Privacy Policy
Effective 30 July 2026
1. Who we are
Kudokit is a service for collecting and displaying customer testimonials, operated by Content Shifu Co., Ltd., 2529/163 Trok Nok Khet, Bangkok 10120, Thailand. For privacy questions or to exercise any right described here, contact hello@kudokit.co.
2. Two different roles — and why it matters to you
Kudokit handles personal data in two distinct capacities, and your rights differ depending on which one applies to you.
We are the controller for the accounts of our own customers: the people who sign up, sign in and pay. We decide what to collect and why, and this policy governs it.
We are a processor for testimonial content. When a business uses Kudokit to collect a review, that business decides what to ask and how the review is used; we only store and display it on their instructions. If you submitted a testimonial and want it removed or corrected, the business you gave it to controls that — contact them first. We will help them act on your request, and if you cannot reach them, write to us and we will pass it on.
3. What we collect
From our customers (account holders)
- Name, email address and password (stored only as a hash, never in readable form).
- Workspace details: business name, handle, logo, brand colours and fonts.
- Billing data: plan, subscription status and payment history. Card numbers are handled by Stripe and never reach our servers.
- Product usage: which features are used and when, plus server logs containing IP address and browser type.
From people who submit a testimonial
- Whatever the collecting business asks for — typically name, email, job title, company and the review itself.
- A photo or avatar, and video or audio if a video testimonial is recorded or uploaded.
- An automated transcript of video, so it can be captioned and searched.
- A star rating, and any private feedback given instead of a public review.
- Technical data needed to prevent abuse: IP address and a Cloudflare Turnstile check confirming a human, not a bot, submitted the form.
From visitors to a public wall or embedded widget
- Aggregate view and click counts, recorded per widget rather than per person.
- A
kudo_seenmarker in your browser’s local storage, used only to tell a repeat viewer from a new one. We do not use advertising cookies, and we do not track you across other websites.
4. Why we use it, and our legal basis
Under the GDPR and the PDPA we must state a lawful basis for each purpose:
| Purpose | Legal basis |
|---|---|
| Providing the service; collecting and displaying testimonials | Performance of a contract |
| Publishing a testimonial you submitted | Your consent, given when you submitted it, and the collecting business’s legitimate interest in showing genuine reviews |
| Taking payment and preventing fraud | Performance of a contract; legal obligation |
| Service emails (invitations, review requests, security notices) | Performance of a contract; legitimate interest |
| Blocking spam and abuse; rate limiting | Legitimate interest in keeping the service usable |
| Diagnosing errors and improving the product | Legitimate interest |
| Keeping accounting records | Legal obligation |
Where we rely on consent you may withdraw it at any time; that does not affect processing already carried out. Where we rely on legitimate interest you may object, and we will stop unless we have compelling grounds not to.
5. Who we share it with
We do not sell personal data, and we have never done so. We do not share it for cross-context behavioural advertising. Under the CCPA/CPRA that means we do not “sell” or “share” your personal information as those terms are defined.
We use third parties to run Kudokit. These are the categories of processor, what each handles, and where it operates. We keep this list current, and will name the specific providers on request — email hello@kudokit.co.
| Category | What it handles | Where |
|---|---|---|
| Cloud database and authentication | Your account, workspaces and testimonial records | Singapore |
| File and image storage | Logos, reviewer photos, generated images | Singapore |
| Profile picture lookup | A one-way hash of an email address — never the address itself — to check whether it already has a public profile picture. Any picture found is copied to our own storage, so this service is never contacted by people viewing a testimonial | USA |
| Application hosting | Running the app and its short-lived server logs | Singapore, USA |
| Payment processing | Subscriptions, invoices and card handling | USA, EU |
| Video platform | Hosting, encoding and captioning video testimonials | USA |
| Email delivery | Account, notification and review-request email | USA |
| AI processing | Transcription, quote extraction and translation of testimonial content | USA |
| Review sources you connect | Importing reviews you already have on other platforms | USA, EU |
| Bot protection | Confirming a human submitted a public form | Global |
| Error monitoring | Crash reports, configured to exclude request bodies, cookies and headers | USA, EU |
| Our own marketing email | Email, name and plan of Kudokit account holders only — never testimonial content, and never the people who leave reviews for our customers | EU |
If you are a Kudokit customer, you are the controller of the testimonial data these processors handle. Our Data Processing Agreementis the contract governing that, and it commits us to at least 30 days’ notice before we add or replace any processor handling testimonial data, with a right for you to object.
We may also disclose data where the law requires it, or to a buyer if the business is sold — in which case this policy continues to apply until you are told otherwise.
6. International transfers
Our primary database is in Singapore, and several processors above operate in the United States and the EU. Where we transfer personal data out of the EEA, the UK or Thailand we rely on the European Commission’s Standard Contractual Clauses, or the equivalent safeguards each provider offers, together with encryption in transit and at rest.
7. How long we keep it
- Account data — while your account is open. When you request deletion we schedule it 14 days ahead so an accidental or malicious request can be reversed, then delete it permanently.
- Testimonials — until the collecting business deletes them, or their workspace is deleted.
- Video — deleted from our video platform along with the testimonial it belongs to.
- Analytics — aggregate counts only, kept indefinitely because they identify no one.
- Billing records — retained as long as tax and accounting law requires, typically five years, even after an account closes.
- Server and error logs — a short rolling window, then discarded.
8. Your rights
Depending on where you live you have some or all of the following rights. Email hello@kudokit.co and we will respond within 30 days (PDPA and GDPR) or 45 days (CCPA/CPRA).
- Access — a copy of the personal data we hold about you.
- Correction — fix anything inaccurate.
- Deletion — erase your data. Account holders can start this themselves under Settings → Profile.
- Portability — your data in a machine-readable form. Customers can export testimonials to CSV at any time.
- Objection and restriction — object to processing based on legitimate interest, or ask us to pause it.
- Withdraw consent — where consent is the basis.
- Non-discrimination (California) — exercising a right will never mean worse service or a higher price.
- Human review — we make no decisions about you by automated means alone that have legal effect.
If you believe we have handled your data improperly you may complain to your data protection authority: the Office of the Personal Data Protection Committee in Thailand, your national supervisory authority in the EEA, or the ICO in the UK.
9. Security
Data is encrypted in transit and at rest. Passwords are hashed. Access between customer workspaces is isolated at the database level as well as in the application, so one customer cannot reach another’s data. Administrative access is limited to staff who need it and is logged. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority within the timeframes the law sets — 72 hours under the GDPR.
10. Children
Kudokit is a business tool and is not intended for anyone under 16. We do not knowingly collect their data; if you believe a child has submitted personal data through Kudokit, tell us and we will delete it.
11. Cookies
We use only what the service needs to work: a cookie that keeps you signed in, one that remembers your active workspace, one that remembers your language, and Cloudflare Turnstile’s bot check on public forms. There are no advertising or cross-site tracking cookies, which is why you are not asked to accept any.
12. Changes
We will update the effective date above when this policy changes, and email account holders before any change that materially affects them.
See also our Terms of Service.