Privacy Policy

Contact details for privacy matters

• Data Protection Officer (DPO): dpo@kividb.io
• General privacy queries: privacy@kividb.io
• Legal notices: legal@kividb.io
• Website: kividb.io

3.1 Account and Identity Data

• Full name
• Email address
• Username and password (stored in hashed form — we never store plaintext passwords)
• Company or organisation name (if applicable)
• Country of residence or billing address

3.2 Payment and Billing Data

• Payment card details (processed directly by our payment processors — we do not store raw card numbers)
• Billing address
• Transaction history and invoices
• Tax identification numbers where required by law (e.g. GST number, VAT number)

Payment data is processed by our payment processor, Razorpay. Card and bank details are entered on Razorpay's own checkout and never reach our servers; we receive only the order and payment references and the outcome. Please review Razorpay's privacy policy for how it handles your payment data.

3.3 Usage and Telemetry Data

• Connection metadata — IP address, port, connection timestamps, and duration
• Command usage statistics — which KiviDB commands are used and how frequently (we do not log the content or values of your data stored in KiviDB)
• Performance metrics — query latency, memory usage, throughput
• Error logs — error types and frequencies (without personal data content)
• Feature usage — which platform features and dashboard sections you interact with
• Instance configuration — database size, replication settings, geographic region selected
• Release checks from KiviDB software you run yourself — when it starts, the software asks kividb.io whether a newer release is available, sending its version, operating system, processor architecture and build variant. The request carries none of your data or configuration, but like any internet request it reveals the IP address it comes from. The reply is served from our content delivery network, and we do not log or store these requests or the IP addresses they come from. You can turn it off; see the End User License Agreement, section 7.

3.4 Website and Request Data

We do not use analytics tools, advertising trackers or tracking pixels, and our emails do not track opens or clicks. What we receive is the technical data any server receives:

• When you use the console, API, Terraform provider or MCP server, our servers log each request: IP address, time, the address requested and the result. These logs are kept for 90 days and used for security and troubleshooting.
• Your IP address is used to estimate your country for tax and billing, and at checkout to suggest your address for your database's allowlist.
• Email delivery events: whether a message was delivered, bounced or marked as spam.

3.5 Communications Data

• Emails and messages you send to our support team
• Support ticket content and history
• Survey responses and feedback you choose to provide
• Community forum posts. The forum at kividb.io/community shows discussions hosted on GitHub Discussions. What you post there, whether on GitHub or through the reply box on our site, is stored by GitHub, Inc. under your GitHub account and is public; we do not store it. The reply box is giscus, a third-party GitHub app, and replying requires signing in to it with GitHub. GitHub's and giscus's own privacy policies apply to that sign-in and to what you post. Opening a discussion on our site loads profile pictures and replies directly from GitHub and giscus, so they receive your IP address. We keep a short-lived copy of public discussion titles and text so the page loads quickly.

3.6 API Keys, Integrations and AI Assistants

You can reach KiviDB through our API, our Terraform provider, and our Model Context Protocol (MCP) server, which lets an AI assistant such as Claude, ChatGPT or Gemini operate your databases on your behalf. All of them authenticate with an API key you create and can revoke at any time.

• API keys — we store a short, non-secret prefix so you can tell your keys apart, and a one-way cryptographic digest of the key itself. The key is shown to you once, at creation, and we cannot recover it afterwards.
• Key usage — the time a key was last used, so you can see which integration is active and spot one that should be revoked.
• Assistant connections — when you connect an assistant by signing in rather than with an API key, as ChatGPT and Claude do, we record the name the assistant registered under, the account and organization you approved it for, and when you approved it. The access and refresh tokens it receives are stored only as one-way digests. Every connection is listed under Settings → Connections, where you can disconnect it.
• What an assistant sends — when you use the MCP server, the requests it makes on your behalf carry your API key or the sign-in you approved, and whatever your assistant asked for: database names and identifiers, and, for data commands, the keys and values involved.

3.7 Data We Do Not Collect

We do not knowingly collect the following categories of sensitive personal data unless you voluntarily provide them in a support communication:

• Racial or ethnic origin
• Political opinions or religious beliefs
• Health or medical data
• Biometric data
• Data relating to children under 16 years of age

Our Services are not directed at children under 16. If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will delete it promptly.

4.1 Directly from you

• When you create an account or sign up for a free trial
• When you subscribe to a paid plan and provide payment details
• When you contact our support team
• When you respond to surveys or provide feedback
• When you download our software

4.2 Automatically

• Through the requests your browser and tools make to our servers, and the browser storage described in Section 8
• Through our platform's telemetry system when you use the cloud Services
• When KiviDB software you run yourself checks for a newer release (see Section 3.3)
• Through server logs when you connect to our APIs

4.3 From third parties

• From our payment processor, confirmation that a payment succeeded or failed
• From the sign-in provider you choose (Google, or your organization's single sign-on), your name, email address and profile picture
• From IP lookup services, the country your IP address belongs to

5.1 To provide and operate the Services

• Creating and managing your account
• Provisioning and operating your KiviDB instances
• Processing payments and issuing invoices
• Providing technical support

Legal basis: Performance of contract (GDPR Art. 6(1)(b)); contractual necessity (DPDP Act 2023).

5.2 To improve our Services

• Analysing usage patterns and telemetry to identify performance bottlenecks
• Prioritising new features based on usage data
• Diagnosing and fixing bugs

Legal basis: Legitimate interests (GDPR Art. 6(1)(f)); we balance this against your rights and only use aggregated or pseudonymised data for this purpose.

5.3 For billing and financial compliance

• Calculating usage-based charges
• Issuing GST-compliant invoices
• Maintaining financial records as required by Indian law (Companies Act, GST Act, Income Tax Act)

Legal basis: Legal obligation (GDPR Art. 6(1)(c)); compliance with Indian financial regulations.

5.4 For security and fraud prevention

• Detecting and preventing unauthorised access, abuse, or fraudulent transactions
• Monitoring for security incidents and responding to them
• Enforcing our Terms of Service

Legal basis: Legitimate interests (GDPR Art. 6(1)(f)); legal obligation where applicable.

5.5 For marketing and communications

• Sending product updates, release announcements, and newsletters (where you have opted in)
• Sending transactional emails — account confirmations, password resets, invoices (always permitted)

Legal basis: Consent for marketing communications (GDPR Art. 6(1)(a)); you may withdraw consent at any time by clicking 'unsubscribe' in any marketing email or contacting us at privacy@kividb.io.

5.6 For legal compliance

• Responding to lawful requests from courts, regulators, or law enforcement
• Enforcing our legal rights
• Complying with applicable laws including Indian law, GDPR, CCPA, and other regulations

Legal basis: Legal obligation (GDPR Art. 6(1)(c)); legitimate interests.

6.1 Service providers and sub-processors

These are the providers that receive personal data from us, and what each receives:

• Cloud infrastructure: Amazon Web Services, Google Cloud and Microsoft Azure. Our own systems and account records run on AWS in Frankfurt (eu-central-1). Your database runs on the provider and in the region you choose.
• Payments: Razorpay. Card and bank details are entered on Razorpay's own checkout and never reach our servers; we keep the order and payment references, amounts and tax details.
• Sign-in: Auth0 (Okta), for Google sign-in and enterprise single sign-on. It receives your name, email address and profile picture from the provider you sign in with.
• Email delivery: Amazon SES, for account, billing and service emails.
• Support: Zoho Desk, for support requests and contact-form messages, including the name, email address, phone number and company you give us.
• Scheduling: Cal.com, only if you use Book a Demo.
• Community forum: GitHub and giscus, as described under Communications Data.
• IP lookups: ipify, country.is, ipwho.is and ipapi.co receive your IP address, and nothing else, for the country and allowlist uses described above.
• Fonts: Google Fonts serves two typefaces on our blog pages, so Google receives your IP address when you read the blog.

We do not use analytics, advertising or third-party error-monitoring services. The current list is also kept at trust.kividb.io.

6.2 Legal requirements

We may disclose your personal data if required to do so by law, court order, or governmental authority, or where we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

6.3 Business transfers

If KiviDB is involved in a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your personal data is transferred and becomes subject to a different privacy policy.

6.4 With your consent

We may share your data with third parties where you have given us explicit consent to do so.

8.1 What we store on your device

We store only what the site needs to work. We do not use analytics, advertising or cross-site tracking cookies.

• Sign-in: when you sign in, your session tokens are kept in your browser's local storage so you stay signed in.
• Preferences: things like the selected organization, dismissed notices, the sidebar state and your pricing or dashboard settings.

8.2 Third parties

Some features are provided by other companies, which may set their own cookies when you use them: Razorpay at checkout, Auth0 and your sign-in provider when you sign in, Cal.com if you book a demo, and GitHub and giscus on community pages. These load only when you use that feature.

8.3 Your choices

Because we store only what is necessary, there is nothing to opt out of on our side. You can clear or block cookies and local storage in your browser settings; doing so signs you out and resets your preferences.

8.4 Do Not Track

We do not track you across websites, so a "Do Not Track" signal changes nothing about how the site behaves.

10.1 Rights available to all users

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — ask us to delete your personal data (subject to legal retention obligations)
• Right to data portability — request your data in a structured, machine-readable format
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time
• Right to object to marketing — opt out of marketing communications at any time

10.2 Additional rights for EEA/UK users (GDPR)

• Right to restrict processing
• Right to object to processing based on legitimate interests
• Rights related to automated decision-making and profiling
• Right to lodge a complaint with your national data protection authority

EEA users may lodge complaints with their national supervisory authority. UK users may contact the Information Commissioner's Office (ICO) at ico.org.uk.

10.3 Rights for California residents (CCPA/CPRA)

• Right to know — the categories and specific pieces of personal information collected
• Right to delete — to request deletion of your personal information
• Right to correct — to request correction of inaccurate personal information
• Right to opt out of sale or sharing — KiviDB does not sell personal information
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights

To exercise your California rights, contact us at privacy@kividb.io with the subject line "California Privacy Request". We will respond within 45 days.

10.4 Rights for Indian users (DPDP Act 2023)

• Right to access information about your personal data being processed
• Right to correction and erasure of your personal data
• Right to grievance redressal
• Right to nominate a nominee to exercise your rights

To exercise your rights under the DPDP Act, contact our Data Protection Officer at dpo@kividb.io.

10.5 How to exercise your rights

Contact us at privacy@kividb.io with your full name, email address associated with your account, and the specific right you wish to exercise. We will respond within 30 days. We may need to verify your identity before processing your request.