Privacy Policy
This policy explains how Kula handles personal data. Kula is operated by Eventuallycoding, a sole proprietorship registered in France (see the legal notice), which is the controller described below. For any privacy question or request, write to support@kulamail.com.
1. Two roles
Kula handles two kinds of personal data, in two different roles.
- As controller, for the data of our own customers and visitors: your account, your team, your billing, your support requests, and the use of our website and dashboard. This policy describes that processing.
- As processor, for the data of the people our customers email: their contacts, the emails sent to them and the way they interact with these emails. The customer decides what is collected and why; we process it only on their instructions, under our Data Processing Agreement. If you received an email sent through Kula, the sender is the controller: contact them to exercise your rights, or write to us and we will forward your request.
We do not sell personal data, do not use our customers' contacts for our own marketing, and do not show ads.
2. Data we collect as controller
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Email address, name, account and team membership | You, when you sign up or are invited | Create and secure your account, sign you in with a one-time code, let your team work together | Contract |
| Sending domains, settings, API keys, connected AI agents | You | Provide the service | Contract |
| Conversations with the AI assistant | You | Answer your requests in the dashboard | Contract |
| Plan, usage (number of emails sent), credit balance | The service | Bill usage, apply the limits of your plan | Contract |
| Billing details and payment | Creem, our merchant of record | Sell and invoice paid plans | Contract, legal obligation |
| Support messages | You | Answer you | Contract, legitimate interest |
| Technical logs, error reports | The service | Keep the service secure and working, investigate abuse | Legitimate interest |
| Service emails (login codes, alerts, invoices reminders, important changes) | The service | Operate your account | Contract |
Payment card details are collected and processed by Creem, never by Kula. Creem acts as an independent controller under its own privacy policy.
Our logs do not record email addresses or IP addresses of your contacts. Our website, kulamail.com, uses no analytics and no tracking.
3. Data we process for our customers
To deliver our customers' emails, Kula processes, on their behalf: contact details and attributes they choose to store (at least an email address), list subscriptions and their confirmation, the content of the emails, delivery events (sent, delivered, bounced, complaint), and engagement events (opens through a tracking pixel, clicks through redirected links, unsubscribes), including the user agent of the device that opened or clicked. The full description is in Annex 1 of the Data Processing Agreement.
In addition, and as controller, Kula keeps one shared list of addresses that hard-bounced (addresses that do not exist), and stops all customers from sending to them. This protects the deliverability of every sender and the reputation of our infrastructure, which is our legitimate interest. The list contains only the address, the date and the reason.
4. Recipients
Personal data is accessible only to Kula and to the providers that help us run the service, listed on our subprocessors page: hosting (Hetzner, Germany), email delivery (Amazon Web Services, France), error monitoring (Sentry, EU), the AI assistant (Anthropic, United States, only when you use it) and our support mailbox (Proton, Switzerland). We may also disclose data when the law or a court requires it.
5. Transfers outside the European Union
Our servers and backups are in the European Union. When you use the AI assistant, your conversation and the data the assistant reads to answer are sent to Anthropic in the United States. This transfer is covered by the European Commission's Standard Contractual Clauses. Proton is in Switzerland, which the European Commission recognises as offering adequate protection.
6. Retention
| Data | Kept |
|---|---|
| Account, team and settings | As long as the account exists, then deleted within 30 days of its closure |
| Contacts, emails and reports of a space | As long as the space exists, then deleted within 30 days of its deletion |
| Content of transactional emails sent as raw HTML | 30 days after sending |
| Conversations with the AI assistant | As long as the account exists |
| Login codes and session tokens | Until they expire (one day at most for unused codes) |
| Technical logs | A few weeks |
| Billing records | 10 years, as required by French accounting law (kept by Creem for the payment itself) |
| Shared list of hard-bounced addresses | As long as it is useful to protect deliverability |
| Database backups | 7 days |
7. Security
All traffic is encrypted (HTTPS, TLS). Backups are encrypted before they leave our server. Sign-in uses one-time codes sent by email, without passwords. Access to production is limited to the operator of Kula. See Annex 2 of the Data Processing Agreement for the full list of measures.
8. Cookies
The dashboard (app.kulamail.com) uses only essential cookies: one to keep you signed in and one to remember the space you are working in. They do not need your consent. The website (kulamail.com) sets no cookies.
Emails sent by our customers may contain a tracking pixel and tracked links; their use is decided by each customer, as controller.
9. Your rights
Under the GDPR, you can access your data, have it corrected or deleted, receive it in a portable format, object to processing based on our legitimate interest, and restrict processing. Write to support@kulamail.com; we answer within one month. You can also lodge a complaint with the French data protection authority, the CNIL, or the authority of your country.
10. Children
Kula is not intended for people under 18, and we do not knowingly collect their data.
11. Changes
We may update this policy. We tell account owners by email of any significant change before it applies. The date of the current version is shown at the top of this page.