Privacy Policy

Contact details for privacy matters

• Data Protection Officer (DPO): dpo@kividb.io
• General privacy queries: privacy@kividb.io
• Legal notices: legal@kividb.io
• Website: kividb.io

3.1 Account and Identity Data

• Full name
• Email address
• Username and password (stored in hashed form — we never store plaintext passwords)
• Company or organisation name (if applicable)
• Country of residence or billing address

3.2 Payment and Billing Data

• Payment card details (processed directly by our payment processors — we do not store raw card numbers)
• Billing address
• Transaction history and invoices
• Tax identification numbers where required by law (e.g. GST number, VAT number)

Payment data is processed by our third-party payment processors (such as Razorpay and/or Paddle). We receive only tokenised or summarised payment information. Please review the privacy policies of our payment processors for details of how they handle your payment data.

3.3 Usage and Telemetry Data

• Connection metadata — IP address, port, connection timestamps, and duration
• Command usage statistics — which KiviDB commands are used and how frequently (we do not log the content or values of your data stored in KiviDB)
• Performance metrics — query latency, memory usage, throughput
• Error logs — error types and frequencies (without personal data content)
• Feature usage — which platform features and dashboard sections you interact with
• Instance configuration — database size, replication settings, geographic region selected

3.4 Website and Analytics Data

• IP address and approximate geographic location (country/city level)
• Browser type, version, and operating system
• Pages visited, time spent, and navigation paths on our website
• Referring website or source
• Device type and screen resolution
• Cookie identifiers and session identifiers
• Marketing interaction data — email opens, link clicks, campaign responses

3.5 Communications Data

• Emails and messages you send to our support team
• Support ticket content and history
• Survey responses and feedback you choose to provide

3.6 API Keys, Integrations and AI Assistants

You can reach KiviDB through our API, our Terraform provider, and our Model Context Protocol (MCP) server, which lets an AI assistant such as Claude, ChatGPT or Gemini operate your databases on your behalf. All of them authenticate with an API key you create and can revoke at any time.

• API keys — we store a short, non-secret prefix so you can tell your keys apart, and a one-way cryptographic digest of the key itself. The key is shown to you once, at creation, and we cannot recover it afterwards.
• Key usage — the time a key was last used, so you can see which integration is active and spot one that should be revoked.
• Assistant connections — when you connect an assistant by signing in rather than with an API key, as ChatGPT and Claude do, we record the name the assistant registered under, the account and organization you approved it for, and when you approved it. The access and refresh tokens it receives are stored only as one-way digests. Every connection is listed under Settings → Connections, where you can disconnect it.
• What an assistant sends — when you use the MCP server, the requests it makes on your behalf carry your API key or the sign-in you approved, and whatever your assistant asked for: database names and identifiers, and, for data commands, the keys and values involved.

3.7 Data We Do Not Collect

We do not knowingly collect the following categories of sensitive personal data unless you voluntarily provide them in a support communication:

• Racial or ethnic origin
• Political opinions or religious beliefs
• Health or medical data
• Biometric data
• Data relating to children under 16 years of age

Our Services are not directed at children under 16. If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will delete it promptly.

4.1 Directly from you

• When you create an account or sign up for a free trial
• When you subscribe to a paid plan and provide payment details
• When you contact our support team
• When you respond to surveys or provide feedback
• When you download our software

4.2 Automatically

• Through cookies and similar tracking technologies on our website (see Section 8 for full cookie details)
• Through our platform's telemetry system when you use the cloud Services
• Through server logs when you connect to our APIs

4.3 From third parties

• From payment processors, for transaction confirmation and fraud prevention
• From analytics providers, for aggregated website usage insights
• From cloud infrastructure providers (AWS, GCP, Azure), for operational monitoring

5.1 To provide and operate the Services

• Creating and managing your account
• Provisioning and operating your KiviDB instances
• Processing payments and issuing invoices
• Providing technical support

Legal basis: Performance of contract (GDPR Art. 6(1)(b)); contractual necessity (DPDP Act 2023).

5.2 To improve our Services

• Analysing usage patterns and telemetry to identify performance bottlenecks
• Prioritising new features based on usage data
• Diagnosing and fixing bugs

Legal basis: Legitimate interests (GDPR Art. 6(1)(f)); we balance this against your rights and only use aggregated or pseudonymised data for this purpose.

5.3 For billing and financial compliance

• Calculating usage-based charges
• Issuing GST-compliant invoices
• Maintaining financial records as required by Indian law (Companies Act, GST Act, Income Tax Act)

Legal basis: Legal obligation (GDPR Art. 6(1)(c)); compliance with Indian financial regulations.

5.4 For security and fraud prevention

• Detecting and preventing unauthorised access, abuse, or fraudulent transactions
• Monitoring for security incidents and responding to them
• Enforcing our Terms of Service

Legal basis: Legitimate interests (GDPR Art. 6(1)(f)); legal obligation where applicable.

5.5 For marketing and communications

• Sending product updates, release announcements, and newsletters (where you have opted in)
• Sending transactional emails — account confirmations, password resets, invoices (always permitted)
• Personalising marketing content based on your usage and interests

Legal basis: Consent for marketing communications (GDPR Art. 6(1)(a)); you may withdraw consent at any time by clicking 'unsubscribe' in any marketing email or contacting us at privacy@kividb.io.

5.6 For legal compliance

• Responding to lawful requests from courts, regulators, or law enforcement
• Enforcing our legal rights
• Complying with applicable laws including Indian law, GDPR, CCPA, and other regulations

Legal basis: Legal obligation (GDPR Art. 6(1)(c)); legitimate interests.

6.1 Service providers and sub-processors

• Payment processing: Razorpay and/or Paddle — for payment collection, fraud prevention, and tax compliance.
• Cloud infrastructure: Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure — for hosting our platform and your data.
• Analytics: We may use analytics providers such as Google Analytics, Plausible, or similar tools for website analytics.
• Email delivery: Email service providers for transactional and marketing emails.
• Error monitoring: Application monitoring services for diagnosing technical issues.

All service providers are contractually bound to process your data only on our instructions, to maintain appropriate security measures, and not to use your data for their own purposes.

6.2 Legal requirements

We may disclose your personal data if required to do so by law, court order, or governmental authority, or where we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

6.3 Business transfers

If KiviDB is involved in a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your personal data is transferred and becomes subject to a different privacy policy.

6.4 With your consent

We may share your data with third parties where you have given us explicit consent to do so.

8.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. They allow the website to remember your actions and preferences over time.

8.2 Categories of cookies we use

8.3 Managing your cookie preferences

When you first visit our website, you will be presented with a cookie consent banner allowing you to accept or reject non-essential cookies. You can change your preferences at any time. You can also control cookies through your browser settings. For more information on managing cookies, visit www.allaboutcookies.org.

8.4 Do Not Track

Some browsers support a "Do Not Track" (DNT) signal. We currently do not respond to DNT signals as there is no consistent industry standard for doing so. We will update this Policy if that changes.

10.1 Rights available to all users

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your personal data (subject to legal retention obligations)
• Right to data portability — request your data in a structured, machine-readable format
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time
• Right to object to marketing — opt out of marketing communications at any time

10.2 Additional rights for EEA/UK users (GDPR)

• Right to restrict processing
• Right to object to processing based on legitimate interests
• Rights related to automated decision-making and profiling
• Right to lodge a complaint with your national data protection authority

EEA users may lodge complaints with their national supervisory authority. UK users may contact the Information Commissioner's Office (ICO) at ico.org.uk.

10.3 Rights for California residents (CCPA/CPRA)

• Right to know — the categories and specific pieces of personal information collected
• Right to delete — to request deletion of your personal information
• Right to correct — to request correction of inaccurate personal information
• Right to opt out of sale or sharing — KiviDB does not sell personal information
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

To exercise your California rights, contact us at privacy@kividb.io with the subject line "California Privacy Request". We will respond within 45 days.

10.4 Rights for Indian users (DPDP Act 2023)

• Right to access information about your personal data being processed
• Right to correction and erasure of your personal data
• Right to grievance redressal
• Right to nominate a nominee to exercise your rights

To exercise your rights under the DPDP Act, contact our Data Protection Officer at dpo@kividb.io.

10.5 How to exercise your rights

Contact us at privacy@kividb.io with your full name, email address associated with your account, and the specific right you wish to exercise. We will respond within 30 days. We may need to verify your identity before processing your request.