Consent comes first
Kirora provides per-channel consent records, permission checks and unsubscribe controls to support responsible marketing. The Privacy Policy and Data Processing Agreement explain how personal data is handled.
- Consent is held per channel. Email and push are separate, so an opt-out on one never affects the other.
- Every change keeps its history: when it happened and where it came from, such as a signup form, an import or the API.
- Consent is checked before each marketing message, not only when an audience is built.
- Every marketing email has a one-click unsubscribe and a preference centre. Neither needs a login, and both take effect at once.
Workspaces and roles
Each business is a workspace, fully separate from every other. Contacts, events, messages and settings never cross between them, and one person can belong to several and switch without signing out.
- Every workspace has one owner, plus admins and members. Sensitive actions such as API keys, exporting or deleting contacts, and managing people need the owner.
- Owners can limit sending, scheduling and going live to admins only.
- Removing someone ends their access to that workspace immediately.
Signing in
- No account exists until the email address is proven with a one-time code.
- Two-factor sign-in with an authenticator app, with recovery codes.
- Every sign-in path is rate-limited, and sensitive steps such as transferring ownership or deleting a workspace ask for your password again.
API keys and webhooks
- API keys carry explicit scopes, an optional expiry and an optional IP allow-list. The full key is shown once.
- Rotating a key keeps the old one working for up to 7 days while you deploy the new one. Revoking ends it at once.
- Agent keys for AI tools can read and draft, but can never send, schedule, activate, or change contacts and consent.
- Outbound webhooks are signed, retried on failure, and refused for addresses on private networks.
AI drafts under human control
- Kiro AI drafts and suggests. Sending, scheduling and activating always need a person to confirm.
- Text stored in your data, such as a contact’s name, is treated as data, never as an instruction.
- Admins can switch AI off for the whole workspace.
Audit and request logs
Admins can see every API request and every sensitive action after the fact: who did what, and when. Audit log retention depends on your plan, subject to the service’s retention limits. See the plan comparison for the retention period.
Your data, your call
- Contacts: export everything you hold about a person, or erase them, from the app or the API.
- Your account: download your own profile and activity, or delete your account.
- Workspaces: deleting one stops sending at once. The owner has 14 days to change their mind, and then everything in it is gone.
- Retention: event and message history follow your plan, subject to the service’s retention limits. Form submissions are kept for 1 year. See the Privacy Policy for details.