Effective date: 28 September 2026
Last updated: 28 September 2026
This policy explains how Klovis Technologies Ltd ("Klovis", "we", "us") collects and uses personal data when you visit our website, sign up for or use the Klovis service, or when your details are held in a Klovis workspace by one of our customers.
Klovis Technologies Ltd is a company registered in England and Wales (company number 17296963). Our registered office is 434-436 Liverpool Road, London, N7 8NL, United Kingdom.
We have not appointed a Data Protection Officer. For anything about this policy or your personal data, email legal@kloviscrm.com.
We handle personal data in two different capacities, and your rights work differently in each.
We are the controller for data about the people who use Klovis and visit our website: account holders, workspace members, people who contact us, and visitors to kloviscrm.com. This policy covers that data in full.
We are a processor for data our customers put into Klovis: their contacts, prospects and conversations, visitors to their websites who use the Klovis chat widget, visitors to their help centres, and people who book meetings through their booking pages. Our customer decides what that data is and how it is used, and our customer is the controller. We only process it on their instructions, under our Data Processing Agreement. If you are a contact of one of our customers and want to exercise your rights, please contact that customer directly. If you contact us, we will pass your request on to them.
Account and profile data. When you sign up or are invited to a workspace: your name, email address, password (stored only as a one-way hash), company and workspace name, role, and profile picture if you add one. This comes from you, or from the workspace admin who invited you.
Sign in with Google. If you choose "Continue with Google", Google gives us your Google account ID, email address, first name and last name. See section 6.
Connected channel accounts. When you connect a LinkedIn, WhatsApp, email or other messaging account, the connection is made through our connectivity provider, Unipile. We never see or store your password for those services. We store a reference to the connection, your own profile identifier on that service, and the messages and conversations that sync into your workspace.
Billing data. If you subscribe, our payment provider Stripe collects your card details. We never see or store your full card number. We receive from Stripe and keep your billing name, email, billing address (used to calculate tax), subscription status and invoice history.
Sign-in and security data. Your IP address and browser details each time you register, sign in, reset your password, or when an API key is used unsuccessfully, together with an audit log of significant actions in your workspace. We use this to keep accounts secure and to investigate problems.
Error monitoring and session replay. When something goes wrong, the app sends a technical error report to our monitoring provider, Sentry. We also record sessions in the web app so we can reproduce problems and see how the product is used. Recordings mask all text, form inputs and media on the screen, and are tagged with your user ID, email and workspace. You can ask us to stop recording your sessions at any time by emailing legal@kloviscrm.com. Our server-side error reports are configured not to include request contents, cookies or your contacts' personal data.
Performance data. We use Vercel Speed Insights to measure how quickly pages load. It collects anonymous technical measurements and does not use cookies.
Communications. Emails and messages you send us, including through the chat on our website and our help centre.
Website visitors. When you visit kloviscrm.com, our website host (Webflow) and its network provider (Cloudflare) receive the technical data your browser sends, such as IP address and device type. Our website also runs the Klovis chat widget, which records the pages you visit, where you came from (referrer and campaign links) and your country (not your IP address) for 90 days, and anything you type into the chat. See our Cookie Policy.
What you must give us. You must give us your name and email address to create an account; without them we cannot provide the service. Billing details are needed for a paid subscription. Everything else is optional.
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account and providing the service | Contract |
| Taking payment, issuing invoices, keeping tax and accounting records | Contract; legal obligation |
| Keeping the service secure, preventing fraud and abuse, enforcing our Terms | Legitimate interests: protecting our service and customers |
| Error monitoring, session replay and fixing problems | Legitimate interests: running a reliable product |
| Service emails, such as password resets, billing notices and changes to our terms | Contract; legitimate interests |
| Answering questions, chats and support requests | Legitimate interests; contract |
| Telling business customers about new Klovis features | Legitimate interests. Every such email has an unsubscribe link. |
| Understanding how visitors use our website | Legitimate interests |
| Complying with law and responding to lawful requests | Legal obligation |
We do not sell personal data. We do not make automated decisions about you that have legal or similarly significant effects.
Klovis does not currently send your data, or your contacts' data, to any AI or large language model provider.
Klovis lets you connect your own AI agent (for example an AI assistant you use) to your workspace with an API key. When you do this, your agent reads and acts on your workspace data under the permissions you set. That agent, and the provider behind it, is chosen and controlled by you, not by Klovis, and its handling of data is governed by your agreement with that provider.
If we add AI features that process personal data, we will update this policy before they go live.
If you sign in with Google, Klovis requests only the basic profile scopes (openid, email, profile). We use your Google account ID, email address and name only to create your Klovis account, sign you in and show your name in the app. We keep them for as long as your Klovis account exists and delete them when your account is deleted. They are protected by the security measures in section 10. We do not use this data for advertising, we do not sell it, and we do not transfer it to anyone except as needed to provide the service, to comply with law, or as part of a merger or acquisition.
Klovis's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If you connect a Gmail or Google Calendar account as a sending or calendar account, that connection is authorised through our connectivity provider, Unipile. The email and calendar data that syncs into your workspace is used only to provide the inbox, campaign, calendar and booking features you use. It is not used for advertising, is not read by people at Klovis except with your permission, for security, or to comply with law, and is not used to train any AI model.
You can revoke access at any time from your Google account permissions page (https://myaccount.google.com/permissions) or by disconnecting the account in Klovis.
We share personal data only with service providers who help us run Klovis, under contracts that require them to protect it:
| Provider | What they do | Where the data is processed |
|---|---|---|
| Neon (contracted through Vercel) | Main database | United Kingdom (London) |
| Railway | Application servers, cache and job queue | Netherlands (Amsterdam) |
| Railway | Malware scanning of files uploaded in website chat | United States (Virginia) |
| Vercel | Web app hosting and delivery, page-speed measurement | Global edge network; United States |
| Unipile | Connecting LinkedIn, WhatsApp, email and other messaging accounts | France (European Union) |
| Cloudflare | File storage (R2), DNS, and network for our website | Global |
| Resend | Sending and receiving email | United States; European Union (Ireland) |
| Sentry | Error monitoring and session replay | European Union (Germany) |
| Stripe | Payments and billing | United States; European Union |
| Webflow | Hosting our marketing website | United States |
| Google, Mozilla, Apple, Microsoft (browser push services) | Delivering push notifications you switch on | United States |
We also share data with our professional advisers and accountants (for example for bookkeeping and tax), with authorities where the law requires it, or with a buyer if Klovis or its assets are sold. A buyer would have to honour this policy.
Some of our providers are based in, or can access data from, countries outside the UK, mainly the United States. Where a country does not have a UK adequacy decision, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or, for US providers certified under it, the UK Extension to the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards at legal@kloviscrm.com.
We protect personal data with measures that include encryption in transit, encryption at rest by our database and storage providers, row-level separation of each customer's data in the database, one-way hashing of passwords and API keys, malware scanning of files uploaded in website chat, and role-based access controls. No system is perfectly secure. If a breach affects your personal data and is likely to put you at high risk, we will tell you without undue delay.
Under UK data protection law you have the right to:
Your right to object. Where we rely on legitimate interests (such as security, error monitoring, session replay and product emails), you can object at any time and we will stop unless we have compelling grounds to continue. You can always object to direct marketing, and we will stop straight away.
To exercise any of these rights, email legal@kloviscrm.com. We will respond within one month. We may need to confirm your identity first.
If you want to complain about how we handle your personal data, email legal@kloviscrm.com with "Complaint" in the subject line. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
If you are still unhappy, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Klovis is a business service and is not intended for anyone under 18. We do not knowingly collect data from children.
If we make significant changes, we will tell account holders by email or in the app before they take effect. The date at the top shows when this policy last changed.
