Privacy statement

This statement explains what personal data we keep about you when you visit kvyk.ai, ask to hear about its launch, or sign in and use it, why we keep it, for how long, and what your rights are.

Who is responsible

Equites Digital BV, Sint-Niklaasstraat 24, 3321 Outgaarden, Belgium, enterprise number 1014.475.389, register of legal entities (RPR) Leuven, VAT BE 1014.475.389, provides kvyk.ai and is the controller of the data in this statement. For any question about your data, write to privacy@kvyk.eu. We have not appointed a data protection officer.

What this statement does not cover

Organisations use kvyk.ai to keep their own records, such as their customers, employees and working hours, and to run apps for their own customers. For that data, the organisation is the controller and we only process it on its behalf, under the data processing agreement in our terms. If an organisation keeps data about you, or you sign in to an organisation’s app, its own privacy statement applies: ask that organisation.

What we keep, and why

Visiting this website

When you visit kvyk.ai, its documentation included, we count the visit, to learn how many people come, which pages they read and how they found us. For each page we keep its address (without anything after a ? or #), its title, the website that linked to it, the kind of browser, operating system and device, and the country, region and city your internet address points to. We do not keep your internet address: from it and your browser’s description we make a code that changes every day, so we can tell visits apart within a day but cannot follow you from one day to the next. We also count a few steps: sending the form to hear about the launch, clicking Sign in or Get started, and switching the language. For these we keep the step and, where it applies, the language, never what you typed. We use no cookies for this and keep nothing in your browser. If your browser asks websites not to track you, your visit is not counted.

The counting runs on our own servers in the European Union, with Umami, open-source software; no other company receives it. The legal basis is our legitimate interest in knowing how our website is used, so we can improve it (GDPR article 6(1)(f)).

The launch email list

If you ask to be told when kvyk.ai launches, we keep your email address, the language and the site (kvyk.ai or kvyk.eu) you subscribed on, and when you subscribed and confirmed. We use it to tell you when kvyk.ai launches and to send you an occasional product update, and for nothing else.

The legal basis is your consent (GDPR article 6(1)(a)), which you give by confirming your address and can withdraw at any time.

Status page subscribers

If you subscribe on the status page, status.kvyk.ai, we keep your email address, your language, and when you subscribed and confirmed. We use it only to email you about incidents and planned maintenance, after you confirm your address from the email we send you.

The legal basis is your consent (GDPR article 6(1)(a)), which you give by confirming your address and can withdraw at any time.

Your account

When you sign in to kvyk.ai, we keep your name, your email address, your language and time zone, the organisations you belong to with your roles in each, and which versions of the acceptable use rules you accepted and when. When you accept the terms for an organisation as its Administrator, we also keep that you did, which version and when. We use them to let you sign in, to show you what your roles allow, to know that the rules and terms in force were accepted, and to send you the emails the service needs, such as sign-in codes, invitations and confirmations of a new address.

The legal basis is the contract (GDPR article 6(1)(b)): with you, or with the organisation you work for, which has a legitimate interest (article 6(1)(f)) in giving you access.

Sign-in and security records

We record when someone asks to sign in and signs in, and each organisation’s event log records who changed what, and when. Our servers also keep technical logs of the requests they answer. We use these to keep kvyk.ai and your organisation secure, to find and fix problems, and to show who did what.

The legal basis is our legitimate interest, and the organisations’, in a secure and accountable service (GDPR article 6(1)(f)).

Staying signed in to an app, and its messages

If you tick Keep me signed in on this device when you sign in to an organisation’s app, we keep a description of that device (its browser and system, such as “Safari on iPhone”), when it was signed in and when it was last used, so the app’s account page can list your devices and you can sign one out. If you let an app send messages to your phone, we keep the address your phone’s browser gave for them, and whether you turned the app’s messages off. For the data itself, the organisation is the controller, as described above.

A message goes from us to the push service of your phone’s browser, which delivers it: Apple’s for Safari, Google’s for Chrome and Mozilla’s for Firefox. The message is encrypted for your device, so the push service cannot read it; it sees only that a message goes to that address, and when. Your browser chose that service, under your agreement with its maker; it may be outside the European Economic Area.

Shared devices

If an organisation runs an app on a shared device, such as a tablet by the door, and you identify on it with your name and a PIN, we keep your PIN for that organisation, only as a one-way hash that nobody can read back, and how many wrong PINs were typed in a row on each device, to lock it after too many. What you do through the device is recorded in the organisation’s event log as you, with the device’s name. We use these to let you identify quickly and to keep someone else from acting as you. The legal basis is the contract (GDPR article 6(1)(b)), and the organisation’s legitimate interest in knowing who did what (article 6(1)(f)).

The assistant

What you write to the assistant, and its answers, are kept in your conversations, which only you see. The AI model behind the assistant is run by Mistral AI in the European Union. Conversations are never used to train a model, by us or by Mistral. A conversation is deleted when you delete it, when your membership or the organisation ends, and after 90 days without activity.

Talking to the assistant before you sign in

On the home page you can talk to the assistant before you have an account, to describe your business and see the data model it proposes. We keep what you write, its answers, the model it proposed and the language of the page, and run the conversation through the same AI model at Mistral AI in the European Union, never to train a model. If you give the assistant your email address, it is used only to fill in the sign-in page; we send nothing to it until you ask for a sign-in code there. To keep the conversation to the people who started it and to limit misuse, we count how many conversations and messages come from your internet address in a day, keeping only a code made from it with a secret key, never the address itself.

When you sign in and create your organisation, the conversation becomes one of your conversations there, as described above, and is deleted from the home page’s. A conversation you do not take with you is deleted 24 hours after its last message. The legal basis is the steps you ask us to take before an agreement (GDPR article 6(1)(b)), and our legitimate interest in preventing misuse (GDPR article 6(1)(f)).

How you use kvyk.ai

To learn where people get stuck and what to improve, we note what you do in kvyk.ai: for example that you added a field, published, that an app build failed at a step, or that the assistant could not finish. For each we keep what kind of step it was, codes such as why something was refused, counts and how long it took, the organisation and when. Never what you write, ask or name, and never the organisation’s records. In place of your account we keep a code made from it with a secret key, so these notes do not name you. We count how much each app is opened per day, but not who opened it.

This is on by default. You can switch it off at any time on your account page, under Use my activity to improve kvyk.ai: we then stop, and delete what we noted under your code. The legal basis is our legitimate interest in improving kvyk.ai (GDPR article 6(1)(f)), and you can object to it as described under your rights.

When your account is deleted

When your account is deleted, so are your name, your email address, your sessions, your conversations with the assistant and what it noted for you, and what we noted of how you use kvyk.ai. What you did in an organisation stays in its records, as the organisation needs to know what happened to its data and apps: the records you added, changed or own, the app versions you built or published, its event log and its use of the assistant. There, you are named only “Deleted account”, the same for everyone whose account was deleted, in place of your name, your email address and your account.

Two things keep your name, because removing it would break the organisation’s record:

• The history of an app’s code, where each change made through the assistant names who asked for it. Each version of an app points to that history, so rewriting it would lose the versions the organisation published.
• An invitation an organisation sent to your address, until it is accepted, withdrawn or expires.

The legal basis is the organisations’ legitimate interest in an accountable record of their own data and apps (GDPR article 6(1)(f)). What an organisation keeps about you in its own records, for example as its customer, is the organisation’s data, under its own privacy statement.

Paying for Pro

When an organisation pays for its Pro plan, we keep what we need to bill it: who to invoice, the invoice address and VAT number, the email address invoices go to, and its payments and invoices. The person who pays enters their card or bank details on the page of Mollie B.V., the Netherlands, our payment provider, never in kvyk.ai; Mollie tells us whether and when each payment was made. We use this to take the payments, to send invoices and to keep the books.

The legal basis is the contract with the organisation (GDPR article 6(1)(b)), and our legal obligation to keep invoices and accounts (GDPR article 6(1)(c)).

When you write to us

If you email us, we keep your message and our answer, to help you and follow up. The legal basis is our legitimate interest in answering you (GDPR article 6(1)(f)).

How long we keep it

• Visits to this website: 13 months, then deleted.
• The launch email list: until you unsubscribe. Every email has a link that deletes your address at once. If you never confirm your address, it is deleted after 7 days.
• Status page subscribers: until you unsubscribe. Every email has a link that deletes your address at once. If you never confirm your address, it is deleted after 7 days.
• Your account: as long as you use kvyk.ai. When you no longer belong to any organisation, because you left it or it ended, your account is deleted 30 days later. If you delete your account yourself, it is deleted at once.
• Sign-in records (your sessions and sign-in requests): 12 months after they end.
• Devices you stay signed in on: until you sign the device out, 30 days after you last used it, or 90 days after you signed in, whichever comes first. Phone message addresses: until you turn the messages off or your browser drops the address.
• Your PIN for shared devices: until you change it, an Administrator resets it, or your membership of the organisation ends. The count of wrong PINs is cleared once a PIN is right or the lock ends.
• An organisation’s event log: as long as the organisation exists. It is deleted with the organisation.
• An organisation’s use of the assistant (per answer: who asked, the models, the number of calls, tokens and cost): as long as the organisation exists. Which tools the assistant used for an answer, how long it worked and whether the app’s checks passed: 90 days. Never what was said.
• How you use kvyk.ai: 13 months, then only daily counts, which name no one. It is deleted at once when you switch it off, and with your account or the organisation.
• Invoices for an organisation’s plan, with the business details on them: as long as Belgian law requires invoices to be kept, today ten years, also after the organisation is deleted.
• Technical logs: 7 days.
• Assistant conversations: as described above. A conversation started on the home page before signing in: 24 hours after its last message, unless you take it with you. The counts per internet address: 1 day.
• Emails you send us: as long as needed to help you and follow up.

Who processes it for us

We do not sell your data and we do not share it for advertising. Two providers process it for us, both under a data processing agreement and both in the European Union:

• Scaleway SAS, France: hosting, databases, file storage, email delivery and logs, in data centres in France and the Netherlands.
• Mistral AI SAS, France: the AI model behind the assistant.

We do not transfer your data outside the European Economic Area. The one exception is a web search the assistant makes: only the search query, which holds general terms and no personal data, goes to Mistral’s global service. A phone message passes, encrypted, through your browser’s push service, as described above.

When an organisation takes payments in its apps, it connects its own Mollie account. The person paying enters their payment details on the page of Mollie B.V., the Netherlands, never in kvyk.ai. We send Mollie only what the payment needs: its amount, currency and description, and the address to return to. What Mollie tells us back, such as whether it was paid, is kept in the organisation’s records. Mollie is the organisation’s own payment provider, chosen by it under its own agreement with Mollie, and processes the payment under Mollie’s privacy statement.

When an organisation pays kvyk.ai for its plan, its Administrator pays on the page of Mollie B.V., the Netherlands, our own payment provider, never in kvyk.ai. We send Mollie the company’s name and each month’s amount, and Mollie tells us whether it was paid. We check the company’s VAT number with the European Commission’s VAT check (VIES). Mollie takes the payment as an independent controller, under its own privacy statement and its duties as a licensed payment institution, not as a provider that processes data for us.

We give data to authorities only when the law requires us to.

Cookies

kvyk.ai uses only the cookies it needs to work, and counts visits without cookies. The cookie policy lists them.

Your rights

You can ask to see the data we keep about you, to correct it, to delete it, to limit what we do with it, or to receive it in a format you can take elsewhere. You can object to what we do on the basis of a legitimate interest, and withdraw your consent at any time. Write to privacy@kvyk.eu; we answer within a month.

You also have the right to lodge a complaint with a data protection authority. We are based in Belgium, so our lead authority is the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels (www.dataprotectionauthority.be). You may also contact the authority in your own country.

We do not make decisions about you based solely on automated processing.

Changes

When we change this statement, we update it here and change the date at the top. If a change matters to how we use your data, we tell you by email.