Privacy Policy

What we collect

• Account details. Your name, email address and, if you sign up with a password, a hashed copy of it. We never store your password in plain text.
• Google sign-in. If you continue with Google, we receive your name, email address and profile picture from Google. We don't ask for access to your Gmail, Drive, contacts or anything else in your Google account.
• Sessions. When you sign in we record the IP address and browser of the session, so you stay signed in and so we can spot misuse.
• Connected sites. Each site's address, the WordPress user you chose for the assistant to act as, and the keys that let Kitepod and the plugin trust each other.
• Changes and history. When your assistant changes a site, we keep a record of who asked, what changed, who approved it and when. To make undo possible we keep an encrypted copy of the content as it was before the change, and screenshots of pages before and after a change is published.
• Files you upload. Images and other media your assistant sends to a site pass through Kitepod on their way there.
• People you invite. If you invite a teammate or a client to approve changes, we store their email address and their role.

What we don't do

• We don't sell your data or share it with advertisers.
• We don't run AI models, and we don't use your site content or your conversations to train any model.
• We don't use analytics or advertising trackers on kitepod.com. The only cookies we set are the ones that keep you signed in and secure.
• We don't send marketing email unless you ask for it.

How we use it

We use this information only to run Kitepod: to sign you in, carry your assistant's requests to your sites, show you previews and history, let you undo changes, send approval requests and sign-in codes, keep the service secure and answer you when you write to us.

Your AI assistant

Kitepod doesn't see your conversations, only the requests your assistant makes to it. When your assistant calls Kitepod, the results (for example a page's content) go back to your assistant, which is run by its own provider, such as Anthropic, OpenAI or Cursor. What that provider does with it is covered by your agreement with them, not by this policy.

Google user data

Kitepod's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google name, email address and profile picture only to create your account and sign you in. We don't transfer this data to anyone else except as needed to run Kitepod or as the law requires, and we don't use it for advertising.

Who processes it for us

• Cloudflare hosts Kitepod: the app, its database, encrypted snapshot storage, page screenshots and outgoing email. Data may be processed in any country where Cloudflare operates.
• Google, only if you choose to sign in with Google.

We may also disclose information if the law requires it, or to protect Kitepod, our users or the public from fraud or abuse.

How long we keep it

• Snapshots used for undo, and page screenshots, are normally deleted after 90 days.
• Your account, connected sites and change history are kept while your account is open.
• When you ask us to delete your account, we delete your account data within 30 days, apart from anything the law requires us to keep.

Your site's own content stays on your own server. Disconnecting a site stops Kitepod from reaching it.

Security

Traffic to Kitepod is encrypted, every request between Kitepod and your site is signed, and stored snapshots and screenshots are encrypted. No system is perfectly secure, so please keep your own backups of your sites too.

Your choices and rights

You can ask us for a copy of your data, to correct it, or to delete your account and its data. Email nasim@heffl.com from the address on your account and we'll reply within 30 days. Depending on where you live, you may also have the right to object to or restrict how we use your data, and to complain to your local data protection authority.

Children

Kitepod isn't meant for anyone under 16, and we don't knowingly collect data from children.

Changes to this policy

If we change this policy in a way that matters, we'll update the date at the top and tell you by email or in the app before the change takes effect.

Contact

Questions or requests: nasim@heffl.com. See also our Terms of Service.