Privacy Policy

Stucly is operated by Kiwa Intel Inc., an Ontario corporation and the controller responsible for personal information processed through the Service. This Policy explains what we collect, why we use it, and whom we share it with. Capitalized terms not defined here have the meaning given in our Terms of Service.

1. Information we collect

We collect information needed to run the Service: account details such as email, password hash, optional display name, and postal code; projects, materials, searches, receipts, and settings; subscription status and masked payment metadata; scrubbed diagnostics; short-lived IP, user-agent, and referrer logs; and cookieless aggregate Umami events. We do not store full card numbers, expiry dates, or security codes.

2. How we use information

We use information to authenticate you, secure sessions, generate estimates and comparisons, save your work, process subscriptions and refunds, enforce quotas, diagnose errors, prevent abuse, improve reliability, and send necessary account, billing, or policy messages. Kiwa Intel does not sell personal information or use your projects and notes to train third-party generative-AI models.

3. Legal bases for processing

Where a legal basis is required, we rely on performance of our contract, legitimate interests in security and reliability, consent for optional communications, and legal obligations that require retention or disclosure.

4. Sub-processors and third parties

We use Supabase for authentication and databases; Railway for hosting; Google Gemini for AI features; Zyte for public retailer-page retrieval; Sentry for scrubbed diagnostics; Lemon Squeezy for billing, cards, invoices, and tax; and Umami for cookieless aggregate analytics. Each receives only information needed for its role under contractual restrictions.

5. Retailer data

Retailer lookups are anonymous and server-to-server. We do not give retailers your identity, email, or account ID. A retailer may log a request from our infrastructure but cannot associate it with a specific Stucly user through us.

6. Cookies, local storage, and analytics

First-party cookies and local storage keep you signed in, remember preferences, and support the offline shell. We do not use advertising trackers. Cookieless Umami analytics record aggregate page views and high-level product events, including search terms without identity, and do not build advertising profiles or track you across websites.

7. Data retention

We keep account data while the account is active. After deletion, profile, projects, materials, receipts, and feedback are removed within 30 days, except limited records required for legal, tax, or fraud-prevention purposes. Access logs and diagnostics are generally retained for a rolling 30-day window.

8. Your rights

Depending on where you live, you may access, correct, export, delete, or object to uses of personal information. Export and deletion controls are available in Settings. Contact legal@kiwaintel.com for help. Quebec users also have Law 25 rights, including portability and objections to certain uses.

9. International data transfers

We operate from Canada. Some providers may process information in the United States or other countries. Where required, contractual clauses or equivalent safeguards protect information transferred across borders.

10. Children

The Service is not directed to children under 13 and we do not knowingly collect their personal information. Contact legal@kiwaintel.com if you believe a child provided information so we can delete it.

11. Security

We use HTTPS, encryption at rest for the primary database, scoped provider access, hashed passwords, and per-environment secret management. No system is perfectly secure. We will notify affected people of a qualifying breach as required by law.

12. Changes to this policy

We may update this Policy. We will notify you through the Service or by email at least 14 days before a material change takes effect.

13. Contact

Send privacy questions, requests, or complaints to Kiwa Intel Inc. at legal@kiwaintel.com. We will respond within a reasonable time and route requests appropriately where required.