Privacy Policy

This Policy explains what personal data Kumidai collects, why, and your rights. The data controller is:

1. Data we collect

• Account data — email, display name, hashed password.
• Content — projects, work items, comments, and settings you create.
• Connection metadata — git repository and AI/MCP connection details you configure (we store configuration and tokens needed to operate them, not the contents of your repositories beyond what you sync).
• Usage & technical data — logs, IP address, request metadata, and audit events for security and reliability.
• Billing data — handled by our payment processor; we receive plan/subscription status, not full card numbers.

2. Why we use it

To provide and secure the Service, authenticate you, operate agents/integrations you enable, bill paid plans, prevent abuse, and comply with law. Legal bases include performance of contract, legitimate interests (security, service improvement), consent (where required), and legal obligation.

3. Processors we use

• Microsoft Azure — hosting (West US 3).
• Stripe — payment processing.
• Email provider — transactional email (registration, invoices, notifications).
• Git & AI providers — only those you explicitly connect.

4. Cookies

We use a strictly-necessary session cookie for authentication. We do not use non-essential tracking cookies without consent.

5. Retention

We keep account and content data while your account is active and for a reasonable period afterwards, then delete or anonymise it, unless longer retention is required by law (e.g. invoicing records).

6. International transfers

Data may be processed outside your country (e.g. US hosting). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

7. Your rights

Subject to applicable law (including the EU/UK GDPR), you may access, correct, delete, port, or object to processing of your personal data, and lodge a complaint with your supervisory authority. To exercise these rights, contact us below.

8. Security

We use tenant isolation, encryption in transit (TLS), hashed credentials, and access controls. No system is perfectly secure; we work to protect your data and will notify you of breaches as required by law.

9. Contact

Privacy requests: admin@kumidai.dev.