The short version
Kavaro collects the information we need to provide, secure and improve the service.
We do not sell your personal data. We do not share your personal data with advertisers.
Some Kavaro features use artificial intelligence. When you use those features, your prompts and related content may be processed by third-party AI providers, including OpenAI and Anthropic, so that the feature can work.
This Privacy Policy explains what we collect, how we use it, who we share it with, and what rights you have. If anything is unclear, contact us at hello@kavaro.io.
Who we are
Kavaro is operated by Meet Departures Limited, a company registered in England and Wales under company number 16451721.
Our registered office is Suite 206, Britannia House, 11 Glenthorne Road, London, W6 0LH.
For the purposes of UK data protection law:
- Meet Departures Limited is the controller of account, billing, and usage data about people who sign up for Kavaro.
- When a customer organisation enters information about its staff (names, emails, roles, rates, schedules), that customer is the controller of that data and Meet Departures Limited is the processor. Those processor terms are set out in our Data Processing Agreement.
You can contact us at:
Email: hello@kavaro.io
Address: Suite 206, Britannia House, 11 Glenthorne Road, London, W6 0LH
What we collect
We may collect the following types of information.
Account information
This may include your name, email address, company name, login method (Auth0 identity), account settings, organisation membership, and subscription details. We do not store your password — authentication is handled by Auth0.
Billing information
If you subscribe to a paid plan or start a free trial that transitions to a paid plan, our payment provider (Stripe) will process your payment details. We typically receive limited billing information only, such as your billing email, billing address, plan, payment status, invoices and transaction references. We do not store full card details ourselves.
Content you add to Kavaro
This may include people records, project plans, bookings, rates, notes, messages, files, settings, generated outputs and other content you submit to the service.
AI prompts and outputs
When you use AI features, we may process:
- the prompts or instructions you submit
- relevant context needed to generate a useful response
- AI-generated outputs
- usage data such as request time, model used, token usage or error messages
Usage and technical data
We collect information needed to run and secure the service, such as IP address (used for login rate limiting), browser session cookies, error logs, and security events. We do not use third-party analytics or advertising cookies in the application.
Communications
If you contact us, we may keep your message, email address and any information needed to respond.
Marketing preferences
If you sign up for updates or marketing emails, we may collect your email address and preferences. You can unsubscribe at any time.
How we use your information
We use personal data to:
- provide, operate and maintain Kavaro
- create and manage accounts
- process subscriptions, trials and payments
- provide AI features when you use them
- save your work and settings
- respond to support and data-protection requests
- send service messages, such as account, billing, security and trial notices
- monitor usage limits and prevent abuse
- debug errors and keep the service secure
- comply with legal obligations
Our lawful bases
Where UK GDPR applies, we rely on one or more of the following lawful bases:
- Contract: to provide Kavaro to you and manage your account
- Legitimate interests: to secure, operate and improve Kavaro, prevent abuse, and communicate about the service
- Consent: where we ask for consent, such as optional marketing
- Legal obligation: where we need to comply with the law
- Processor instructions: when we process your organisation’s staff data, we do so on the customer’s documented instructions (the DPA)
AI processing
Kavaro uses third-party AI providers, including OpenAI and Anthropic, to provide AI-powered features. When you use an AI feature, your prompts, uploaded content, context and related information may be sent to the AI provider for processing.
You should not submit information to AI features unless you have the right to do so. You should avoid submitting highly sensitive information unless it is necessary for your use of Kavaro and permitted under your own policies.
We do not use your personal data to train our own AI models. We do not use your customer content to train third-party foundation models.
Who we share information with
We share personal data only where needed to run Kavaro, provide the service, comply with the law, or protect our rights. We do not sell your personal data. We do not share your personal data with advertisers.
A current list of subprocessors is published on our Security & GDPR page. In summary this includes:
- Auth0 — sign-in and identity
- Stripe — payments and billing
- DigitalOcean — hosting (London, LON1) and encrypted backups
- Resend — transactional email
- OpenAI and Anthropic — AI features, only when those features are used
If you connect Slack, Jira or Trello, those services receive the data you choose to send through the integration. They are your processors, not ours.
We may also share information with professional advisers, or with authorities where required by law. If we sell, merge or transfer part of our business, personal data may be shared with the relevant buyer or successor under appropriate safeguards.
International transfers
The Kavaro Resourcing application and its production database are hosted in the United Kingdom (DigitalOcean LON1).
Some subprocessors may process personal data outside the UK (for example AI providers). Where this happens, we rely on adequacy regulations, standard contractual clauses, or the provider’s own approved transfer mechanism.
Cookies and similar technologies
The marketing site stores a first-party cookie, kv_ft, for 90 days. It records the referrer, the first page you landed on, any UTM source, medium and campaign, and the time of that visit, so we can see where a trial signup started. It is not used for advertising.
Kavaro uses an essential session cookie (PHPSESSID) to keep you signed in. Superadmin uses a separate session cookie. These cookies are necessary for the service to work.
We do not use analytics, advertising or other non-essential cookies in the application, so we do not show a cookie consent banner. You can still control cookies through your browser settings; blocking the session cookie will sign you out.
How long we keep information
We keep personal data only for as long as reasonably needed for the purposes described in this Privacy Policy.
- Account and organisation content is kept while the organisation is active.
- After an organisation is closed, we delete it from the production database. You may request an export before closure; we will provide one on request.
- Billing records may be kept for accounting and tax purposes (typically up to 6 years in the UK).
- Sessions expire after 30 days of inactivity.
- Login rate-limit records (IP address and email) are deleted after 24 hours.
- Pre-deploy database copies and DigitalOcean automated backups are retained for disaster recovery and are pruned on a documented schedule. Deleted data may persist in backups until those backups are pruned or roll off. If we restore from a backup, we re-apply any erasure requests honoured since that backup was taken.
- Support messages are kept as long as needed to handle your request and maintain business records.
Security
We use technical and organisational measures to protect personal data, including TLS 1.2 or higher in transit, encryption of connected-service tokens at rest, organisation-scoped access, role-based permissions, rate limiting on login, and restricted server access. More detail is in our Security page.
No online service can be completely secure. You are responsible for keeping your account login details safe and telling us if you suspect unauthorised access.
Your rights
Depending on where you are and how data protection law applies, you may have rights to:
- access your personal data
- correct inaccurate personal data
- delete personal data
- restrict how we use personal data
- object to certain uses of personal data
- receive a copy of your personal data in a portable format
- withdraw consent where processing is based on consent
- complain to a data protection authority
To exercise your rights, contact us at hello@kavaro.io. We may need to verify your identity before responding. We aim to respond within one month.
You also have the right to complain to the UK Information Commissioner’s Office (ICO). We would always appreciate the chance to address your concern first.
If you are an employee whose data was entered by a Kavaro customer, please contact that organisation first — they are the controller of your staff record. We will support them in fulfilling your request.
Marketing
We may send you product updates or marketing emails if you have signed up or where the law otherwise allows. You can unsubscribe at any time using the link in our emails or by contacting us.
We will still send important service messages, such as billing, security, trial and account notices, regardless of your marketing preferences. Digest emails include an unsubscribe link.
Children
Kavaro is not intended for children under 18. You must not create an account if you are under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete it promptly.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, such as by email or by posting an updated version on our website. The “Last updated” date at the top shows when it was last changed.
Contact
Questions about this Privacy Policy should be directed to:
Meet Departures Limited
Email: hello@kavaro.io
Address: Suite 206, Britannia House, 11 Glenthorne Road, London, W6 0LH