1. Who is responsible
The controller responsible for this website is the provider, as named with full address in our Impressum.
Kwudo is not open for sign-ups yet. This notice covers the public pages of kwudo.com and the contact form. Instagram automation has its own notice (section 2). We will publish a notice for the full service before it opens.
2. Data We Collect
When you visit a page. Our web server records each request: your IP address, the date and time, the page requested, the response status, the referring page and your browser's user agent. We use this to deliver the site, to keep it secure and to find faults. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
When you use the contact form. We store your name, email address, subject and message, together with your IP address and browser user agent, and send a copy of your message by email to our support mailbox. We use this to answer you and to stop abuse of the form. Legal basis: answering your request (Art. 6(1)(b) GDPR where it concerns a contract with us, otherwise Art. 6(1)(f) GDPR); for the IP address and user agent, our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
On your device. What the site stores in your browser is listed on the cookie page. We use no analytics, advertising or tracking tools.
Instagram automation. Sellers can let Kwudo reply to comments on their Instagram posts. If you are such a seller, or you commented on their post, the Instagram automation privacy notice explains what we receive, how long we keep it and how to delete it.
3. How long we keep it
- Web server request logs are deleted after 15 days. Application logs, which can contain an IP address, are overwritten as newer logs arrive.
- Contact messages are deleted from our database automatically 12 months after we receive them. We delete the email copy in our support mailbox once we no longer need it for your request, at the latest after 12 months. If you ask us to delete your message sooner, we do, unless we must keep it by law.
- Database backups, which include contact messages, are deleted after 30 days.
4. Service providers
These providers process data for us under data processing agreements:
- Google Cloud hosts the website, the database and its backups in the Netherlands (region europe-west4).
- Resend sends the email that forwards a contact message to our support mailbox.
- Namecheap Private Email hosts our support mailbox.
Some of these providers are based in, or use companies in, countries outside the EU, including the United States. Where data leaves the EU, the transfer relies on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified companies, or on the Commission's standard contractual clauses (Art. 45 and 46 GDPR). You can ask us for a copy of the clauses that apply, using the contact details in section 1.
5. Your Rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR);
- have it corrected (Art. 16) or deleted (Art. 17);
- have its processing restricted (Art. 18);
- receive it in a portable format (Art. 20);
- object at any time to processing based on our legitimate interests, on grounds relating to your situation (Art. 21).
To use these rights, contact us as shown above. You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work, or where you think the infringement happened (Art. 77 GDPR).
6. Do you have to provide data?
No. You can read the site without giving us anything beyond what your browser sends with every request. If you want an answer from us, we need an email address to reply to.
7. Changes to This Policy
We will update this notice when what we do with data changes, and at the latest when the full service opens. The date at the top shows the current version.