Kewka Privacy Policy

Last updated: September 21, 2026

Who we are

Kewka LLC ("Kewka," "we") operates the Kewka Hub at kewka.ai. Questions about this policy go to privacy@kewka.ai.

What Kewka is

Kewka is a data hub for automobile dealerships. A dealership sends its own business data to Kewka from the systems and vendors it already uses. Kewka stores that data in one place. Dealership staff review it, decide field by field who may see what, and turn sections on for use. Every request for the data is checked against the access the dealership set, and only what a seat is allowed to see is returned.

Information we collect

Account and sign-in. You sign in with your dealership business email through your dealership's sign-in provider. The provider confirms your email address and name, which we use only to identify your seat and match it to the access your dealership has set up. We never see or store your password. If your email is not on your dealership's seat list, you are shown a "no seat" page and nothing else.

Dealership business data. The dealership itself sends Kewka records from its vendors and feeds — today, inventory, deal, service and parts records. These records may include personal information about the dealership's customers (for example, names and contact details on a deal or repair order). The dealership decides what to send and what to make visible.

Usage and audit records. We keep: sign-in events; the dealership's own review and approval actions (which seat, which store, what was approved, when); and a log of every read of the data — what was asked for, whether it was answered or refused, how many rows were returned, when, by which seat, and through which connected application. The log never stores the answer or any data value.

Technical. Standard server request logs (IP address, time, path, status). One session cookie used only to keep you signed in. No advertising cookies. No third-party analytics.

How we use it

To operate the service for your dealership: storing its data, showing it to the people it has seated, answering requests within the limits it set, keeping the access log it can read back, providing support, and keeping the service secure. That is the whole list.

What we never do

• Sell, rent or trade any data.
• Use one dealership's data for any purpose other than operating the service for that dealership.
• Show one dealership's data to another dealership. Kewka does not combine data across dealerships today. Any future benchmark program would be opt-in by a separate written consent, would never identify a single store, and would never include customer or employee records.
• Install anything in, or operate inside, the dealership's own email, office or vendor systems. Sign-in proves who you are; it does not give Kewka access to anything else in your account.

Who can see the data

Only people the dealership has seated, and each of them only the classes of data their position has been granted. Access is granted, never assumed: a seat that lacks a grant gets a plain refusal, not a partial answer, and the refusal is logged. Every request is checked against the seat's own dealership before any data is touched; a request about another dealership is refused.

Kewka staff access is limited to what is needed to run the service, uses named individual accounts, and is recorded in our audit logs. Kewka does not browse dealership data.

Connected applications

A dealership may connect applications of its own choosing to read its data through Kewka. A connected application asks Kewka for data on behalf of the signed-in person; Kewka returns only rows that person's seat is allowed to see, and logs every request. What happens inside the connected application — how it stores what it receives, its own retention — is governed by that vendor's terms with the dealership, not by Kewka. Kewka does not send dealership data to any application on its own initiative.

Where data lives and security

Data is stored in the United States, in accounts Kewka owns and controls. It is encrypted at rest and in transit. Storage is private; raw files are write-once and are never edited. Access to our systems uses individual least-privilege accounts; there are no shared credentials, and secrets are held in a managed vault. Reads and administrative actions are audit-logged.

Security incidents

If we confirm a security incident affecting a dealership's data, we notify that dealership's principal contact promptly — and no later than 72 hours after confirmation — with what we know, what we have done, and what we recommend the dealership do. We support the dealership in meeting any notice obligations it has to its own customers or regulators.

Retention

Dealership data is kept for as long as the dealership uses the service, and afterwards as set out in the dealership's agreement with Kewka. A dealership may ask us to delete its data. Audit and access logs are retained so that access history remains verifiable, including the record of a deletion.

Dealership customers' information

Where dealership records contain personal information about the dealership's customers, Kewka processes it on the dealership's behalf and under its instructions; the dealership remains the owner and the party responsible to its customers. If you are a dealership customer with a question or request about your information, please contact the dealership. Kewka handles this information in a manner aligned with the safeguards financial-information rules expect of a dealership's service providers.

Dealerships that require a data processing addendum, or a service-provider agreement under a state privacy law, can request one at privacy@kewka.ai.

Your privacy rights

Kewka is a Nevada company and serves dealerships across the United States. If you are a resident of a state with a consumer privacy law (for example, California or Nevada), you may have rights to know, access, correct or delete personal information about you, and to opt out of its sale or sharing. Kewka does not sell or share personal information for advertising, and does not use it for profiling.

• If you are dealership staff with a Kewka seat, contact privacy@kewka.ai. We will verify your identity through your dealership and respond within the time the applicable law allows.
• If you are a dealership's customer, your request goes to the dealership, which owns the record. Kewka acts as its service provider and will act on the dealership's instructions.

We do not discriminate against anyone for exercising these rights.

Cookies

One session cookie keeps you signed in and expires after a short period of inactivity. A short-lived cookie protects the sign-in handshake and is discarded when sign-in completes. The hub keeps some display preferences in your browser; that data stays in your browser and is not sent to Kewka.

Service providers

Kewka uses a small number of service providers for hosting, sign-in and secure file transfer. All are located in the United States, act only on our instructions, and are bound by written agreements that hold them to the commitments in this policy. A current list is available to any dealership on request at privacy@kewka.ai.

The dealership's data vendors and connected applications are the dealership's own choices and contracts; they are not Kewka's service providers.

Children

Kewka is a business tool and is not directed to anyone under 18.

Changes to this policy

When this policy changes, we update the date at the top and keep prior versions available on request. Material changes are notified to each dealership's principal contact.

Contact

privacy@kewka.ai · Kewka LLC