Privacy Policy

Who Is Responsible

Controllers (joint responsibility where applicable):

For privacy-related requests, you may contact either address above.

Scope

This policy applies to visitors of our marketing pages, users of authenticated areas (including design-partner and demo access), and anyone who contacts us by email. It does not cover third-party websites or services you access through links or integrations (such as Microsoft 365); those are governed by the respective provider's policies.

Categories of Data We Process

Account and authentication data
Username, role, session identifiers, and credentials you use to sign in. We issue an httpOnly session cookie (kitechain_session) to keep you logged in.

Content you provide in the Service
Business process descriptions, chat messages, project names, canvas designs, checklists, debug notes, and related metadata needed to operate kitechain. This may include personal data if you or your organisation enter it into the Service.

Usage and operations data
API usage metrics (e.g. token counts, estimated cost, session and user identifiers), feature interactions, and technical logs required to run and secure the platform.

Demo and marketing interaction data
When you use demo features or certain calls-to-action on the landing page, we may record event names and technical metadata (such as IP address, browser user agent, and referrer) in our analytics store.

Communication data
Information you send us by email (e.g. design-partner enquiries).

Hosting and security logs
Our hosting provider may process IP addresses, timestamps, request URLs, and device/browser information in server logs for delivery and abuse prevention.

Purposes and Legal Bases

We process personal data for the following purposes, relying on the legal bases indicated under the EU General Data Protection Regulation (GDPR) where applicable:

Providing the Service (Art. 6(1)(b) GDPR — contract / pre-contractual steps): authentication, saving projects, generating designs, exports, and support during pilots.

Operating and securing the platform (Art. 6(1)(f) GDPR — legitimate interests): error diagnosis, abuse prevention, usage monitoring, and infrastructure reliability, balanced against your rights.

Improving the Service (Art. 6(1)(f) GDPR): understanding how features are used in aggregate, including demo funnels, where not overridden by your preferences or law.

Communication (Art. 6(1)(b) or (f) GDPR): responding to enquiries and managing design-partner relationships.

Where we rely on consent (e.g. for optional communications in the future), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

AI Processing

kitechain uses large language models and related services (such as Anthropic and OpenAI) to analyse your inputs and generate outputs. Your prompts and relevant project context may be transmitted to these providers for processing. Outputs are generated automatically and may be inaccurate; you should review them before use in production environments. Do not submit special categories of personal data (e.g. health, biometric, or trade-union data) unless your organisation has a lawful basis and appropriate safeguards.

Cookies

Strictly necessary cookies
kitechain_session — maintains your login session (httpOnly, typically 30 days).

Functional cookies
kc_mode — may be set for demo accounts to indicate demo mode in the UI.

We do not use third-party advertising cookies on the Service. If we introduce non-essential cookies or similar technologies later, we will update this policy and, where required, obtain consent before activation.

Recipients and Processors

We use trusted service providers who process data on our instructions, including:

hosting (e.g. Vercel), database and storage (e.g. Supabase), AI model providers (e.g. OpenAI, Anthropic), and email/communication tools. We only share data necessary for the stated purpose and require appropriate contractual safeguards where applicable (including data processing agreements under Art. 28 GDPR for enterprise customers when offered).

References to integrations (Microsoft Power Platform, Azure, GitHub, etc.) mean that your organisation's use of those products is separate from our processing; we do not control their environments.

International Transfers

Some processors are located outside the European Economic Area (notably in the United States). Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and supplementary measures described by those providers. You may request more information about transfers relevant to your use of the Service by contacting us.

Retention

We retain personal data only as long as needed for the purposes above, unless a longer period is required by law. Project and account data are generally kept while your account is active and for a reasonable period afterward to allow recovery or resolve disputes. Usage logs and demo events may be retained in aggregated or pseudonymised form for operations and analytics. You may request deletion subject to legal exceptions.

Your Rights

If GDPR applies to you, you may have the right to access, rectify, erase, restrict, or port your personal data, and to object to certain processing based on legitimate interests. You may also lodge a complaint with a supervisory authority. In Germany, you can contact the authority responsible for your place of residence or work; details are available at bfdi.bund.de.

To exercise your rights, email us at anna.papanakli@gmail.com or simonrichert7@gmail.com. We may need to verify your identity before responding.

Security

We implement technical and organisational measures appropriate to the risk, including encrypted transport (HTTPS), access controls, and least-privilege access to production systems. No method of transmission or storage is completely secure; you are responsible for safeguarding your account credentials.

Children

The Service is directed at business users and is not intended for children under 16. We do not knowingly collect personal data from children.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date above indicates the current version. Material changes will be communicated where appropriate (e.g. by email to active users or a notice in the Service).