Privacy policy

1. Data we process and how we obtain it

1.1 Account data

To create and manage your access to the service, we process:

• User's first and last name.
• Email address.
• Company code (for access and authentication).
• Role within the company (administrator, user).
• Sign-up date and last logins.

Name, email and company code are used exclusively to manage access and the contractual relationship. Kulram does not use them for commercial purposes or profiling, nor does it share them with third parties, except for strictly necessary technical processors.

Company data appearing in the processed documents themselves (business name, tax ID of suppliers and customers, etc.) is data from the document content. The initial reading of the document happens locally on the user's computer. When AI extraction is activated, the necessary content is sent to our servers, which immediately forward it to the AI providers described in section 5 and return the result to the application; Kulram does not persistently store the content of those documents, it only processes it in transit to provide the service.

1.2 Billing and subscription data

To manage subscription payment, we process:

• Contracted plan (Basic, Growth or Business) and subscription dates.
• Billing history (amount, concept, date).
• Payment data (card number, etc.) is managed entirely by Stripe. Kulram never stores banking data on its servers.

1.3 Documents scanned from mobile

The mobile capture feature lets you photograph physical documents from a mobile device to transfer them to the desktop application. When you use this feature:

• Images are temporarily uploaded to our servers, a necessary step to synchronize them with the desktop application.
• Once the application confirms receipt, images are deleted from the server.
• The maximum retention period if synchronization is not completed is 30 days.
• Images travel encrypted over HTTPS and are stored in a private directory not publicly accessible.

1.4 AI credit usage

We record artificial intelligence usage data for billing and audit purposes:

• Number of reads performed, type of document processed (simple or complex) and credits consumed.
• Company and user performing each operation.

Kulram does not store the content of documents processed with AI. See section 4 for more detail.

1.5 Support tickets

If you send a support request, we process the message, your email, company code and any attachment you voluntarily choose to include.

1.6 Technical data

For security and operational purposes, we may record IP address, browser type, operating system, access timestamps, the requested page and the referring page. We use these logs in aggregate to understand how visitors reach the website.

1.7 Access requests

If you fill in the access request form, we process the name (yours or your company's), your email address, the number of employees, your main interest (optional), how you heard about us (optional), the plan you were viewing and the page from which you sent the form, solely to reply to you and to know, in aggregate, which channels bring requests. We receive them by email and store them in our database. If you do not end up creating an account, we delete them at most 12 months after your request.

1.8 Application settings synchronized across devices

So you don't lose your configuration when reinstalling the application or switching computers, and so users within the same company share the same configuration, the following desktop application settings are now also stored on our servers (previously they lived only on each user's computer):

• Shared by the company: the company's own data (except signature certificates and the signer's details, which stay on the PC only), the contact list, custom extraction profiles, categories, naming and smart-distribution rules, document naming templates, and saved sending recipients.
• Personal to each user: the application language, the destination folders configured for document distribution, and email templates (each user writes their own, they are not shared with the rest of the company).
• Never synchronized: passwords (they stay in the Windows credential store), digital signature certificates, or the signer's details (name, ID number, handwritten signature image).

The contact list may include personal data of third parties who are not Kulram users: contact persons at the Customer's suppliers and clients, and, if the Customer adds them, its own employees (for example, for payroll distribution). With respect to that data, Kulram acts as a data processor on behalf of the Customer: the terms of that processing are set out in the Data Processing Addendum (DPA). The Customer is responsible for having a sufficient legal basis to include that data in the application.

2. Purposes and legal bases

3. Local processing versus server processing

Kulram is designed around a privacy by design principle: much of the work happens directly on the user's computer. AI extraction, however, passes through our servers, which act as a technical intermediary to the AI providers, which forward it immediately and do not store it persistently: it is processed only in transit, solely to provide the service.

4. Artificial intelligence and documents

When the user activates AI processing in the desktop application, the document content (or relevant fragments) is sent to our servers, which act as a technical intermediary and immediately forward it to the corresponding AI provider for reading or data extraction. This mechanism exists so access keys to the AI providers are not exposed in each user's desktop application. Kulram does not persistently store the content processed this way.

Kulram will select AI providers with adequate GDPR guarantees who do not use the data sent to train their models. The list of active providers is detailed in section 5.

Kulram only logs on its servers the number and type of AI operations performed for billing purposes, never the content of the processed documents.

We recommend not processing documents containing especially sensitive data (health, ideology, criminal convictions, etc.) with AI without first checking the AI provider's policy regarding such categories.

5. Providers and international transfers

With every provider acting as a processor, the corresponding data processing agreements will be formalized in accordance with art. 28 GDPR.

6. Data retention

• Mobile capture images: deleted after the desktop application confirms the download. Maximum period: 30 days.
• Account data: while the account is active. After cancellation, kept for 2 years to handle potential claims.
• Billing data: 6 years from the issuance of each invoice, in accordance with the Spanish Commercial Code (art. 30, retention of books and supporting documentation).
• Support tickets: 2 years from ticket closure.
• Security logs: maximum 12 months.
• Access requests: maximum 12 months if no account is created.
• Synchronized company settings (contacts, company data, profiles, categories, templates, naming and distribution rules): while the company's account is active; deleted in cascade when the company is removed.
• Synchronized personal settings (language, destination folders): while the user's account is active; deleted in cascade when the user is removed.

7. Rights of data subjects

In accordance with the GDPR, you can exercise the following rights by addressing your request to support@kulram.com:

• Access (art. 15): know what data about you we process.
• Rectification (art. 16): correct inaccurate or incomplete data.
• Erasure (art. 17): request deletion when no longer needed or you withdraw consent.
• Restriction (art. 18): request that processing be suspended while a claim is resolved.
• Portability (art. 20): receive your data in a structured, machine-readable format.
• Objection (art. 21): object to processing based on legitimate interest.
• Withdrawal of consent (art. 7.3): where applicable, you can withdraw it at any time without retroactive effect.

We will respond within a maximum of one month from receipt of the request.

If you believe your rights have not been honored, you can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, the supervisory authority for Kulram as a company established in Spain. If you reside in another country of the European Economic Area, you can also address your complaint to the data protection authority of your country of residence; you can consult the official list on the website of the European Data Protection Board (EDPB).

8. Security

• Encrypted transmission via HTTPS/TLS for all communications with the server.
• Server access restricted by credentials and role permissions.
• Mobile images are stored in directories not publicly accessible.
• Passwords are stored as an irreversible hash (bcrypt).
• Activity log for anomaly detection.

In the event of a security breach affecting your personal data, we will notify you within the legally established timeframe if there is a risk to your rights.

9. Cookies

This website uses only technical cookies strictly necessary for the service to function (user session management). No tracking, third-party analytics or advertising cookies are used. See more detail in our cookie policy.

10. Changes to this policy

Kulram may update this policy when necessary. We will notify significant changes by email or through a notice in the application with at least 15 days' notice.

11. Data controller

The data controller is [Controller's business name]. For further contact and registration details, see the legal notice.

12. Contact

For any privacy question or to exercise your rights: support@kulram.com