Privacy Policy

How Kavedi connects

Kavedi links to your number as a companion device, the same way WhatsApp Web does. It is not the official WhatsApp Business API. To hold that link we store the session and authentication state for your number, encrypted (AES-256-GCM) with a key that is not kept in the database. We never ask for your WhatsApp password — there isn’t one to give — and we never take payment details through this connection.

What we store

• What you teach it: the answers you write, and the text read out of any price list, flyer or document you upload. The file itself is not kept — only the answers you approve. Each answer also gets a numerical “embedding” so the right one can be found.
• Questions Kavedi couldn’t answer: the text of that one message, so it can reach you under “waiting for you”. A voice note is kept as a reference that lets Kavedi fetch it from WhatsApp again if you press Transcribe, plus the transcript once you do.
• Your contacts: names, numbers and when each chat last had a message, taken from the address book WhatsApp syncs to the linked device. Stored encrypted, so contacts survive a restart without being downloaded again. Labels you add and anyone who replied STOP are stored too.
• Your triggers: what starts each one, its conditions and its steps, the words it sends, and any picture or file you upload for it to send. Files are kept in private storage until no trigger uses them. Each time a trigger runs we record when, for which chat or group, and whether it worked — not what was said. A trigger that asks someone a question and waits for their reply keeps what it has so far — their message, anything it fetched, earlier replies — encrypted, until they reply or the wait runs out, an hour at most.
• Messages you schedule: the text, who it goes to and when, until it is sent, and whether it was delivered or read.
• Appointments: the time, what was booked and the name of whoever booked it.
• Settings and profile: your name, what you do, address, phone and website if you fill them in, your time zone and how you want Kavedi to reply.
• Counts, not content: one row per reply or hand-over, holding the kind and who it involved — that is where “9 replies today” comes from.
• Your account: the email address you sign in with (and your name and picture if you use Google).
• Beta applications: your email address, and whatever you chose to tell us — your name, what you do, where you are, how you use WhatsApp and what you’d want Kavedi to handle — plus whether we let you in.

What we don’t store: the conversations themselves. An incoming message is read to answer it and is not written down; the only message text kept is a question that was passed to you, and what a trigger waiting for a reply has so far. Kavedi never reads a broadcast list, a status or a Channel, and never reads a group unless you pick it for a trigger (up to three). Messages in a group you picked are checked against your triggers and not stored; every other group is dropped before it is even decrypted. Kavedi never replies in a group with AI.

Who else sees it

To answer a message, its text is sent to an AI provider along with the answers you taught Kavedi and your profile. To find the right answer, the message is also turned into an embedding by Google. Voice notes you ask to transcribe are sent to a speech-to-text provider. None of them receive your contact list, your account or your other conversations. Today that means Groq (writing replies, and transcription) and Google Gemini (embeddings, and reading uploaded documents); providers can change, and this page will say so.

Kavedi itself runs on Render, with data stored by Supabase (Postgres) — neither is necessarily in your country. Sign-in email goes through Resend. Beta applications are stored with Kavedi’s own data, or go through Web3Forms if that is briefly unavailable, as the old waitlist did. This site is served through Cloudflare. We do not sell anything to anyone, and there is no advertising.

Worth knowing while Kavedi is free: we use free tiers of those AI providers, and some providers reserve the right to review content sent on a free tier to improve their services. If that matters for what people send you, wait until we are on paid plans before connecting a number — ask us and we’ll tell you where we are.

Who at Kavedi can see it

Access is limited to the Kavedi team, and only to run the service, support you, or fix something. Nobody reads your chats for any other reason — and for the most part there is nothing to read, because conversations are not stored.

The people who message you

They are messaging you, not us, and their messages stay in your WhatsApp. If you use auto-reply, Kavedi passes a message to an AI provider in order to answer it, keeps the question if it couldn’t, and records that a reply happened. Triggers only check a message’s words and kind against the ones you set; nothing is sent to an AI provider for them. A step that gets something from the internet fetches the web address you typed, from Kavedi’s server. If you put someone’s words in that address (a word after your trigger word, say), those words go to that site; nothing else about you or them does. What a site does with a request is up to that site, so only use addresses you trust. If someone replies STOP, that is stored permanently so nothing automatic ever reaches them again. If someone asks you to remove their details, email us and we will.

How long we keep it

What you teach it, your contacts, appointments and settings stay until you delete them or delete your account. Questions waiting for you stay until they are resolved or deleted. Scheduled messages are kept after sending so you can see what went out. Records of trigger runs are deleted after 30 days. What a trigger keeps while it waits for a reply is deleted when the reply comes, or within minutes of the wait running out. Server logs hold no message text — only counts, numbers and errors — and are kept by our hosting provider for a short period.

Your choices

Disconnect your number at any time in Settings → WhatsApp: Kavedi unlinks the device and forgets the stored login and address book. Delete account in the same place removes everything above — answers, triggers and their files, questions, contacts, labels, appointments, queued messages, settings and your sign-in — and cannot be undone. You can also email support@kavedi.com to ask for a copy of your data, a correction, or deletion.

Where you stand legally

Wherever you are, the arrangement is the same: for the people messaging you, you are in control of their data (the “controller”), and Kavedi processes it on your behalf. That is how the UK and EU GDPR describe it, as do Nigeria’s Data Protection Act and similar laws elsewhere. Your data is processed by the providers named above, who may be outside your country. You can ask us to hand back or delete what we hold at any time, and we’ll sign a processing agreement if you need one.

Security

Data is encrypted in transit. Session state and your saved address book are also encrypted at rest with a key held outside the database, and every request to Kavedi is checked against your signed-in account so one account can never read another’s. If something goes wrong that affects you, we’ll tell you.

Changes to this policy

Kavedi is early, and this will change as the product does. The date at the top changes with it, and anything material will be sent to you.