Privacy Policy

Effective date: [effective date] · Last updated: October 6, 2026

This Privacy Policy explains how Clevers LLC ("we", "us") collects, uses and shares personal information when you use KPIK: our website (https://kpik.ai), web app (https://app.kpik.ai) and mobile apps (together, the "Service").

KPIK is a tool for teams. Work happens in a workspace, which belongs to the organization (or person) that created it. That organization decides who joins, what goes into the workspace and how long it's kept.

For workspace content, the organization is the controller and we process it on its behalf, as its processor (or "service provider" under US state laws). If you have a question about what's in a workspace, ask the organization that runs it. Organizations can ask us for a data processing agreement ("DPA") at privacy@kpik.ai.
For your KPIK account (your sign-in details, security records and how you use the Service), we are the controller.

1. Information we collect

Your account

Profile: your first and last name, display name, email address and/or mobile phone number, profile photo (if you add one), language and time zone.
Password: if you set one. We store only a one-way hash, never the password itself.
Verification: whether and when your email or phone was confirmed.
Agreements: which version of these Terms and this Privacy Policy you accepted, when, and from which IP address.

Signing in and security

One-time codes we send to your email or phone. We keep only a keyed hash of each code, never the code.
Sessions: each sign-in, how you signed in (code, password, Google, Microsoft, Apple or your organization's single sign-on), when it was created and last used, the IP address and browser or app (user agent).
Devices: for the mobile apps, the device model, operating system, app version and a random install identifier, plus a push notification token if you allow notifications.
Sign-in attempts: each password, code, authenticator code or recovery code tried, with the IP address and whether it worked. We use these to slow down guessing.
Two-factor authentication: if you turn it on, your authenticator secret (encrypted) and hashed recovery codes.
Linked sign-in accounts: if you use Google, Microsoft or Apple, a unique identifier for that account and the email address it shares. For Apple, a token we use to disconnect KPIK from your Apple account when you delete your account (stored encrypted).
Delivery log: a record of each code and security notice we send (the channel, the kind of message and the destination, encrypted).
Security and audit records: a log of important actions (for example signing in again to confirm it's you, changing your email, an admin changing your role). These store who did what and when, and the IP address. They don't store the content involved.

Workspaces

Membership: the workspaces you belong to, your role (for example owner, admin, member or guest), who invited you and when you joined or left.
Workspace details: the workspace's name, logo, time zone, plan and number of seats, email domains and their verification, sign-in rules (such as required single sign-on or two-factor authentication) and single sign-on settings.
Invitations and join requests: the email address an invitation was sent to, who sent it, the role offered and its expiry; requests to join a workspace and whether they were approved.
Workspace content: what you and your team put into the Service, such as customer requests, ideas, projects, tasks, meetings, messages, comments and files, as those features become available.

Notifications and inbox

The notifications we show in your inbox and send by push or email (for example an invitation, a join request or a security alert), whether you've read or archived them, and your notification preferences.

AI features

Prompts and outputs: the text you or your workspace send to an AI feature and the result. We pass these to the AI provider to produce the result. Unless a feature tells you otherwise, we don't store prompts or outputs.
Usage: for each AI request, the workspace, the person, the feature, the provider and model, the number of tokens, the cost and whether it succeeded. These records never contain the prompt or output text.

Support

What you send us when you contact support, and our replies.

Collected automatically

Logs: IP address, browser or app, the requests made to our servers and error reports, used to run and secure the Service.
Cookies and browser storage: the web app uses only what's strictly necessary to sign you in and complete the step you're on. See our Cookie Policy.

We don't collect precise location, contacts, photos (other than a profile photo or workspace logo you upload), health or financial information, and we don't use advertising identifiers.

2. Where information comes from

You: when you sign up, fill in your profile, use the Service or contact us.
Your organization: an admin may invite you (giving us your email address), approve or decline your request to join, change your role, or remove you. If your organization has verified its email domain, signing up with an address on that domain lets you join or ask to join its workspace.
Your organization's identity provider: if your organization uses single sign-on (SAML or OpenID Connect, for example Okta, Microsoft Entra ID or Google Workspace), the provider sends us your email address, name and a unique identifier, and may create your account automatically when you first sign in.
Google, Microsoft and Apple: if you choose to sign in with one of them, it shares your name (Apple only the first time), email address, whether the email is verified, and a unique account identifier. We never receive your password for those services. With Apple you can hide your email address; we then receive an Apple relay address.
Other members: other people in your workspace may mention you or add content about you.

3. How we use information and our legal bases

Where the GDPR or UK GDPR applies, we rely on the legal bases below.

What we do	Legal basis
Create your account, sign you in (including sending one-time codes by email or text message) and keep you signed in	Contract with you
Provide the Service: show workspaces and their content, place you in the right workspace, apply your organization's sign-in rules, send notifications you've chosen	Contract with you; for workspace content, your organization's instructions
Run the AI features you or your workspace use	Contract; your organization's instructions
Keep accounts safe: rate limits, cooldowns after failed attempts, new sign-in alerts, two-factor authentication, audit records, investigating abuse	Legitimate interests (keeping the Service and its users secure); legal obligation where it applies
Send service and security messages (for example "your email was changed" or "new sign-in to your account")	Contract; legitimate interests
Enforce plan limits and AI budgets, and later bill for paid plans	Contract; legitimate interests
Provide support	Contract; legitimate interests
Record which version of our Terms and Privacy Policy you accepted	Legal obligation; legitimate interests (proving what was agreed)
Understand and improve the Service, using aggregated or de-identified information where we can	Legitimate interests
Send product news, where we do	Consent where the law requires it; you can unsubscribe at any time
Meet legal obligations and respond to lawful requests	Legal obligation

We don't use your information for advertising, we don't sell it, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. What workspace owners and admins can see and do

If you're in a workspace run by an organization, its owners and admins (and anyone their roles allow) can:

see the workspace's members and guests, including your name, email address or phone number, photo, role and when you joined;
invite people, approve or decline join requests, change roles, turn members into guests and back, suspend or remove people, and transfer ownership;
verify the organization's email domains, so people who sign up with those addresses can join or ask to join;
set sign-in rules, such as requiring single sign-on through the organization's identity provider or requiring two-factor authentication;
see the workspace's plan, usage and AI usage, including AI usage per person;
see, change, export or delete the workspace's content, and delete the workspace.

If your account is managed through your organization's single sign-on, the organization controls how you sign in, and you may not be able to change your email address in KPIK. Guests see only what's shared with them.

Leaving or being removed from a workspace ends your access to it. What you added stays with the workspace, because it belongs to the organization. If you have questions about how an organization uses your information, contact that organization.

5. AI features

Some features use AI models from third-party providers: Anthropic (Claude), OpenAI and Google (Gemini). When you use one, we send the relevant content (your prompt and the workspace content the feature needs) to the provider to produce the result.

We use these providers through their paid business APIs, under terms that don't let them train their models on what we send. In production we never use free or consumer tiers that may train on data.
We don't use your prompts, outputs or workspace content to train AI models, and we don't let our providers do so.
The providers may keep API inputs and outputs for a limited time to detect abuse, as set out in their API terms and data processing terms. See our subprocessors for who they are and where they process data.
We record usage (which model, how many tokens, the cost), not the text, so we can enforce your workspace's limits and show usage reports.
AI output can be wrong. Review it before you rely on it.

6. How we share information

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

We share it only:

Within your workspace: other members can see your name, photo and the content you share. Admins can see more, as section 4 describes.
With our subprocessors: companies that process information for us under contract and only on our instructions, for example cloud hosting and storage (Google Cloud), push notifications (Firebase Cloud Messaging), email (Mailgun), text messages (Twilio) and AI providers (Anthropic, OpenAI, Google). The full list, with what each does and where, is on our subprocessors page.
With sign-in providers you choose: when you sign in with Google, Microsoft or Apple, or your organization's identity provider, and, when you delete your account, Apple, so it can disconnect KPIK from your Apple account.
When the law requires it, or to protect the rights, safety and security of our users, the public or us.
In a business transfer, such as a merger or acquisition, where this policy keeps applying to your information.

7. Push notifications, email and text messages

Push notifications on the mobile apps are sent through Google Firebase Cloud Messaging (which uses Apple's push service for iPhones), if you allow them. They carry only a short title and a link into the app. Security alerts never include private details. You can turn notifications off in the app or in your device settings.
Email (codes, invitations, security notices and notifications) is sent through Mailgun. Where notification settings are available, you can choose which notifications reach you by email. Security messages can't be turned off.
Text messages (sign-in codes and, if you use only a phone number, security notices) are sent through Twilio. Reply STOP to opt out of texts; you can then sign in by email or password if you have them.

8. Where information is stored and international transfers

The Service is hosted on Google Cloud in the United States (Google Cloud us-central1, Iowa; files in Google Cloud's US multi-region). Our subprocessors may process information in other countries, as listed on the subprocessors page.

If you're in the European Economic Area, the United Kingdom or Switzerland, your information is transferred to the United States. We protect these transfers with the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and equivalent safeguards, together with the security measures in section 10. [TO CONFIRM: whether Clevers LLC self-certifies under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions); if so, say so here, otherwise remove] You can ask us for a copy of the safeguards at privacy@kpik.ai.

9. How long we keep information

We keep personal information only as long as we need it. In particular:

Information	How long
Your account and profile	While your account exists
One-time codes	Deleted 7 days after they're used or expire (each code works for only 10 minutes)
Sign-in attempts	90 days
Log of codes and security notices sent	90 days
Sessions and devices	Until you sign out, the session is revoked or expires, or you delete your account. [TO CONFIRM: how long ended or revoked session records are kept]
Notifications	Archived after 90 days, deleted after 180 days
Invitations	Expire after 7 days. [TO CONFIRM: how long expired, declined or revoked invitations are kept]
Records of the Terms and Privacy Policy you accepted	For as long as we need to show what was agreed; the IP address is erased after you delete your account
Security and audit records	[TO CONFIRM: audit record retention period]; after you delete your account they keep only your user ID, not your name, email, phone or IP address
AI usage records	[TO CONFIRM: AI usage record retention period]; they never contain prompt or output text, and after account deletion only your user ID remains
Workspace content	For as long as the organization keeps it, or until it's deleted
Support messages	[TO CONFIRM: support message retention period]
Server logs	[TO CONFIRM: server and load balancer log retention period]
Backups	Database backups are kept for about 14 days, so deleted information may remain in a backup until it's overwritten. We don't restore deleted personal information from backups except to recover from an incident

When you delete your account

You can delete your account in the app (Settings → Delete account). Deletion is final: there's no way to restore the account.

At once: you're signed out everywhere; your email address and phone number are removed from the account (and can be used to sign up again); your devices, push tokens, profile photo, two-factor secret and recovery codes, and notifications are deleted; links to Google, Microsoft and Apple are removed, and we ask Apple to revoke our access.
Within 30 days: the rest of your personal information is erased: your name (shown as "Deleted user"), language and time zone, password and code data, session records, sign-in attempts and the delivery log, and the IP address on your audit and consent records.
What stays: a record with your user ID only (no name, email, phone or IP address), so that security and audit records, consent records and AI usage totals still add up. Content you added to an organization's workspace stays with that workspace, shown as "Deleted user".
If you're the only owner of a workspace that other people are still in, you'll need to transfer ownership or delete that workspace first. A workspace nobody else is in is closed with your account.

We may keep information longer where the law requires it, or to resolve a dispute or investigate abuse.

10. Security

We protect information with measures that include:

encryption in transit (HTTPS with HSTS) and encryption at rest by Google Cloud, plus extra encryption of email addresses, phone numbers, authenticator secrets and similar fields;
hashed passwords, and hashes for one-time codes, recovery codes, invitation links and sign-in tokens;
rate limits and cooldowns on sign-in, sign-in alerts for new devices, two-factor authentication, and confirming it's you again before sensitive actions such as deleting your account;
sessions you can see and sign out of at any time, and that end at once when revoked;
a private network for our database, access limited to staff who need it, and audit records of sensitive actions;
single sign-on that checks signatures, audiences and replays strictly.

No system is perfectly secure. If we learn of a breach that affects your information, we'll notify you and the authorities as the law requires.

11. Your rights and choices

In the Service:

See and correct your profile, email and phone in Settings.
See your sessions and devices and sign any of them out.
Choose notifications in Settings (where available), or turn push notifications off on your device.
Delete your account in Settings → Delete account (see section 9).

By email: for anything else, including a copy of your information in a portable format (export), write to privacy@kpik.ai from the email address on your account. If you can't sign in, or don't have the app, you can also ask us to delete your account this way.

Depending on where you live, you may have the right to access, correct, delete or export your personal information; to object to or restrict how we use it; to withdraw consent at any time (this doesn't affect what we did before); and to complain to your data protection authority. In the EEA and UK you can find yours on the EDPB or ICO website.

We'll answer within the time the law sets (usually one month, or 45 days in California) and may need to confirm your identity first. We won't discriminate against you for using your rights. For content in a workspace run by an organization, we'll usually pass your request to that organization, because it decides what happens to it.

12. California and other US states

This section applies to residents of California and other US states with similar privacy laws.

What we collect: identifiers (name, email, phone, IP address, account and device IDs); customer records (account details); commercial information (your plan and, later, purchases); internet activity (sessions, sign-in attempts, usage of the Service); audio, electronic or visual information (a profile photo you upload); professional information (your workspace, role and work email); and the content you add. Sensitive information we collect is limited to your sign-in credentials (password hash, codes and two-factor secrets), which we use only to sign you in and keep your account secure.
Sources, purposes and retention: as described in sections 2, 3 and 9.
Disclosures: we disclose these categories for business purposes to the subprocessors in section 6, to your workspace's members and admins, and to sign-in providers you choose.
No selling or sharing: we don't sell personal information or share it for cross-context behavioral advertising, and haven't in the past 12 months. We don't knowingly sell or share the information of anyone under 16.
Your rights: to know and access, correct and delete your information, and not to be discriminated against for using these rights. Because we don't sell or share personal information, or use sensitive information beyond what's needed to provide the Service, there is nothing to opt out of or limit. To use your rights, email privacy@kpik.ai. An authorized agent can act for you if you confirm you've authorized them.

13. Children

The Service is for people aged 16 and over, and we don't knowingly collect personal information from children under 16. If you believe a child has given us information, contact privacy@kpik.ai and we'll delete it.

14. Changes to this policy

We'll post changes on this page and update the date at the top. If a change is material, we'll tell you in the Service or by email before it takes effect, and, where the law requires, ask you to accept the new version. Each version has a number, and we record which version you accepted when you signed up or accepted an update.

15. Contact

Clevers LLC, [company postal address]

Privacy questions and requests: privacy@kpik.ai
Data protection officer: [name or role of the data protection officer, or "not appointed"; reachable at privacy@kpik.ai]
EU representative: [EU representative under GDPR Article 27, if required]
UK representative: [UK representative under UK GDPR Article 27, if required]
Everything else: support@kpik.ai