Legal
Privacy Policy
Effective July 11, 2026
Kulario is designed to give buyers useful answers while giving demand teams only the context they are authorized to use. This policy explains the data path.
What we collect
We collect account and workspace details provided by Kulario customers. When a buyer completes a customer-created experience, we process the answers, identity fields the customer selected, consent choices, referral context, and first-party product events needed to save progress and report starts and completions.
How data is used
We use data to operate, secure, support, and improve Kulario; calculate and display buyer results; provide customer reporting; and deliver fields to integrations the customer enables. Demo Lab and test-mode responses remain excluded from customer analytics and destination delivery.
Customers and buyer data
The Kulario customer determines the questions, fields, purposes, privacy notice, and connected destinations for its experience. For that buyer data, the customer is the controller or business and Kulario acts as its service provider or processor. Buyers should contact the company that shared the experience for requests about their response.
AI and approved source material
When an authorized user asks Kulario to create a source-backed draft, bounded excerpts from the files or public links they selected may be sent to the AI provider configured by Kulario. Source evidence shown in an experience is stored as locked, exact excerpts. AI generation is not used for Demo Lab or customer content unless the authorized user initiates it.
Service providers and destinations
Kulario uses infrastructure and service providers such as Vercel and Supabase to host and store the service. Customer-selected content may be processed by the configured AI provider. Buyer fields are sent to Marketo, HubSpot, Salesforce, or signed webhooks only when the customer enables a valid mapping and the buyer grants marketing consent.
Retention and security
We retain account and customer data while the workspace is active and as reasonably needed for security, support, legal obligations, and recovery. Temporary source uploads expire and are removed automatically. Credentials are encrypted and write-only in the product. No internet service can promise absolute security.
Your choices
You may decline marketing consent and still receive your result. Global Privacy Control is honored for marketing consent. Account holders can export response data and request verified workspace deletion. Depending on location, individuals may also have rights to access, correct, delete, or restrict use of personal data.
Contact and updates
Questions or privacy requests can be sent to hello@kulario.com. We may update this policy as the service changes and will post the revised effective date here.