Privacy Policy

Last updated: · SamDad Consulting Limited (trading as Kassa)

1. Introduction

SamDad Consulting Limited (trading as "Kassa", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website kassaai.com (the "Site") and use our AI chatbot services (the "Services").

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU AI Act where applicable. Please read this policy carefully. If you do not agree with the terms of this policy, please do not access the Site or use our Services.

🔍 Key point: Kassa is built with privacy by design. We never pretend to be human, we minimise data collection, and we give you control over your information. You remain the data controller for your own business data; we act as your data processor.

2. Information We Collect

We collect information that you provide directly to us, information that is generated through your use of our Services, and information from third-party sources where permitted by law.

2.1 Information you provide to us

Account information: When you sign up for an account, we collect your name, email address, business name, and password.
Billing information: When you subscribe to a paid plan, we collect payment details (processed securely by our payment provider — we do not store full card numbers).
Business content: You may upload or link your website content, FAQs, and other business information so Kassa can learn about your business. This content is stored securely and used solely to power your chatbot.
Communications: When you contact our support team or respond to our communications, we keep a record of that correspondence.

2.2 Information collected automatically

Usage data: We collect information about how you interact with our Site and Services, including page views, button clicks, session duration, and error reports.
Device & browser information: We collect IP addresses, browser type, operating system, and referring URLs to help us improve performance and security.
Cookies & tracking: We use essential cookies to keep you logged in and to remember your preferences. We may also use analytics cookies (e.g., Plausible or similar privacy-first tools) to understand how our Site is used — these are opt-in where required by law.
Conversation logs: Chat conversations between your website visitors and the Kassa chatbot are stored in your dashboard. This data belongs to you, and we process it only to provide the Service.

3. How We Use Your Information

We use your information for the following purposes:

To provide and maintain our Services: Including training your chatbot, delivering responses, and managing your account.
To improve and personalise: We analyse usage patterns to make the chatbot smarter and the dashboard easier to use.
To communicate with you: Including service updates, billing notices, support responses, and (with your consent) marketing materials.
To ensure security and prevent fraud: We monitor for suspicious activity and protect your account from unauthorised access.
To comply with legal obligations: We may retain and disclose information where required by law or to protect our rights.

⚖️ Lawful basis: We rely on the following lawful bases for processing your personal data: (a) your consent, (b) the performance of a contract with you, (c) our legitimate business interests (e.g., improving our Services, security), and (d) compliance with legal obligations.

4. Cookies & Tracking Technologies

We use cookies to enhance your experience on our Site. Cookies are small text files stored on your device.

Essential cookies: Required for the Site to function (e.g., authentication, session management).
Preference cookies: Remember your settings, such as language or layout.
Analytics cookies: We use privacy-first analytics (like Plausible) to understand how visitors interact with our Site. These do not use persistent identifiers and are GDPR-compliant by design.

You can manage your cookie preferences in your browser settings. However, disabling essential cookies may affect your ability to use certain features of the Site.

5. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

With service providers: We engage trusted third parties to help us deliver our Services — for example, cloud hosting (AWS), payment processing (Stripe), and email delivery. These providers are contractually bound to protect your data and use it only for the services they perform for us.
With your consent: We may share information with third parties if you have given us explicit permission to do so.
For legal reasons: We may disclose information if required by law, regulation, or legal process, or to protect the safety, rights, or property of Kassa, our users, or the public.
Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

6. Data Security & Retention

6.1 Security measures

We implement industry-standard security measures to protect your data, including:

Encryption of data in transit (TLS) and at rest (AES-256).
Regular security audits and vulnerability testing.
Access controls — only essential personnel have access to production data, and all access is logged.
Secure data centres with physical and environmental protections.

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to continuous improvement.

6.2 Data retention

We retain your information for as long as your account is active or as needed to provide you with our Services. If you close your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain certain information for legal or regulatory purposes (e.g., billing records for 6 years as required by UK tax law).

7. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

Right to access: You can request a copy of the personal data we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete data.
Right to erasure: You can request that we delete your personal data ("right to be forgotten").
Right to restrict processing: You can ask us to temporarily limit processing of your data.
Right to data portability: You can request that we transfer your data to another service provider.
Right to object: You can object to our processing of your data for direct marketing or based on legitimate interests.
Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at privacy@kassaai.com. We will respond within one month of receiving your request, as required by law.

📬 Data Controller vs Processor: For your business data (conversations, customer info, etc.), you are the data controller. Kassa acts as a data processor, processing your data only on your instructions. For the personal data we collect directly from you (your account details), Kassa is the data controller. We are registered with the UK Information Commissioner's Office (ICO) — registration number ZC234892.

8. Children's Privacy

Our Services are not intended for children under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child under 16, we will take steps to delete that information.

9. International Data Transfers

Kassa is based in the United Kingdom. We may store and process your data in the UK and in other countries where our service providers operate. We ensure that any international data transfers are conducted in compliance with UK GDPR, using appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions where applicable.

10. Third-Party Links

Our Site may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. We encourage you to read the privacy policies of any external sites you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date at the top. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Questions about this policy: contact us, or see our Privacy Policy for how we handle personal data more broadly.

Data Protection Officer: You can also contact our DPO at dpo@kassaai.com

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Company information

Kassa is a trading name of SamDad Consulting Limited.

Registered in England and Wales, Company No. 11280941.

Registered Office: Ripley, Derbyshire, DE5 3WA, United Kingdom.

📄 This policy was last updated on .