt-outs.
- Client account and billing information: contact name and email, business details, the package purchased, subscription status, usage counts, and the record of your acceptance of our Client Services Agreement (version, date and time, checkout reference and email). Payments are processed by Stripe; we never see or store full card numbers. We keep only the card brand and last four digits that Stripe shares.
- Information processed for our clients: chatbot conversations (messages, a random session identifier stored in the visitor’s browser, the website used and the time), lead details the visitor or the client provides (name, email, phone, enquiry), support requests and appointment requests, AI call recordings and transcripts, text messages sent or received through a client’s number, and workflow records.
- Technical and usage information: information our hosting providers process to run and secure our services, rate-limiting counters, and page-view counts per day (no cookies, no stored IP addresses). We do not use advertising trackers.
How we use it
- To respond to enquiries and provide the services our clients buy, including onboarding, support and billing.
- To run the AI chatbots, AI receptionists and automations our clients have deployed, and to pass leads, requests and escalations to the right client.
- To send text messages and emails only where permitted: our own messages to people who opted in or (for business email) with an unsubscribe option; client-related messages only after the client authorises them and the required consent exists.
- To measure usage for billing and fair use, keep records of consent, opt-outs and agreement acceptance, prevent abuse and meet legal obligations.
Automated systems and AI
We use automated systems, including AI language models and AI voice, to answer visitors to our own website through our AI assistant, to organise enquiries, classify replies (for example recognising an opt-out), draft messages, and to answer our clients’ website visitors and callers. AI chatbot and AI receptionist replies are generated and sent automatically, without a person reviewing each reply. They are limited to information the business has approved, they do not make decisions with legal or similarly significant effects, and you can ask to speak to a person; requests for a person and complaints are escalated to the business. Outbound marketing messages drafted by AI are not sent without the required authorisation and checks. AI can make mistakes; please contact the business or us if something is wrong. Our AI model provider (OpenAI) does not use information sent through its API to train its models by default.
Call recordings
AI calls (for example a client’s AI receptionist or calls Kevara AI places with consent) may be recorded and transcribed to provide the service, keep accurate records and improve quality. Callers hear a recording notice at the start of the call. The voice provider (Vapi) keeps call history for 14 days by default; recordings and transcripts copied into our records are kept as described below.
Text messages (SMS)
Kevara AI sends its own text messages only to people who gave consent by ticking the optional, unchecked box on our enquiry form. Message frequency varies, up to 4 messages per month. Message and data rates may apply. Reply STOP to opt out at any time and HELP for help. Consent is not a condition of purchase.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors that support our services, such as customer service or message delivery, is permitted. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Who we share information with
We do not sell personal information. We share it only with the service providers below, which process it for us under their own security and privacy terms, with the client a record belongs to, and where the law requires.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Website hosting, website database (D1), request routing | Cloudflare data centres worldwide |
| Hostinger | Server hosting Kevara’s automation platform (n8n) and its data tables | Frankfurt, Germany (EU) |
| OpenAI | AI language models for chatbots, classification and drafting | United States |
| Vapi | AI voice calls (speech recognition, call handling, recordings, transcripts) | United States |
| ElevenLabs | Synthetic voice for AI calls | United States |
| Twilio | Phone numbers, calls and text messages | United States |
| Google (Workspace, Gmail, Calendar) | Email, calendars and documents | United States |
| Google Maps Platform (Places) | Finding businesses for business-to-business outreach (public listing details) | United States |
| Hunter.io | Finding and verifying business email addresses for outreach | United States (Amazon Web Services) |
| Stripe | Payments, subscriptions, invoices, receipts and the billing portal | United States |
| GitHub | Website source code hosting (not intended for personal data) | United States |
Where information is processed
Our providers process information in the United States, except that our automation platform and its data (including enquiries, consent records and client records) is hosted by Hostinger in Frankfurt, Germany, in the European Union. Cloudflare serves the website from data centres worldwide. Your information may therefore be transferred to and processed in the United States and Germany.
How long we keep it
| Information | Retention |
|---|---|
| Enquiries and prospect records | As long as needed to respond and for our business records, with no automatic deletion yet; we delete them on verified request where the law allows |
| SMS consent and opt-out records; email suppression list | At least four years; opted-out numbers and addresses are kept so we never contact them again |
| Billing, payment and invoice records | As long as tax and accounting law requires |
| Client Services Agreement acceptance records | For the life of the client relationship and afterwards for as long as needed to show what was agreed |
| Client deployment data (conversations, leads, transcripts, workflow records) | While the client’s service is active, according to the client’s settings, then 30 days after termination for the client to request an export; after that, kept until deletion under the Data Processing Agreement |
| Call history held by the voice provider | 14 days by default (provider setting) |
We do not yet delete these records automatically; we delete information on verified request where the law allows.
Your choices and rights
- Reply STOP to any of our text messages; use the unsubscribe page or reply “unsubscribe” to stop our marketing emails.
- Email t.thomas@kevarallc.com to access, correct, export or delete your information, or to withdraw consent. We verify requests before acting on them.
- If your information was collected by one of our clients (for example through a chatbot on their website), contact that business; we help them respond.
- Clients can request an export of their business data at any time; see the Client Services Agreement.
- Depending on where you live you may have additional rights under your state’s privacy law; contact us to use them.
Security
We use encrypted connections, signed requests between our systems, per-client separation of data and keys, access limited to authorised people, and rate limits. No system is perfectly secure; we will notify affected people and clients of a data breach as required by law.
Browser storage
Our website does not use advertising cookies. Our own AI assistant keeps the conversation and a random session identifier in your browser’s session storage for that tab only; it is cleared when you close the tab. A client’s chatbot stores a random session identifier in your browser so a conversation can continue; it contains no personal information. The owner sign-in uses a security cookie.
Children
Our website, messages and services are for businesses and adults and are not directed to anyone under 18. Clients must not use our services to collect information from children.
Changes
We post changes on this page with a new effective date. See also our Terms.