Legal
Privacy Policy
Last updated: 23 October 2026
This policy explains which personal data we use when you use Kaivo, why, how long we keep it, and how to exercise your rights. We do not sell your data, we do not show ads, and we do not use advertising or tracking cookies.
1. Data controller
Klizeny Studio, to be completed. Contact for anything about your data: kaivo-support@kaivoia.site.
2. What we use, why, and for how long
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Create and run your account, sign you in | E-mail, name, profile picture, sign-in provider identifier | Contract (Art. 6(1)(b) GDPR) | While your account is open, then deleted within 30 days of closure |
| Provide the Service: chat, Create with Byte, previews, publishing, Kaivo CLI | Your messages, project files, uploaded images and logos, published websites | Contract | Until you delete them or close your account; published sites until you unpublish them |
| Plans and payments | Plan, PayPal subscription and order identifiers, amounts, dates (never your card number) | Contract; legal obligation (Art. 6(1)(c)) for accounting | 10 years for accounting records (Art. L123-22 French Commercial Code) |
| Usage limits, security, fraud and abuse prevention, moderation of published content | Request logs (time, model, size, errors), IP address, browser, reports received | Legitimate interest in keeping the Service safe (Art. 6(1)(f)); legal obligations (DSA) | Up to 12 months, longer only if needed for a dispute |
| GitHub publishing (only if you connect GitHub) | GitHub username and access token | Contract | Until you disconnect GitHub or close your account |
| Support and messages you send us | Your e-mails, feedback sent from Kaivo CLI | Contract; legitimate interest | 3 years after our last exchange |
| Page view count of your published sites | A counter only: no identity of the visitors | Legitimate interest | As long as the site is published |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not send marketing e-mails without your consent.
3. Artificial intelligence and your requests
To answer you, your messages and the files of the project you are working on are sent to an AI model provider (see the list below). The provider processes them to generate the answer. We do not train AI models on your content.
Depending on the model, the provider may keep requests for a limited time to prevent abuse, and some providers of free models may use requests to improve their models. Please don't put sensitive personal data (health, passwords, bank details, data about other people) in your requests.
4. Who receives your data
Only our team members who need it, and the service providers below, who act on our instructions (processors) under a data processing agreement. We may also disclose data to authorities when the law requires it.
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Website hosting, file storage (Blob) | USA / EU |
| Supabase Inc. | Database and sign-in | USA / EU |
| Groq Inc. | AI model inference | USA |
| OpenRouter Inc. | AI model routing | USA |
| Google LLC (Gemini API, Google sign-in) | AI model inference, optional sign-in | USA |
| Mistral AI | AI model inference | France / EU |
| NVIDIA Corporation | AI model inference | USA |
| Pollinations.ai | Image generation | EU / USA |
| LangSearch, DuckDuckGo | Web search when you ask for it | Varies |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payments and subscriptions | Luxembourg / EU |
| GitHub Inc., Discord Inc. | Optional sign-in and GitHub publishing | USA |
5. Transfers outside the European Union
Some providers are in the United States or other countries outside the EU. These transfers are protected by the EU-U.S. Data Privacy Framework when the provider is certified, or otherwise by the European Commission's Standard Contractual Clauses (Art. 46 GDPR). You can ask us for a copy of these safeguards.
6. Your rights
Under the GDPR you can:
- access your data and get a copy;
- correct inaccurate data;
- have your data deleted, and close your account;
- restrict or object to some processing, in particular processing based on our legitimate interest;
- receive the data you gave us in a reusable format (portability): your projects can also be downloaded as a ZIP at any time;
- withdraw your consent at any time when processing is based on it;
- in France, give instructions about what happens to your data after your death.
Write to kaivo-support@kaivoia.site from the e-mail address of your account. We answer within one month (extendable by two months for complex requests, in which case we tell you).
You can also lodge a complaint with a supervisory authority, for example the CNIL in France: cnil.fr.
7. Security
Connections are encrypted (HTTPS), passwords are handled by our sign-in provider and never stored in clear, access to data is limited to what each person needs, and secret files (such as .env) are removed before a site is published.
8. Children
Kaivo is for people aged 15 and over. If you think a child under 15 has given us personal data, write to us and we will delete it.
9. Visitors of websites published with Kaivo
The person who published a website is responsible for the data that website collects. Kaivo hosts it and only keeps a page view counter, without identifying visitors. Our hosting provider keeps technical logs (such as IP addresses) for a short time for security.
10. Cookies
We only use cookies that are necessary for the Service. Details are in the Cookie Policy.
11. Changes
If we change this policy in an important way, we will tell you by e-mail or in the Service before the change applies.