Privacy Policy

1.1 Account details

Your name, email address, profile and login. If you sign in with Google or GitHub, we receive the profile details you allow them to share.

1.2 Payment details

Card numbers and billing details are collected and processed by our payment provider, Stripe. We do not store full card details. We keep records of payments, plans and Credits for billing and tax.

1.3 Your content

What you and your agents put into Kavela: messages, instructions, files, agents, workflows, approvals and the work agents produce, including messages that reach your agents through the channels you connect.

1.4 Connected accounts

When you connect an account, we store the access it grants (such as tokens or keys), encrypted, and agents read and write data in it to do the work you ask for. When you sign in to a website for an agent, you do it on that site’s own page or in a secure browser session, so your password goes to that site and does not pass through the AI model.

1.5 How you use our website and app

IP address, browser, device, pages visited, referring pages and the times of your actions, from server logs and analytics. Our analytics provider, PostHog, also records how pages are used (session replay), with everything typed into a form field masked.

The legal bases are those of the EU and UK GDPR. Under Singapore’s Personal Data Protection Act 2012 (PDPA), we rely on your consent, including consent you are deemed to give by using Kavela for these purposes, and on the exceptions the PDPA allows.

3.1 Improving Kavela and our models

We may turn personal information into aggregated, de-identified data that no longer identifies you, and use it to analyse, improve, develop and protect Kavela, including our models. We use your own content to improve our models only if you allow it. Depending on where you live, you can object to this use of your information (section 9).

3.2 Data from Google accounts

Kavela’s use of information received from Google APIs, and its transfer to any other app, adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use information from a Google account you connect only to provide and improve the features you use it for. We never use it to develop, improve or train AI or machine-learning models, never use it for advertising, and never sell it. People at Kavela read it only with your permission, where needed for security or to meet the law, or once it is aggregated and anonymised.

3.3 AI model providers

To run your agents, we send the content they need to the AI model providers that power Kavela, who process it for us under contract. If you connect your own Claude or Codex plan, agents send content to Anthropic or OpenAI through your own account, under their terms and privacy policies.

3.4 Automated decisions

Agents process content automatically. We do not use them to make decisions about you that have legal or similarly significant effects. If you think an automated decision has significantly affected you, contact us and a person will review it.

3.5 Who can see your sessions

A small number of authorised Kavela staff and systems may look at your sessions where reasonably needed to:

• run, fix and support Kavela, for example to investigate a failed run or a support request;
• detect, investigate and stop fraud, abuse, security incidents and breaches of our Terms; or
• meet the law or a valid legal request.

Access is limited to the people and the data the purpose needs. Data from a Google account follows section 3.2.

When an organisation uses Kavela for its team or its clients, it decides what data goes into its workspaces and how it is used, and we process that data on its behalf and on its instructions. If you are a member, guest or client of such an account, its owner’s privacy policy covers your data; please send requests about it to them, and we will help them answer.

• Our service providers, who process data for us under contract: Cloudflare (hosting, storage and computing), Supabase (database and sign-in), Stripe (payments), PostHog (analytics), Resend (email) and AI model providers. A current list is available on request.
• People in your account. Members and guests you invite can see the workspaces and content you give them access to.
• The services you connect. Agents send data to them when doing the work you ask for.
• People who add your packs. If you publish a pack of agents, what it contains is copied to anyone who adds it.
• Authorities and others, when needed: where the law requires it, or where we believe in good faith that it is needed to prevent harm, protect someone’s safety, or protect Kavela and its users, as our Terms of Service describe.
• A buyer or successor, in a merger, acquisition or sale of our business, with this policy’s protections.
• Anyone else you ask us to.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Our service providers process data in several countries, including the United States, so your data may be processed outside the country where you live. When we transfer personal data out of Singapore, we make sure it is protected to a standard comparable to the PDPA. For data from the EU, EEA or UK, we use Standard Contractual Clauses or another lawful transfer mechanism. Ask us for details.

You can ask us to delete your data sooner, subject to what the law requires us to keep.

Your data is encrypted in transit (TLS) and at rest, and access to it is limited to the people who need it. Credentials for the accounts you connect are encrypted again, with their own key, before they are stored. No system is perfectly secure, so we cannot promise that data will never be accessed without permission.

If a data breach is likely to cause you significant harm, we will tell you, and the relevant authorities, as the PDPA, the GDPR and other applicable laws require.

9.1 Everyone

You can ask to access or correct your personal information, ask us to delete it, and withdraw consent you have given (which may mean we can no longer provide part of Kavela). Write to [email protected]. We answer within 30 days and may need to confirm your identity first.

9.2 EU, EEA and UK

You also have the rights to data portability, to restrict processing, to object to processing based on legitimate interests (including the use in section 3.1), and not to be subject to solely automated decisions with legal or similarly significant effects. You can complain to your local data protection authority.

9.3 United States

Depending on your state, including California, you may have the right to know what personal information we collect, to delete or correct it, and not to be treated differently for using these rights. The categories we collect are those in section 1: identifiers (name, email, IP address), commercial information (plans and Credits bought), internet activity (use of our website and app) and the content you put into Kavela. We do not sell personal information or share it for cross-context behavioural advertising.

9.4 Singapore

If you are not satisfied with our answer, you can contact the Personal Data Protection Commission of Singapore.

Visitors in the EU are asked before analytics load. You can block or delete cookies in your browser settings; Kavela works without analytics cookies. Browsers can send a "Do Not Track" signal; there is no agreed standard for it, so we do not respond to it.

Kavela is not for anyone under 18, or the age of majority where they live. We do not knowingly collect their personal information, and we delete it if we find we have. If you think a child has given us personal information, contact [email protected].

We may update this policy. For a material change, we will tell you by email or in Kavela at least 30 days before it takes effect. The date at the top shows the latest version.

Kavela AI Pte. Ltd. (UEN 202640130R), 60 Paya Lebar Road, #06-28, Paya Lebar Square, Singapore 409051. For privacy questions, requests or complaints, write to our Data Protection Officer at [email protected].