Privacy Policy

Last updated: September 2026

1. Introduction

KayAI ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

Important: We collect sensitive data (HubSpot API tokens). These are your production credentials. We treat them with the security of a financial password.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email, name, password (if using email login)
• Payment Information: Processed by Stripe; we do not store card details
• HubSpot Token: Your HubSpot API token (required to use the service). This is encrypted at rest.
• Team Data: Email addresses of team members you invite

2.2 Information Collected Automatically

• Session Cookies: To keep you logged in
• Server Logs: IP address, browser type, pages visited (standard web server logs)
• Google OAuth Profile: Name, email, profile picture (if signing in with Google)

2.3 Information from Third Parties

• Google: Profile information when you authenticate with Google
• Stripe: Confirmation of successful payments
• HubSpot: We read from your HubSpot portal (contacts, companies, deals) only as needed to provide the service

3. How We Use Your Information

• To provide the service: Authenticate you, store your settings, read from your HubSpot portal
• Billing: Process subscriptions and payments via Stripe
• Support: Respond to your support requests
• Security: Detect and prevent fraud or abuse
• Legal: Comply with law or legal process

4. Who We Share Your Data With

• Stripe: Payment processor. They handle billing and keep PCI compliance.
• Google: Only if you authenticate via Google (they already have your profile).
• HubSpot: We use their API to read from your portal, only with your token.
• Service providers: Railway (hosting), Cloudflare (CDN), Google Fonts (typography)

We do not sell your data. We do not share your HubSpot token with anyone except HubSpot via their API.

5. Data Security

• HubSpot tokens are encrypted at rest using AES-256
• Passwords are hashed with bcrypt
• All data is transmitted over HTTPS (TLS 1.2+)
• Database is on a private, firewalled server

While we use industry-standard protections, no security is perfect. If you believe your account is compromised, contact us immediately.

6. Your Rights

Under Australian Privacy Act:

• Access: You can request a copy of your personal information
• Correction: You can correct inaccurate data
• Deletion: You can request deletion (we will delete your account and associated data within 30 days)
• Opt-out: You can stop receiving communications

To exercise these rights, email support@kayai.app with "Privacy Request" in the subject line.

Under GDPR (if you're in EU):

• Right to access, correct, delete ("right to be forgotten")
• Right to data portability (export your data)
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with your data protection authority (EDPB)
• Right to withdraw consent at any time

Legal basis for processing: Your explicit consent (when you sign up) and performance of the contract (when you use the service).

7. Data Retention

• Active accounts: Data kept while you use the service
• Deleted accounts: Permanently deleted within 30 days (except legally required records)
• Server logs: Kept for 7 days then deleted
• Payment records: Kept for 7 years (tax/legal requirement)

8. Cookies & Tracking

• Session cookies: Essential, remember you're logged in
• No analytics tracking: We do not use Google Analytics or third-party tracking
• No advertising pixels: We do not track you across other websites

9. Children & Minors

KayAI is not intended for anyone under 18. We do not knowingly collect data from minors. If you're under 18, please do not use this service.

10. International Data Transfers

Your data may be stored or processed in Australia, US (Stripe), or US (Google). By using KayAI, you consent to this transfer. We have agreements in place (Standard Contractual Clauses) to protect your data.

11. Changes to This Policy

We may update this policy. Changes are effective when posted. Continued use means you accept the updated policy.

12. Contact Us

Privacy Questions or Requests:
Email: support@kayai.app
Subject: "Privacy Request" or "Privacy Concern"
Response time: Within 30 days

Complaints (Australia):
You have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) if you believe we've breached the Privacy Act.