How to read this list
This page identifies the core providers and user-directed connected services that can process personal information when Kulaya operates or supplies a requested feature. The exact information depends on the feature a family chooses. Inclusion here does not mean every company is a processor for every interaction; a company can process on Kulaya's instructions for one service and under its own terms for another.
This list supplements the Privacy Policy, Children's Privacy Notice, and Consumer Health Data Privacy Policy.
Supabase, Inc.
Services: authentication, database, synchronization, realtime delivery, and private file storage.
Information: account identifiers, family and member profiles, family content, health and nutrition records, encrypted connected-service credentials, files, role and access information, and technical or security records needed to provide the Service.
Processing locations: locations described by Supabase for the configured project, support, and infrastructure.
Vercel Inc.
Services: website and application hosting, content delivery, server-side execution, security, and operational logs.
Information: IP address, browser and device details, request timing, routes, error details, cookies or headers needed for an authenticated request, and content submitted to a server-side feature.
Processing locations: locations described by Vercel for its hosting, support, and delivery network.
OpenAI
Services: optional AI inference and safety moderation through the OpenAI API. The registered project, contractual controls, data-processing terms, and reviewed retention settings must be in place before activation.
Kulaya offers two separately authorized AI purposes for eligible adults aged 18 or older. All AI features, including the Learning helper, are unavailable to anyone under 18. Parental approval does not override that restriction. Guest accounts cannot use AI. Non-AI family features retain their separate age and access rules.
Reduced general assistant: OpenAI. GPT-5.6 Terra processes only the adult's current typed or dictated question and its answer. We do not attach earlier chat messages, stored family records, school-email content, files, or images. This mode cannot read or change app data, browse the web, or execute tools. Do not submit children's information, private family details, contact information, or sensitive health information. Local screening reduces accidental disclosure but cannot reliably identify every kind of personal information in free text.
Existing Gemini permissions do not authorize OpenAI processing. Earlier full-assistant permissions do not authorize either new limited purpose. Each requires its own current notice and choice.
OpenAI also performs input and output safety moderation. We send an opaque safety identifier, not a raw email or account ID. API content is not used for model training by default. Kulaya's OpenAI Zero Data Retention request is pending, not approved: standard provider safety retention can apply. Disabling response storage is not ZDR. The full family-data assistant, uploads, and automatic OpenAI calendar classification remain disabled pending their separate privacy and readiness checks. See OpenAI's API data controls.
Email summaries: DeepInfra. With a separate adult permission, DeepInfra processes message text and subjects using DeepSeek V4 Flash to produce private summaries, importance assessments, action lists, and suggested calendar dates. Messages can concern school, work, household, or other topics; an approved sender is not a school-only filter. We do not send the stored family roster or email attachments, follow links, or automatically approve calendar changes. Email content is not sent to OpenAI. Only use this feature for information you are authorized to share, including any child information in an email.
Connecting Gmail alone does not authorize AI processing. You must save approved senders and select matching messages for manual analysis, or separately opt into checks about every ten minutes for newly arriving messages. Pasted or forwarded email also requires the separate email-summary AI permission. There is no automatic historical backfill. Empty checks do not call AI. The current pilot limits attempts and shares the household AI allowance; frequency is not a delivery guarantee or an emergency service.
Kulaya does not retain raw email bodies after processing. Private summaries, message identifiers, subjects, senders, proposed dates, and processing outcomes can remain until deleted. DeepInfra's terms prohibit training on customer content and limit content retention, with support, security, and legal exceptions. Technical prompt caching may apply; Kulaya does not request extended cache retention. It is not a promise that no data is ever retained, or a claim of U.S.-only processing. See DeepInfra's terms and the provider list.
Review or withdraw each permission separately in Settings → AI & family permissions. Background email checks can also be paused in Gmail settings. Withdrawal blocks future requests, but a transmission already sent cannot be recalled. General chat can remain in the current device's local history until cleared; it is not forwarded as conversation context. Permission, usage, and security records are retained as described in this policy. None of these choices authorizes another person's account.
AI is not a person, therapist, emergency service, or professional adviser. Safeguards cannot guarantee every answer is safe or correct. Check original messages and review proposed dates before accepting them. Do not rely on AI output for diagnosis, treatment, or medical, legal, financial, or high-impact decisions. In the U.S., call 911 for immediate danger or call/text 988 for a suicide or mental-health crisis.
Processing locations: the locations supported by the configured OpenAI service and agreement; this notice does not promise U.S.-only processing.
DeepInfra, Inc.
Services: optional email-summary analysis using DeepSeek V4 Flash, hosted by DeepInfra.
Service and routing: paid, usage-based serverless inference through DeepInfra's API, using model deepseek-ai/DeepSeek-V4-Flash. This is not a DeepSeek consumer-chat account or a model self-hosted by Kulaya. Our email route is fixed to DeepInfra; it has no fallback to OpenAI, Google, Anthropic, or another model gateway. DeepInfra's published data-handling documentation describes its no-training and no-sharing rules and identifies exceptions for its Google and Anthropic model routes, which this email feature does not use.
Information: authorized email subjects and text, generated summaries, importance assessments, action lists and suggested dates. This can include school, work, household, or other topics from approved senders or messages an eligible adult explicitly submits. Stored family rosters and email attachments are not sent. This permission is separate from OpenAI and from automatic mailbox checks.
Retention and processing: DeepInfra's terms prohibit model training on customer content and limit retention, with support, security and legal exceptions. Technical prompt caching may apply; we do not request extended cache retention. This list does not promise U.S.-only processing.
DeepInfra Terms · DeepInfra Privacy Policy · Inference data handling
Google LLC: user-connected services
Services: optional adult Google Sign-In, read-only Google Calendar and Gmail access, and OAuth. These user-connected services are separate from OpenAI processing and use separate access controls. Google connected-service features remain adult-only.
Information: basic profile and email information for sign-in; account identifiers, authorized scopes, Calendar events, Gmail headers, snippets, and a selected message body for optional connected features.
For Gmail extraction, Kulaya does not retain the selected message body after processing. Kulaya can retain the message identifier, subject, sender, and processing status or outcome to prevent duplicate imports and track the result.
Google Sign-In, Calendar, and Gmail are user-directed Google services. Kulaya's use of Google API information is also governed by the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including Limited Use requirements. These restrictions cover raw, aggregated, anonymized, and derived Google user data and take precedence over broader provider descriptions on this page. Google user data may not be used or transferred to create, train, or improve foundational or generalized AI models. See the Google data-use commitment for permitted transfers and human-access restrictions.
Google LLC: automatic web-font delivery
Services: automatic delivery of the Inter and Sora typefaces used by Kulaya's web interface. This is not a user-directed connection.
Information: when a web page loads, the browser requests the font stylesheet and files from Google and provides the IP address, browser details, requested font, referrer information sent by the browser, and ordinary request metadata needed to return them. Google handles the request under its own privacy policy and operates services across other websites.
Plus Five Five, Inc. (Resend)
Services: delivery of authentication and account-related email through Kulaya's configured Supabase authentication service.
Information: recipient email address, authentication or account-message content, message identifiers, delivery status, and related delivery metadata.
Zoho Corporation
Services: hosting and delivery for Kulaya support and privacy-request email.
Information: sender and recipient addresses, subject, message content, attachments, message identifiers, and delivery or support correspondence metadata supplied when a person contacts us.
Device and browser services chosen by the user
A browser, Apple, Google, or device manufacturer can process information under its own terms when a user chooses a camera, photo, microphone, speech-recognition, notification, app-store, or health-export feature. These services are controlled through the user's device or service account and are not always acting as Kulaya's processor.
Kulaya does not receive a user's app-store password. Raw Apple Health, Garmin, and Samsung Health export files selected for import are designed to be parsed on the device; only summaries the user saves are synchronized to Kulaya.
Changes to providers
Kulaya can update this list as providers or features change. We will update the date and provide the additional notice or consent required before a new provider receives sensitive health information or children's information for a materially different purpose.
Questions about a provider or a change can be sent to support@kulaya.app.