Kiuey — operated by PPAP Mgr, Corp.

Effective date: September 15, 2026
Last updated: August 11, 2026
Version: 2.0 (replaces the policy dated August 6, 2020)

Summary

This is a plain-language overview. It is not a substitute for the full policy below.

• Kiuey, including PPAP Manager, is enterprise software. In most cases your employer — not you — decides that you use the Service and what information goes into it.
• We handle two different kinds of information, under two different sets of rules. Customer Data is the quality documentation, part records, and related content your organization puts into the Service. We process it only on your organization’s instructions and we do not use it for our own purposes. Account and usage data — your name, work email, and technical logs — we manage ourselves so we can run, secure, and improve the Service.
• We do not sell or share your personal information, and we do not use advertising trackers on our websites.
• Customer Data is hosted in the United States by default. Customers may elect European hosting.
• The Service includes an optional AI document review add-on. It checks your documents and writes its findings to your account, where they are treated exactly like the documents they came from. Your documents are never used to train any model and are never used for anything other than producing your own review.
• You have rights over your personal information. How to use them is set out in “Your rights” below.

Questions or complaints: privacy@kiuey.com.

1. Who we are and what this policy covers

Kiuey is the brand under which we provide supplier quality software, including PPAP Manager and our other supplier quality modules.

The company behind Kiuey — and the legal entity responsible for the information described in this policy — is PPAP Mgr, Corp. (“we”, “us”, “our”), a Delaware corporation with its registered address at 651 N. Broad Street, Suite 206, Middletown, DE 19709, United States, and offices at Newlab, 2050 15th St., Detroit, MI 48216, United States. PPAP Mgr, Corp. is the contracting party on our customer agreements and the entity accountable under data protection law, regardless of which brand name appears in the product you use.

This policy applies to:

• the Kiuey platform and all of its modules, including PPAP Manager, and any associated mobile or desktop clients (the “Application”);
• the websites at kiuey.com and ppapmanager.com (the “Websites”);
• our support portal at help.ppapmanager.com; and
• our sales, marketing, and support communications.

Together these are the “Service.”

This policy does not apply to third-party websites we link to, or to systems your employer operates.

2. The two roles we play

Understanding which role applies to a given piece of information determines who you contact and what rights apply.

2.1 We are a processor for Customer Data

When your organization (“Customer”) subscribes to the Service, it uploads and generates content: PPAP submissions, control plans, dimensional results, FMEAs, supplier correspondence, and similar records. We call this Customer Data. It may contain personal information such as names, work email addresses, and signatures, and it will frequently contain commercially sensitive or trade-secret information.

For Customer Data:

• The Customer is the controller. We are the processor.
• We process Customer Data only on the Customer’s documented instructions, as set out in our Data Processing Agreement.
• Customer Data belongs to the Customer, not to us and not to individual users.
• We do not use Customer Data to develop or improve our products, to train models, or for any purpose other than delivering the Service to that Customer.
• If you want Customer Data about you accessed, corrected, or deleted, contact your employer first. If you contact us, we will forward your request to the Customer without undue delay and support them in responding.

2.2 We are a controller for account, usage, website, and marketing data

For the information we need to operate the business — user account records, technical logs, security telemetry, website analytics, and sales and marketing contacts — we determine the purposes and means ourselves, and we are the controller. You can exercise your rights directly with us for this data.

3. Information we collect

3.1 Information you or your employer provide

We do not request or intentionally collect special category data (health, biometrics, race, religion, political opinion, trade union membership, sexual orientation), government identifiers, or payment card numbers through the Application.

3.2 Information collected automatically

• Device and browser information: operating system and version, browser, device type and model, language, screen characteristics.
• Network information: IP address, internet service provider, approximate connection speed.
• Usage information: date and time of access, pages and features used, actions taken within the Application, error and diagnostic events.
• Approximate location derived from IP address, at city level. We do not collect GPS or precise location data.
• Cookies and similar technologies on our Websites — see section 9.

3.3 Customer Data

Content submitted by or on behalf of a Customer, as described in section 2.1. We do not control what a Customer chooses to upload. Customers are responsible for ensuring they have a lawful basis for any personal information they place in the Service.

3.4 Sources other than you

We may receive your business contact details from your employer when it provisions your account, and from publicly available professional sources such as a company website or LinkedIn profile. We do not purchase or enrich marketing lists from data brokers.

3.5 Usage measurement

We measure how much the Service is used — for example, the number of PPAPs processed — because usage forms part of how your organization is billed. This measurement is part of delivering the Service under your organization’s contract and cannot be switched off while the Service is in use. It records volumes and activity, not the contents of your documents.

4. How we use information, and our legal basis

For users in the European Economic Area, United Kingdom, and other jurisdictions requiring a stated legal basis:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You may object — see section 10.

5. Artificial intelligence features

The Service includes an optional AI-assisted document review add-on (“AI Review”), enabled only if your organization chooses to activate it.

What it does. AI Review checks a submitted PPAP package against the PPAP elements and returns findings — gaps and inconsistencies, each referencing its source page — to your account.

What happens to the documents.

• The package is processed in a temporary environment for the duration of the review only, and the working copy is discarded when the review ends.
• The findings produced by the review are written to your organization’s account and are Customer Data. Findings are derived from your documents and may quote or reference their contents, and they are therefore subject to exactly the same confidentiality, access, security, and retention terms as the source document itself — including the retention periods in section 7. Nothing produced by AI Review is treated as ours or held under different terms.
• We do not use your documents, or the findings derived from them, for any purpose other than producing that review for your organization. No training, no product development, no analysis across customers.

Model and provider.

• AI Review uses a large language model operated through Amazon Bedrock, within our AWS environment. AWS acts as our sub-processor. Bedrock is a service of Amazon Web Services, Inc. — the same company that already hosts the Service — not a separate vendor. See section 6.1.
• The model developer supplies the model but does not operate the inference infrastructure and does not receive your content.
• No retention. Bedrock does not store inputs or outputs after the request completes. The add-on has no memory between reviews: a document reviewed today cannot appear in or influence any other review, for your organization or any other.
• No training. Content submitted to AI Review is not used to train, fine-tune, or customize any model, ours or any third party’s.
• Abuse detection. AWS applies automated, machine-only abuse-detection classifiers to Bedrock traffic. These involve no human review and no storage of your content.

Data residency. By default, AI Review runs in the United States — AWS US East (Ohio), us-east-2. Amazon Bedrock is available in AWS regions worldwide, and we can deploy AI Review in a different region at your organization’s request, including within the European Union. If your organization requires processing in a specific region or within a specific geographic boundary, raise this with your account manager and we will configure it at setup and confirm the configured region in writing. Where a deployment uses AWS routing that may distribute requests across more than one region, those regions remain within the geographic boundary agreed with your organization. Model availability and version can vary between regions, and we will tell you if the region you request affects this.

Activity logging. We record an activity log entry for each review — when it ran, which submission it concerned, and at whose request. The activity log records event metadata only. It does not contain document content or findings text. Because it is an accountability and audit record, it is retained indefinitely; see section 7.

Model invocation logging is disabled. Amazon Bedrock offers an optional feature that writes the full text sent to and returned by the model into logs. We have this turned off. The content of a review is therefore never written to any AWS logging destination.

Encryption. Content is encrypted in transit and at rest throughout.

Human oversight. AI Review flags findings. It does not approve, reject, or sign any submission. Your engineers make every decision, exactly as they do without the add-on.

Turning it off. Customer administrators can disable AI Review. When disabled, no content is sent to any model.

Automated decision-making. We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not profile or score suppliers or individuals automatically.

6. Who we share information with

We do not sell personal information. We share it only as follows.

6.1 Sub-processors

We use the vendors below. A current list, including any additions, is maintained at https://kiuey.com/subprocessors/.

Each row above is a single company under a single data processing agreement. Where a company provides more than one service to us, those services are listed together rather than as separate entries, because the entity — not the service — is what receives your data.

We impose written data protection terms on every sub-processor and transfer the minimum information each one requires.

Amazon Bedrock is an AWS service, not an additional vendor. The optional AI Review add-on runs on Amazon Bedrock, which is provided by Amazon Web Services, Inc. — the same company that already hosts the Service, under the same agreement. Enabling AI Review does not introduce any new company into our supply chain.

The developer of the AI model is not a sub-processor. The model used by AI Review is supplied by its developer but operated entirely by AWS within our environment. The developer does not run the inference infrastructure, has no access to it, and does not receive your content.

We give Customers at least 30 days’ notice before adding a new sub-processor that processes Customer Data, and Customers may object as set out in the Data Processing Agreement.

6.2 Other users in your organization

Other users at your organization can see your full name, business email address, job title, and the content you create in the Service.

6.3 Your employer

We provide the Customer, and its authorized legal, technical, and administrative representatives, with information in our possession about users on its account. Your employer may also direct us to suspend, modify, or delete your account.

6.4 Professional advisers

Legal, accounting, audit, and security advisers bound by confidentiality.

6.5 Legal and safety

Government authorities, courts, and law enforcement in response to valid legal process. Where we are legally permitted to do so, we will notify the affected Customer before disclosing Customer Data.

6.6 Corporate transactions

If PPAP Mgr, Corp. is involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. We will notify affected Customers and, where required, individual users.

7. How long we keep information

Two kinds of retention clock. Information tied to a customer relationship — Customer Data, account data, and support history — is kept for as long as your organization is a customer, because you need it while you are using the Service. The retention period only begins when the relationship ends. Information not tied to a customer relationship — technical logs, and contact records for people who never became customers — is kept for a fixed period from the record’s own age or last activity, since there is no relationship to measure from.

Backups. We keep encrypted backups on the following cycle:

Backups exist for disaster recovery only. When information is deleted from the live Service, it may persist in a backup until that backup ages out of the schedule above. During that period we do not access, search, or use backed-up data for any operational purpose, and information deleted at your request or ours is not reinstated if a backup is restored. Because of this, the retention periods stated in the table above are the periods for which information remains available in the live Service; backup copies expire on the cycle shown here.

We may retain information longer where required by law, or where necessary to establish, exercise, or defend legal claims. In that case we restrict processing to that purpose.

On termination, Customers may export their Customer Data before deletion. Passwords are never included in any export.

8. International transfers

We are based in the United States. Customer Data is hosted in the United States by default. Customers may elect European Union hosting for Customer Data — contact your account manager to arrange this. For Customers on European hosting, this election also covers processing by the optional AI add-on, as described in section 5.

Account data, log data, and support and CRM records may be processed in the United States regardless of hosting election.

Who can access your data. Customer Data is accessible only to authorized personnel based in the United States. Our Chihuahua office does not have access to Customer Data.

For transfers of personal information out of the EEA, UK, or Switzerland, we rely on:

• the European Commission’s Standard Contractual Clauses (Decision 2021/914), with the UK Addendum where applicable.

We are not currently certified under the EU–US Data Privacy Framework.

We carry out transfer impact assessments and apply supplementary technical measures including encryption in transit and at rest, access control, and a policy of challenging overbroad government requests. A copy of the clauses is available on request to privacy@kiuey.com.

9. Cookies and tracking

Our Websites use cookies and similar technologies. Our Application uses only strictly necessary cookies for authentication and session security.

We do not use advertising or cross-context behavioral tracking technologies on our Websites.

Managing cookies. Visitors in the EEA, UK, and other jurisdictions requiring consent are shown a cookie banner on first visit. Non-essential cookies are not set until you consent. You can change your choices at any time via the “Cookie settings” link in our website footer, or through your browser settings.

Global Privacy Control. We honor the GPC browser signal as a valid opt-out of sale and sharing for US state privacy law purposes.

Do Not Track. There is no common industry standard for DNT, and we do not respond to DNT headers. Use the GPC signal or our cookie settings instead.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• delete your information, subject to legal and contractual limits;
• restrict or object to certain processing, including direct marketing;
• receive a portable copy of information you provided to us, in a machine-readable format;
• withdraw consent at any time, without affecting processing already carried out;
• not be discriminated against for exercising your rights; and
• complain to your data protection authority.

Important: if your request concerns Customer Data, we must direct it to your employer, who controls that data. We will acknowledge your request and forward it without undue delay.

How to exercise your rights

Email privacy@kiuey.com with:

1. your name and a contact address;
2. the organization whose account you use;
3. what you are asking for.

Verification. We will verify your identity proportionately. For active users, the primary method is confirmation from your authenticated account or a verified email address. Do not email identity documents unless we specifically ask; if verification requires them, we will provide a secure upload link.

Timing. We acknowledge requests within 10 business days and respond within 30 days. Where the law allows and the request is complex, we may extend by a further 30 days and will tell you why. US state law requests are handled within 45 days, extendable by 45 days.

Cost. Free, unless a request is manifestly unfounded or excessive.

Authorized agents. You may use an authorized agent where state law permits; we will require proof of authorization.

11. Security

We maintain an information security program appropriate to the sensitivity of the data we hold, including:

• Independent assurance. We undergo an annual SOC 2 Type II audit and annual third-party penetration testing. Our current report, covering the most recent observation period, is available to Customers and qualified prospects under NDA on request to security@kiuey.com.
• Encryption. TLS 1.2 or higher in transit; AES-256 at rest.
• Credentials. Passwords are stored as salted, one-way bcrypt hashes, are never accessible to our personnel, and are never exported. We support SAML single sign-on, and multi-factor authentication is available to Customers on request.
• Access control. Least-privilege access, granted only where required for a role, reviewed periodically, and logged.
• Personnel. Background-checked where lawful, bound by confidentiality, and trained on security and privacy.
• Segregation. Customer environments are logically separated.

No system is perfectly secure, and we cannot guarantee absolute security. If you discover a vulnerability or believe you can access data you should not, contact security@kiuey.com immediately.

Security incidents

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to personal information, we will:

• notify the affected Customer without undue delay and in any event within 72 hours of becoming aware;
• provide the information the Customer needs to meet its own notification obligations;
• notify affected individuals directly where required by law or where the Customer asks us to;
• take containment and remediation steps, and provide a written incident report; and
• where necessary, suspend all or part of the Service while we contain the incident, informing affected Customers.

12. Children

The Service is for business use by persons 18 or over. It is not directed at, marketed to, or intended for minors, and we do not knowingly collect information from anyone under 18. If you believe a minor has provided us with personal information, contact privacy@kiuey.com and we will delete it.

13. Regional disclosures

13.1 European Economic Area and United Kingdom

• Controller: PPAP Mgr, Corp., 651 N. Broad Street, Suite 206, Middletown, DE 19709, USA, for the data described in section 2.2.
• Privacy contact: our privacy team, at privacy@kiuey.com. We have not appointed a Data Protection Officer, as we do not meet the criteria in Article 37.
• Supervisory authority: you may complain to the authority in your country of residence, work, or where you believe an infringement occurred.
• Legal bases: see section 4. Transfers: see section 8.

13.2 California and other US states

PPAP Mgr, Corp. does not currently meet the applicability thresholds of the California Consumer Privacy Act or of comparable laws in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or Delaware. We nonetheless extend the following rights and disclosures voluntarily to residents of those states, and to business contacts in states whose laws would otherwise cover only consumers acting in a personal capacity. We will review this position if our circumstances change.

Categories of personal information collected in the last 12 months:

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not knowingly collect the personal information of anyone under 16.

Your rights include knowing, accessing, correcting, deleting, portability, opting out of sale or sharing, limiting use of sensitive information (not applicable — we collect none), appealing a refusal, and freedom from discrimination. Exercise them per section 10.

Appeals. If we decline a request, you may appeal by replying to our decision. We will respond in writing within 45 days with our reasoning. If we deny the appeal, you may contact your state attorney general.

Retention: see section 7.

14. Changes to this policy

We may update this policy. If changes are material, we will notify Customers and users at least 30 days before they take effect, by email or by notice within the Application, except where a change must take effect sooner for legal reasons.

Previous versions. The prior version of this policy, dated August 6, 2020, remains available at https://kiuey.com/privacy-policy-2020/, so that Customers can see the commitments in force at any given time.

Change log

15. Contact

Kiuey — PPAP Mgr, Corp. Privacy: privacy@kiuey.com Security: security@kiuey.com Support: support@ppapmanager.com · help.ppapmanager.com

Detroit HQ: Newlab, 2050 15th St., Detroit, MI 48216, USA · +1 313 484 0195 Mexico: Washington 3701-18B, Chihuahua, Ch. 31200, Mexico · +52 614 389 83 02 Registered: 651 N. Broad Street, Suite 206, Middletown, DE 19709, USA