Privacy Policy

Two different relationships

Kavvim LLC (“Kavvim,” “we,” “us”) provides studio management software to interior design businesses in the United States. This policy explains what we collect, why, and what you can do about it. How it applies depends on who you are.

• If you are a Kavvim customer or a user at a customer studio, we are the business responsible for your personal information, and this policy governs it directly.
• If you are a client of a studio that uses Kavvim, the studio decides what information about you goes into the Service and why. We process it on the studio’s behalf, under their instructions. Contact the studio you work with for questions about your information, or to request access or deletion. We will assist them in responding. Our handling of that information is governed by our Data Processing Addendum with the studio.

1. Information we collect

Account information you give us: name, email address, password (stored only as a cryptographic hash), job title, display preferences, time zone, and optionally a profile photograph. For the studio: business name, address, industry, currency, and logo.

Signing in with Google, if you choose it. The sign-in screen offers a Google button as an alternative to an email address and password. Press it and Google tells us your email address, your name, and a Google account identifier, which we store so we recognize you next time. We ask Google for nothing else: no calendar, no contacts, no files. Your Google password is entered on Google’s own page and never reaches us. Email and password remains available, and if you never press that button nothing about your Google account reaches us.

Billing information: billing name and email, subscription and seat details, and payment card metadata, meaning brand, last four digits, expiration, and cardholder name. We never receive or store full card numbers or security codes. Those go directly from your browser to Stripe.

Content you put into the Service: projects, tasks, items, vendors, schedules, time entries, invoices, presentations, messages, files, and images. Much of this is information about your clients, including their names, contact details, home addresses, and photographs of their properties.

Files you add from Google Drive or Dropbox. When you upload files to a project you can pick them from Google Drive or Dropbox instead of your computer. Kavvim receives only the files you pick and stores a copy of each one as an ordinary project file; later changes to the original are not copied. For Google Drive we ask Google for access to the files you pick and nothing else, and that access is held in your browser for up to an hour and is never sent to or stored on our servers. Dropbox uses your own Dropbox session and gives your browser a short-lived download link for each file you pick. We cannot see anything else in your Google Drive or Dropbox.

Employment and rate information where a studio records it: hourly rates, overtime rates, weekly capacity, and time entries.

Usage and technical information: authentication events, last login time, audit records of changes made in the Service, and AI usage metering.

Error reports. When something goes wrong, our software sends a diagnostic report to a third-party error monitoring provider so we can find and fix the fault. A report contains the error, a stack trace, your browser and operating system, and the sequence of actions leading up to it. It can include your user identifier and the page or screen you were on. We configure it not to send request contents, form values, cookies, or your IP address.

Questions asked on our public website. Our marketing site has a box where anyone can ask a question about Kavvim, and we send that question to our AI provider along with extracts from our own product guide so it can be answered. We store the question text so we can see what people want to know and improve our documentation, and we delete it after 90 days. We do not record who asked: no name, no email address, and no IP address. Do not type anything confidential into it.

Demos booked on our public website. When you ask for a demo you give us your name and email address, and optionally your phone number, studio name, studio size and a message. If you pick a time, we put the demo on our own Google Workspace calendar with a Google Meet link and invite you to it, so Google receives your name, your email address, the time, and your studio name and message if you gave them, and Google sends you the calendar invitation. To find open times we read only whether our own calendars are busy, never anything in yours. The confirmation email carries a private link to move or cancel the demo; we store only a scrambled form of it.

IP addresses are used transiently for rate limiting and abuse prevention. They are not stored in our database.

Approximate location, only if you allow it. The first time you click into an address field, your browser may ask whether you want to share your location. This is your browser’s own prompt, not ours, and you can decline. If you allow it, we round the coordinates to roughly 100 meters and send them to our address autocomplete provider as a ranking hint, so nearby addresses appear first in the suggestions. It does not change which addresses can be found, only their order.

The location is held in your browser’s memory for that page visit only. It is never written to our database, never logged, and never stored in a cookie or in local storage. It is discarded when you close the tab. If you decline, or if your browser cannot determine a location, address autocomplete works exactly as before. You can change or revoke the permission at any time in your browser’s site settings.

What we do not collect: we do not use analytics, advertising, session replay, or behavioral tracking of any kind. There is no Google Analytics, no advertising pixel, and no tag manager anywhere in the Service. We do not collect precise location, do not track location in the background or continuously, do not collect location anywhere other than address fields, and do not use location for analytics, advertising, or profiling.

2. How we use information

To provide and operate the Service; to authenticate you and secure your account; to process payments and manage subscriptions; to send transactional email; to provide support; to detect and prevent abuse and fraud; to comply with law; and to improve the Service through aggregate operational metrics.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have never done so.

We do not train AI models on your data, and we do not permit our AI providers to. See Section 4.

3. Legal basis and consent

We process your account and content data to perform our contract with you. We process security and abuse-prevention data on the basis of our legitimate interest in operating a safe service.

We rely on your consent for approximate location, which is collected only through your browser’s own permission prompt and can be revoked at any time in your browser’s site settings.

AI features are enabled by default and are described in Section 4. A studio administrator can disable any or all of them at account setup or later in Settings.

4. Artificial intelligence

Optional AI features transmit content to third-party providers. Which content, and when:

AI features are on by default. We show you what each one transmits during account setup, and a studio administrator can disable any or all of them at that point or later in Settings → AI. Turning them off does not affect any other part of the Service.

No AI provider we use is permitted to train on your content. For Anthropic and Google this is a term of our commercial agreements with them. For Photoroom it is an account setting we have enabled. Content is retained by providers only briefly, for abuse detection or for the duration of the request, per their published terms. We record which categories of data each AI request included, so we can tell you what was sent.

If you are a studio, consider whether your agreements with your clients permit this before leaving these features on. That assessment is yours.

5. Google API data

Kavvim uses three Google APIs on your behalf: signing in with Google, described in Section 1; the optional Google Meet integration a studio connects to mint join links for video bookings, described on our Subprocessors page; and the Google Drive picker for adding files to a project, described in Section 1. Separately, we use Google Calendar on our own company account to book demos requested on our website, described in Section 1; it never connects to your Google account.

Kavvim's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

That policy is published at https://developers.google.com/terms/api-services-user-data-policy.

Information we receive from the Google Meet integration, meaning the email address and account identifier of the connected Google account and the join link of the meeting room we create on it, is never sent to any AI model or AI provider. It is not used to develop, improve, or train any artificial intelligence or machine learning model, by us or by anyone else.

Files you pick through the Google Drive picker are stored as project files in your studio, like any file you upload. They are not used to develop, improve, or train any artificial intelligence or machine learning model, by us or by anyone else.

6. The browser web clipper

We publish an optional browser extension, the Kavvim Web Clipper, for Chrome and Edge. You install it separately from the Chrome Web Store or Microsoft Edge Add-ons and it is not required to use the Service. If you have not installed it, nothing in this section applies to you.

It is dormant until you click its toolbar icon or choose one of its entries from the right-click menu on a page. It does not run on pages in the background, it does not watch your browsing, and it does not build or keep a record of the pages you visit.

What it reads from a page. When you click the toolbar icon on a product page, or choose one of its right-click menu entries there, the extension reads that one page to pull out the product name, the price and currency, the vendor or brand name, the addresses of the product photographs, and the address of the page itself. It reads only the tab you clicked on, only at that moment, and it shows you everything it found in a form you can edit before anything is saved. The form stays open beside the page; if you move to another tab or page, the extension does not read it until you ask, with its Read this page button or its right-click menu.

What you can send it from the right-click menu. You can select text on the page and send it to the form as the product name, price or vendor, or send it a photograph on the page to add. It receives only the text you selected or the address of the photograph you chose, with the address of the page so it is never applied to a different product, and it goes into the same form, where you can change it before anything is saved.

What it sends, and when. Opening the extension asks Kavvim for your project, group, item type and presentation lists, and for your studio’s vendors so it can fill in the vendor you already use for that website. That request tells us nothing about the page you are on. The photographs you choose from are loaded as thumbnails by your browser directly from the vendor’s own image host, the same way the page you are looking at loaded them. On many online stores the extension also asks the store’s own website for its product record, the same information the store uses to show the product, because it gives the exact name and price; that request goes to the site you are already on and carries no Kavvim data.

Reading help. When the extension cannot find the vendor, the price or any photograph on a page by itself, it sends that page’s address and title, up to 8,000 characters of the text of the product section, the addresses and descriptions of up to 40 photographs on the page, and what it had already read, to Kavvim, and we pass them to our AI provider, Anthropic, to find the missing details. This happens when you open the extension, before you press Save, and it fills in only details you have not typed or picked yourself, each marked as filled by AI. It never replaces a vendor your studio already has for that website. We do not store the page text; we record only that the request was made and its size, and the answer is kept in your browser until you close it so the same page is not sent twice. Nothing from your studio is sent. A studio administrator can turn this off in Settings → AI, under Web clipper reading help, and then nothing about the page reaches us until you press Save.

When you press Save, the extension sends us the details shown in the form, meaning the name, price and vendor, together with the address of the page as the source link, and the photographs you selected. It downloads each selected photograph from the vendor’s image host and uploads a copy to our object storage in the United States, so that your project holds its own copy rather than a link that breaks when the vendor reorganizes their site. The clip then appears in the Kavvim project you chose, either as an item or staged onto a presentation deck.

What it stores on your device. A connection token for your Kavvim account, the last project you saved into, and your language choice. These live in the browser’s extension storage. Reading help answers are kept in the browser’s memory and are gone when you close the browser. Removing the extension clears them, and so does Disconnect in its settings. Anything you send it from the right-click menu is kept in the browser’s memory only until you save, clear it, close the tab or close the browser.

How it connects to your account. Pressing Connect Kavvim opens a Kavvim page where you sign in and approve the connection once. We then issue the extension a personal access token. Only a cryptographic hash of that token is stored on our servers, so we cannot read the token back. The extension exchanges it for a short-lived access token whenever it needs one, which is how we know whose account a clip belongs to. You can see every connected extension, and revoke any of them, in Settings; we record when each token was last used. Disconnect also revokes the token on our side, and if that call cannot reach us the extension still forgets the token locally and you can revoke it yourself in Settings.

The extension acts as you. A token issued to the extension carries the same permissions your Kavvim account has, so a clip is filed exactly as if you had created it in the app and is attributed to you in the same way.

What it does not do. The extension contains no analytics, no advertising, no tracking pixels, and no error reporting. Unlike the rest of the Service, it sends no diagnostic reports anywhere.

The extension sends data to two Kavvim destinations: our application at app.kavvim.com, and our object storage in the AWS us-east-1 region, which receives the photographs directly. It makes two kinds of request to a party that is not us, and neither carries Kavvim data: on a store that publishes one, it asks the site you are on for its product record when you open the extension; and after you press Save, it downloads the photographs you selected from whatever host the vendor serves them on. Neither tells the vendor anything beyond what your browser already tells them when you browse their site. Page text sent for reading help goes to us, not to the vendor, and from us to Anthropic as described above.

7. The Kavvim mobile app

We publish an optional app for iPhone and Android. It is the same Kavvim application as the website, signed in to the same account, and the rest of this policy applies to it as written. This section covers only what is different on a phone. If you do not use the app, nothing in this section applies to you.

Staying signed in. Instead of cookies, the app keeps the token that keeps you signed in, and the multi-factor trusted-device token, in the phone’s secure storage: the Keychain on an iPhone, the Keystore on Android. They belong to that phone only and are not moved to another phone. Signing out removes the sign-in token from the phone even when there is no connection, and reinstalling the app starts signed out.

Projects kept on your phone. So that you can look at a project where there is no signal, the app keeps a copy of the projects you open on that phone: the project’s details, items and their photos, tasks, schedules, delivery tracking, reminders you have marked done, notes, the list of its files and the photos among them, and the client’s contact details, together with your studio’s team list, clients and vendors and the account you are signed in with. Invoices, payments, billing, messages, notifications, time entries and the shared vendor logins are never kept. The copy stays in the app’s private storage on the phone and is not sent anywhere. It is deleted when you sign out, when your session ends, or when someone else signs in to the app on that phone. Anything not refreshed from our servers for 30 days is dropped from it, and its photos are limited to 250 MB, oldest removed first.

Camera and photos. The app asks for the camera or your photo library only when you choose to add a photo, and sends only the photos you take or pick, the same way as an upload from a computer.

App lock. If you turn on Lock the app, your phone checks your Face ID, fingerprint or passcode itself. Nothing about it reaches Kavvim, and the setting is stored on that phone only.

Sharing a link to Kavvim. On Android you can share a link from another app to Kavvim to add a product as an item. The app receives only the link you shared. When you continue, our servers read that one page to fill in the product name, price and photos, and the photos you choose are copied into your project, the same as a link pasted into Add item from URL.

Updates. The app downloads new versions of itself from our own servers at app.kavvim.com. Those downloads carry no information about you or your studio.

8. Who we share information with

Service providers (subprocessors). We use vendors to operate the Service. Each is bound by a written agreement limiting them to processing on our instructions. The current list, with what each receives, is published on our Subprocessors page and incorporated here. We do not use advertising networks, and we do not run product-analytics or help-desk software that receives your data.

Your studio. If you are a user at a studio, your studio administrators can see your account information, your activity in the Service, and audit records of your changes.

Legal and safety. We may disclose information where required by law, valid legal process, or to protect the rights, safety, or property of Kavvim, our customers, or the public. Where we are permitted to notify you, we will.

Business transfer. If Kavvim is acquired or merges, information may transfer as part of that transaction. We will notify you and the successor will be bound by commitments no less protective than these.

We do not disclose personal information to any third party for that party’s own marketing purposes.

9. Where information is processed

Kavvim operates entirely within the United States. Our application servers, database, object storage, and backups are located in the United States. We do not currently offer data residency outside the US, and we do not market the Service outside the US.

If you are outside the United States, understand that using the Service involves transferring your data to the United States.

Our subprocessors may process information in other locations under their own terms; each is identified on our Subprocessors page.

10. Retention

Deleting a project is immediate and permanent. The project and everything recorded in it go at once: its tasks and comments, items, files, notes, presentations, schedules, client approvals, its unsent invoice drafts, the assistant conversations held on it, and the notifications about it. The project’s files are removed from our storage straight away, and other uploads attached to it (such as task attachments and images) within three days. A project with an invoice that was sent or paid, or with work time logged to it, cannot be deleted, because those are financial and payroll records. Overhead time filed under the project is kept, and the audit log keeps a record that the project was deleted. Backups are overwritten on their own rotation.

Archived clients are permanently deleted after 24 months unless something still refers to them, such as an invoice. We notify studios before that runs.

You can start the deletion timeline yourself at any time from Settings → Closing your account, and cancel it from the link in the confirmation email at any point before the deletion date. We email you the exact dates when a timeline starts, and again before it runs out.

To ask a question about any of this, email privacy@kavvim.com.

11. Security

We describe our technical and organizational measures on our Security page, which states plainly both what is implemented and what is not. In summary: encryption of sensitive fields at rest using AES-256-GCM with key management through AWS KMS; a zero-knowledge credential vault where we cannot decrypt what you store; BCrypt password hashing with an enforced complexity policy; short-lived signed access tokens with rotating refresh tokens; optional multi-factor authentication; row-level tenant isolation; rate limiting on authentication; and audit logging of changes.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you without undue delay and in any event within 72 hours of confirming it, and will provide what we know about scope, impact, and remediation.

12. Your rights

Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights that vary by state but generally include:

• Know and access - what we hold about you and how we use it.
• Correct - inaccurate personal information.
• Delete - your personal information, subject to legal retention.
• Portability - a copy in a portable format.
• Opt out of sale or sharing - we do not sell or share, so there is nothing to opt out of, but the control exists.
• Non-discrimination - we will not treat you worse for exercising a right.

How to exercise them. Three controls are in the product, signed in: correct your own details in Settings → Your profile, start a deletion in Settings → Closing your account, and record the sale-and-sharing opt-out from “Do Not Sell or Share My Info” at the bottom of the app. Settings → Data import & export downloads your studio’s records where your role allows it. Every other request, including access and portability - a copy of the personal information we hold about you - goes by email to privacy@kavvim.com from the address on your account. We respond within 45 days, extendable once by another 45 where necessary, and will tell you if we need more time.

If you have a Kavvim account, you can record the opt-out yourself: sign in and use “Do Not Sell or Share My Info” at the bottom of the app. It is stored against your account rather than in your browser, so it survives clearing your site data and applies on every device you sign in from. If you do not have an account, email privacy@kavvim.com and we will record it for you.

Global Privacy Control. We honor the GPC browser signal as a valid opt-out of sale and sharing. If the browser you sign in with sends one, we record the same opt-out on your account without waiting for you to click anything, we do not re-date a record you already have, and we will not let it be withdrawn while the signal is still being sent.

Verification. We will verify your identity before acting on a request, usually by confirming control of the account email. For deletion requests we may require additional confirmation.

Authorized agents may submit requests on your behalf with written authorization; we may contact you to confirm.

If you are a client of a studio, direct your request to that studio. They control the information and decide how it is used. We will help them fulfill it.

Appeals. If we deny a request, you may appeal by replying to our response or writing to privacy@kavvim.com with “Appeal” in the subject. We will respond within 45 days. If we deny the appeal, residents of certain states may contact their state Attorney General.

13. Children

The Service is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children. If we learn we have, we will delete it. Contact privacy@kavvim.com.

14. Changes

We may update this policy. For material changes we will give at least 30 days’ notice by email and in-app, and ask you to acknowledge the new version. The version and effective date are shown at the top, and prior versions are available on request.

15. Contact

Privacy questions and requests: privacy@kavvim.com. Postal mail: Kavvim LLC, 180 Woodbury St, Apt 328, Manchester, NH 03102.