Privacy Policy

Kravio (Israeli sole proprietor, business ID 203203229, Ganim 1, Ariel 4071201, Israel) operates a CRM platform at kravio.io. The platform is sold to business owners (the "Customer") — coaches, real-estate agents, accountants and insurance agents — to manage their own clients.

An important distinction: for the Customer's own account details we are the data controller. For the information a Customer enters about their clients (contacts, leads, trainees) we are only a data processor (a "holder" under Israeli law) and the Customer is the controller; we act on their instructions. If your enquiry concerns that kind of information, please contact the business you dealt with directly; we will assist them in handling it.

• Customer account details: name, email, phone, business name and sector.
• Business information entered by the Customer: contacts, leads, appointments, tasks, documents, training and nutrition plans.
• Communications: the content of WhatsApp and email messages sent or received through the platform, including transcripts of conversations with the AI agent.
• Information about trainees who use the app: see "The trainee app" below.
• Technical usage data: administrative action logs (audit log), errors and security data.

We do not collect sensitive information beyond what a Customer or their clients choose to enter, and we never use one Customer's data for another. Every tenant is isolated at the database level.

To provide the service only: displaying data to the Customer, sending reminders and updates on their behalf, running the AI agent they enabled, billing, support and security. We do not sell personal information and we do not use it for advertising.

Messages are delivered through Meta's WhatsApp Business Platform. When a business connects its own WhatsApp Business account to the platform, messages are sent from that business's phone number and under its responsibility, and Meta bills that business directly for the conversations.

A first business-initiated message is only sent to someone who submitted their details voluntarily (a contact form, or manual entry by the business). Every business-initiated message carries an opt-out: reply "הסר" (or "stop") to that message. The opt-out is recorded immediately and stops both reminders and AI agent outreach to that client record at that business. If you later submit your details to the same business again, that is treated as a new enquiry; to avoid it, ask the business not to contact you, or write to us.

Some conversations are handled by an automated agent (AI). The agent states that it is automated when asked, and hands the conversation to a person on request.

Coaches who use Kravio can invite their trainees to a personal area — on the web and in the Kravio iPhone app. A trainee account is only created by the coach's invitation. The coach is the controller of their trainees' information, and we process it on the coach's behalf.

What is collected:

• Sign-in details: email and password. The password is stored hashed and we cannot see it.
• Date of birth — to enforce the age policy (see "Minimum age and minors").
• What the trainee enters: body measurements (such as weight and circumferences), workout and meal logs, reminders, and sign-ups for sessions.
• Forms and health declarations the coach sends for completion, including a signature. At signing we also record the time, the IP address and the browser details, as evidence of the signature.
• A device identifier for notifications (push token) — only if the trainee allowed notifications. It is used solely to deliver reminders.

Health and body information is sensitive. It is shown to the trainee and to their coach's team and used to manage their training. If the coach uses Kravio's AI assistant, the information (including measurements and workout logs) is processed by Anthropic to answer the coach's questions, and is not used to train models. Kravio staff can view it only if the coach granted temporary support access, and every such access is logged. It is not passed to anyone else other than the sub-processors listed below.

What is not collected: the app uses no third-party advertising, tracking or analytics tools and does not track users across other apps or websites. It does not access the device's location, contacts, camera or photos.

Cookies and on-device storage: only cookies required for signing in are used. The device also keeps the last coach selected (so it does not ask again) and the display preference (light or dark). On the website, the browser may keep a copy of personal area pages so they show without an internet connection.

Notifications: reminders are delivered through Apple's notification service (in the iPhone app), Google's (in the Android app) or the browser's (on the web). In the apps, Apple or Google delivers the reminder text to the device. Notification content is shown on the lock screen and may be visible to anyone holding the device. Any reminder can be turned off in the app, and notifications can be blocked in the device settings.

Demonstration videos: videos in training and nutrition plans are embedded from YouTube (privacy-enhanced mode) or Vimeo (do-not-track mode). When a screen containing a video is displayed, that provider receives technical information from the device, such as the IP address and browser details, under its own privacy policy.

• The app is intended for ages 13 and over. Children under 13 cannot use it.
• A trainee aged 13–17 can use the app only after the coach confirms in the system that a parent or guardian has consented. The system records who confirmed and when. Changing the date of birth cancels the confirmation.
• Obtaining the parent's consent is the coach's responsibility, as set out in the Terms of Service.
• Anyone whose date of birth is under 13 is blocked automatically. If we learn that a child under 13 is using the app, we will make sure their access is blocked and ask the coach to delete the account and the information. A parent can ask to review or delete their child's information, from the coach or from us.

The following sub-processors process information on our behalf, under an agreement that requires them to protect it at least as well as this policy does:

• Supabase — database and file storage (EU region).
• Vercel — application hosting.
• Meta Platforms — WhatsApp message delivery.
• Twilio — alternative WhatsApp channel, being phased out.
• Resend — email delivery.
• Apple — notification delivery to the iPhone app (Apple Push Notification service).
• Google — notification delivery to the Android app (Firebase Cloud Messaging).
• Anthropic — the language model powering the WhatsApp agent and the coach's AI assistant. The information is not used to train models.
• Sumit — payment processing and invoicing (once billing is activated; it receives no data today).

Services the device contacts directly, under their own privacy policies and not on our behalf: the browser's push service (such as Google, Apple and Mozilla), which receives an encrypted notification it cannot read; YouTube and Vimeo (videos); and Google Calendar — only when you tap "add to calendar", which sends it the event details.

Some providers process data outside the European Union; such transfers rely on Standard Contractual Clauses (SCCs) or an adequacy decision.

Business information, communications and conversation transcripts are retained for as long as the Customer's account is active — the system does not delete them automatically after a period of time. Deletion happens either at the business's initiative (deleting an item or a contact in the system) or following a deletion request sent to us, as described in our data deletion instructions. Such a request is handled within 30 days.

Deleting a contact immediately deletes their conversations and transcripts as well. The log of sent messages (WhatsApp and email) is kept separately as an operational record — it is detached from the contact record on deletion, but still contains the phone number and the message content. A full deletion request removes that too.

A trainee who deletes their account in the app: the sign-in and the devices registered for notifications are deleted immediately, as are the measurements, workout and meal logs and reminders the trainee entered. The client record (including date of birth), sessions, payments and completed forms remain with the coach as their business record, as described in the data deletion instructions. The coach decides how long those records are kept.

Administrative (audit) logs and the sign-in system's security logs (such as sign-in time and IP address) are retained for security purposes. Accounting records are retained as required by law (7 years) and are not deleted on request. Deleted information may remain for a limited time in the infrastructure provider's automatic backups until they are replaced in the normal backup cycle.

You have the right to access your information, correct it, delete it, restrict its use and receive it in a portable format. To exercise these rights, see our data deletion instructions or contact us. For information about trainees and contacts, the request is handled by the business, which is the controller, and we assist it.

You are not legally required to give us any information. Without an email address, a password and a date of birth the trainee app cannot be used, and forms and declarations are completed at the coach's request.

If you believe your rights have been infringed, you may complain to the Israeli Privacy Protection Authority (and, in the European Union, to your local data protection supervisory authority).

Data is encrypted in transit (TLS) and stored on infrastructure where disks are encrypted at rest. Access is isolated between tenants at the database level (Row Level Security), and administrative actions are logged. To report a suspected breach: security@kravio.io.

privacy@kravio.io · Ganim 1, Ariel 4071201, Israel

We may update this policy from time to time. Material changes will be shown to Customers in the application before they take effect. In case of any discrepancy, the Hebrew version of this policy prevails.