Legal · Privacy
Privacy policy: what we collect, why, and what we never keep.
Last updated: November 1, 2026. This privacy policy explains how 8Kava Labs LLC handles personal information about visitors to 8kava.com, customers who use Kava OS, and shoppers who buy from 8Kava devices. Our devices look at products, not people: no images of faces are stored or sent.
Six things to know before the details
This summary is for convenience. The full policy below is what applies.
Products, not people
Recognition on 8Kava devices runs on the device and identifies products. We don't use facial recognition, and no images of faces are stored or sent.
Card data stays with processors
Card numbers are encrypted at the reader and handled by payment processors. We receive a token, the card brand and the last four digits, not the full number.
We don't sell personal information
We don't sell it or share it for cross-context behavioral advertising, and brands on device screens never learn who a shopper is.
Customers control device data
When an operator or location host runs 8Kava devices, we process shopper data on their behalf and under their instructions.
Hosted in the US, encrypted
Kava OS data is hosted in US regions and encrypted in transit with TLS 1.2+ and at rest with AES-256.
You have choices
Ask to see, correct or delete your information, or opt out of marketing email, at any time. Write to hi@8kava.com.
1. Who we are and what this policy covers
8Kava Labs LLC ("8Kava", "we", "us") is located at 2821 Remington Street, Suite 101, Fort Collins, CO 80525. We make smart vending and micro-retail hardware and the Kava OS software platform that runs it.
This policy covers personal information we collect:
- through 8kava.com and our emails (website visitors);
- from businesses, and their users, that sign up for, use or buy Kava OS, 8Kava hardware or our services (customers); and
- at 8Kava devices, such as Kava Cooler, Kava Vend, Kava Kiosk, Kava Box, Kava Lockers, Kava PPE and Kava Outdoor, and through the Kava app (shoppers).
Our two roles. For website visitors, customer accounts and Kava app accounts, 8Kava decides how information is used and is responsible for it. For shopper data collected at devices a customer operates, the customer (usually a vending operator, an employer or another location host) decides how its program runs, and we process that data on its behalf under our customer agreement. If you're a shopper with a question about a specific device, we'll help, and we may pass your request to the customer who runs it.
This policy doesn't cover websites or services run by others, including payment processors and customers' own apps, which have their own policies.
2. Website visitors
What you give us. When you fill in a form, such as a demo request or a site-assessment inquiry, we collect what you enter: typically your name, work email, phone number, company, role, number of locations and your message. When you email hi@8kava.com, vending@8kava.com or support@8kava.com, we keep the correspondence.
What we collect automatically. Our servers log your IP address, browser and device type, pages requested, referring page and time of visit. We use a small number of cookies and similar technologies: essential ones that make the site work, and analytics that show us which pages are read and where visitors get stuck. We don't use third-party advertising cookies on 8kava.com. We treat a Global Privacy Control signal from your browser as a request to opt out of any sharing that a law treats as a sale or as targeted advertising.
The ROI calculator. Figures you enter into the ROI calculator are used to produce your estimate. We don't attach them to your identity or contact you about them unless you send them to us, for example with a demo request.
How we use it. To answer your inquiry, schedule demos, prepare quotes, send information you asked for, operate and secure the site, and understand how it's used so we can improve it. If you sign up for updates, we'll email you, and every message includes an unsubscribe link.
3. Kava OS customers
Account and business information. When your organization uses Kava OS or buys hardware or services, we collect account details for your users (name, work email, phone and role, such as owner, manager, driver or restocker, technician, finance or brand partner), billing contacts and records, contracts, support tickets and call notes.
Usage and operational data. Kava OS records how the web console, operator app and driver app are used: sign-ins, actions taken, settings changed and audit-log entries, including approvals and actions by Kava Agent. Driver and technician apps may record the phone's location while a route or service job is active, so routes can be planned and visits confirmed. Devices send operational telemetry such as sales, inventory, temperatures, door events, energy use, errors and connectivity, which on its own generally doesn't identify anyone.
How we use it. To provide, secure and support Kava OS; to bill; to send service and security notices; to improve our products, including by training and evaluating models on aggregated or de-identified operational data; and to meet legal obligations.
Your business data is yours. You can export it at any time through the API or as CSV or Parquet files. We don't sell it, and we don't use one customer's identifiable data for another customer's benefit.
4. Shoppers at 8Kava devices
On-device recognition. Kava Cooler and Kava Box use cameras and shelf weight sensors to work out which products were taken. Recognition runs on the device's own processor and is designed to look at products, not people. We don't use facial recognition, we don't create biometric identifiers, and no images of faces are stored or sent. When a disputed charge or an accuracy check needs a visual review, only imagery of the product area is used, and it's kept no longer than needed to resolve the issue. Learn how Vision AI works.
Transactions. For each purchase we record the device, time, items, prices, any discount or subsidy applied, the payment method type and the payment result. If you pay by card or mobile wallet, your card data is encrypted at the reader and processed by a payment processor; we receive a token, the card brand and the last four digits, not your full card number. Processors handle card data under their own privacy policies.
Kava app, badges and payroll deduction. If you use the Kava app or QR checkout, we hold your account details (name, email and phone if you provide it), a payment token, your purchase history and any loyalty balance. If you pay with an employee badge or by payroll deduction, your employer or the location host provides an identifier that links the purchase to your account in its program. It can see purchases charged to that program and decides how long they're kept. Lockers and PPE dispensers record which badge, code or account opened which compartment or received which item, because that's how those services work.
Shopper analytics. Some devices count anonymous events, such as door opens, time spent at the device, and items picked up and put back, to improve layouts and assortments. These analytics are aggregated, don't identify individuals and aren't used to follow anyone across devices or locations.
Retail media. Screens on some devices show ads or promotions. Brands see aggregated campaign results, such as impressions and purchases at the same device. They never receive shopper identities.
5. How we share information
We share personal information only as described here:
- Customers. Operators and location hosts receive transaction and program data from the devices they run.
- Service providers that host our platform in US regions, process payments, send email, and provide support, analytics and security tools, under contracts that limit their use of the data to the services they provide to us.
- Field partners who install and service devices on our behalf, limited to what a job requires, such as a site contact's name and phone number.
- Brand partners running retail media campaigns, who receive aggregated results only.
- Legal and safety. When we believe disclosure is required by law, subpoena or court order, or is needed to protect the rights, property or safety of people, our customers or 8Kava.
- Business transfers. If 8Kava is involved in a merger, acquisition or sale of assets, information may transfer to the successor, which must honor this policy for information collected under it.
Legal bases. If you're in a place, such as the European Economic Area or the United Kingdom, where the law requires a legal basis for processing, we rely on performing a contract with you, our legitimate interests in running and improving our business, your consent where we ask for it, and compliance with legal obligations.
6. Retention and security
Retention. We keep personal information only as long as we need it for the purposes above. Website inquiries and sales records are kept while a conversation is active and for a reasonable period afterward. Customer account data is kept for the life of the account, then deleted or de-identified within a reasonable period after the agreement ends, except records we must keep for legal, tax or accounting reasons. Transaction records are kept for the period the customer sets in Kava OS, subject to legal minimums for financial records. Temperature and food-safety logs are kept as long as the customer needs them for audits.
Security. Data is hosted in US regions and encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is role-based and logged. Card data stays within processors' P2PE-capable readers and systems, and our internal controls are SOC 2-aligned. No system is perfectly secure; if a breach affects your personal information, we'll notify you and the relevant authorities as the law requires. Read more on our Security & Trust page.
7. Your rights and choices
Depending on where you live, including under the California Consumer Privacy Act, the Colorado Privacy Act and similar state laws, you may have the right to:
- know what personal information we hold about you and get a copy in a portable format;
- correct inaccurate information;
- delete information we hold about you;
- opt out of the sale of personal information, targeted advertising, and profiling that produces legal or similarly significant effects (we don't do any of these); and
- not be treated differently for exercising these rights.
How to ask. Email hi@8kava.com with "Privacy request" in the subject line, or write to us at the address below. We'll verify your request, usually by matching details we already have, and respond within 45 days, or tell you within that time if we need up to 45 more days, as the law allows. You may use an authorized agent; we may ask for proof of their authority.
Appeals. If we decline your request, you can appeal by replying to our decision with "Appeal" in the subject line, and we'll respond within the time the law requires. If you're a Colorado resident and you're not satisfied with the outcome of an appeal, you may contact the Colorado Attorney General.
Shopper requests. If your request concerns purchases at a device run by an operator or employer, we'll help, and we may forward it to that customer, which controls that data.
Marketing email. Use the unsubscribe link in any message, or email us. Service and security notices to customers continue while an account is active.
8. Children, international visitors, changes and contact
Children. Our website and Kava OS are built for businesses and aren't directed to children under 13, and we don't knowingly collect their personal information through them. 8Kava devices can be used by shoppers of any age; because recognition identifies products, not people, a purchase isn't linked to a person unless an account, badge or card is involved. If you believe a child has given us personal information, email hi@8kava.com and we'll delete it.
International visitors. 8Kava operates in the United States and stores and processes information here. If you contact us from elsewhere, your information will be transferred to the US, where privacy laws may differ from those where you live.
Changes. We'll update this policy as our products and the law change. We'll post the new version here with a new "Last updated" date, and if a change is material, we'll tell customers by email or in Kava OS before it takes effect.
Contact. Privacy questions and requests: hi@8kava.com. By mail: 8Kava Labs LLC, Attn: Privacy, 2821 Remington Street, Suite 101, Fort Collins, CO 80525. By phone: (678) 451-2033. For accessibility requests, see our accessibility statement.
Ask every smart device one question: what do you remember about me?
A good answer is short. Ours: which items left the shelf, when, what they cost and how they were paid for. Not your face, not your full card number, not where you went next. If you're choosing equipment for your building, ask each vendor to answer in one sentence, in writing. A vendor who needs a page to answer is telling you something.
Privacy questions shoppers and customers ask
Does a Kava Cooler recognize my face?
No. Its cameras and shelf sensors identify products, and recognition runs on the device. We don't use facial recognition, and no images of faces are stored or sent.
Can my employer see what I buy?
Only purchases charged to a program your employer runs, such as payroll deduction, badge payment or a meal subsidy. Purchases you pay for with your own card or mobile wallet aren't linked to your name in Kava OS reports.
Do you sell my data?
No. We don't sell personal information or share it for cross-context behavioral advertising. Brands running campaigns on device screens see aggregated results only.
How do I delete my Kava app account?
Email hi@8kava.com from the address on the account, and we'll delete it once we've verified the request. Records that must be kept for legal or financial reasons, such as transaction records a customer is required to retain, are kept only as long as needed.
Where is my data stored?
Kava OS data is hosted in US regions, encrypted in transit with TLS 1.2+ and at rest with AES-256. Enterprise customers can arrange custom data residency.
Where to go next
A question about your data deserves a person, not a form.
Write to us with any privacy question or request. For how we protect data in depth, read Security & Trust.