Privacy Policy

1. Data Controller

Kavana is the data controller for the personal data processed in connection with the Services. If you have any questions about this policy or about your data, contact us at privacy@kavana.pro.

2. Information We Collect

We collect the following categories of personal data:

• Account information: your name, email address, phone number, and a hashed password when you register.
• Profile and usage data: display name, workspace and tenant identifiers, chatbots, knowledge sources, conversation history, and messages.
• Payment information: wallet balances and transaction records. Payments are processed by our payment providers; we do not store full card numbers.
• Technical data: IP address, browser type, device information, and log data collected automatically when you use the Services.

3. How We Use Your Information

We use your personal data to provide, operate, and maintain the Services; authenticate you and protect your account; process payments and manage your wallet; improve and secure the Services, including monitoring for abuse and fraud; communicate with you about service updates and respond to support requests; and comply with legal obligations.

4. Legal Basis for Processing

Under the GDPR we process personal data on the following legal bases: performance of a contract (Article 6(1)(b)) to provide the Services you request; legitimate interests (Article 6(1)(f)) to secure and improve the Services; consent (Article 6(1)(a)) where we ask for it, such as for certain cookies; and compliance with legal obligations (Article 6(1)(c)).

5. Data Sharing and Processors

We share personal data only with processors who help us operate the Services — such as cloud infrastructure providers, AI model providers, and payment processors — under data processing agreements that require them to protect your data. We do not sell your personal data. We may disclose data where required by law or to protect our rights and the safety of our users.

6. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy: account data while your account is active, conversation and knowledge data while you keep it, and billing records for as long as required by law. When you delete data or your account, we erase or anonymize it within a reasonable period, unless we must keep it for legal reasons.

7. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Access: obtain a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data (“right to be forgotten”).
• Restriction: limit how we process your data in certain circumstances.
• Data portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time.
• Complain: lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us at privacy@kavana.pro. We will respond within one month as required by the GDPR.

8. Cookies and Local Storage

We use cookies and similar technologies to keep you signed in, remember your preferences such as language and theme, and understand how the Services are used. You can control or delete cookies through your browser settings, but some features may not work correctly without them.

9. Data Security

We use appropriate technical and organizational measures — including encryption in transit, hashed passwords, and access controls — to protect your personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). When we transfer personal data internationally, we rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission.

11. Children’s Privacy

The Services are not directed to individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated “Last updated” date. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.

13. Contact Us

For any questions, requests, or complaints about this Privacy Policy or your personal data, contact us at privacy@kavana.pro.