Privacy

Introduction

Kipwise Inc. (“Kipwise”) takes the private nature of your personal information very seriously. This policy also explains your choices surrounding how we use your personal information, which include how you can object to certain uses of the information and how you can access and update certain information.

Website Visitors

Like most website operators, Kipwise collects non-personally-identifying information of the sort that web browsers and servers typically make available, such as the browser type, language preference, referring site, and the date and time of each visitor request. Kipwise’s purpose in collecting non-personally identifying information is to better understand how Kipwise’s visitors use its website. From time to time, Kipwise may release non-personally-identifying information in the aggregate, e.g. by publishing a report on trends in the usage of its website.

Kipwise also collects potentially personally-identifying information like Internet Protocol (IP) addresses. Kipwise does not use such information to identify its visitors, and does not disclose such information, other than under the same circumstances that it uses and discloses personally-identifying information, as described below.

Gathering of Personally-Identifying Information

Certain visitors to Kipwise’s websites choose to interact with Kipwise in ways that require Kipwise to gather personally-identifying information. The amount and type of information that Kipwise gathers depends on the nature of the interaction. For example, we ask visitors who sign up for kipwise.com to provide an email address. In each case, Kipwise collects such information only insofar as is necessary or appropriate to fulfill the purpose of the visitor’s interaction with Kipwise. Kipwise does not disclose personally-identifying information other than as described below. And visitors can always refuse to supply personally-identifying information, with the caveat that it may prevent them from engaging in certain website-related activities.

Aggregated Statistics

Kipwise may collect statistics about the behavior of visitors to its websites. For instance, Kipwise may monitor the most popular public sites on Kipwise .com. However, Kipwise does not disclose personally-identifying information other than as described below.

Aggregated Statistics is not personal information, and we may use and disclose such information in a number of ways, including research, internal analysis, analytics, and any other legally permissible purposes.

Protection of Certain Personally-Identifying Information

Kipwise discloses potentially personally-identifying and personally-identifying information only to those of its employees, contractors and affiliated organizations that (i) need to know that information in order to process it on Kipwise’s behalf or to provide services available at Kipwise’s websites, and (ii) that have agreed not to disclose it to others.

Some of those employees, contractors and affiliated organizations may be located outside of your home country; by using Kipwise’s websites, you consent to the transfer of such information to them. In addition, in some cases we may choose to buy or sell assets. In these types of transactions, user information is typically one of the business assets that is transferred. Moreover, if Kipwise or substantially all of its assets were acquired, or in the unlikely event that Kipwise goes out of business or enters bankruptcy, user information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquiror of Kipwise may continue to use your personal and non-personal information only as set forth in this policy. Otherwise, Kipwise will not rent or sell potentially personally-identifying and personally-identifying information to anyone.

Other than to its employees, contractors and affiliated organizations, as described above, Kipwise discloses potentially personally-identifying and personally-identifying information only when required to do so by law, or when Kipwise believes in good faith that disclosure is reasonably necessary to protect the property or rights of Kipwise, third parties or the public at large. If you are a registered user of a Kipwise website and have supplied your email address, Kipwise may occasionally send you an email to tell you about new features, solicit your feedback, or just keep you up to date with what’s going on with Kipwise and its products. If you send us a request (for example via a support email or via one of our feedback mechanisms), we reserve the right to publish it in order to help us clarify or respond to your request or to help us support other users. Kipwise takes all measures reasonably necessary to protect against the unauthorized access, use, alteration or destruction of potentially personally-identifying and personally-identifying information.

You should also be aware that if you submit information to “chat rooms,” “forums” or “message boards” such information becomes public information, meaning that you lose any privacy rights you might have with regards to that information. Such disclosures may also increase your chances of receiving unwanted communications.

Cookies

A cookie is a string of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website each time the visitor returns. Kipwise uses cookies to help Kipwise identify and track visitors, their usage of Kipwise websites, and their website access preferences. Kipwise visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using Kipwise’s websites, with the drawback that certain features of Kipwise’s websites may not function properly without the aid of cookies.

Your Rights

If you are located in certain countries, including those that fall under the scope of the European General Data Protection Regulation (AKA the “GDPR”), data protection laws give you rights with respect to your personal data, subject to any exemptions provided by the law, including the rights to:

• Be informed your personal data is being collected, and how we will use and keep it;
• Request access to your personal data;
• Request correction or deletion of your personal data;
• Request a copy of our automated processing activities related to your personal data;
• Object to our use and processing of your personal data;
• Request that we limit our use and processing of your personal data; and
• Request portability of your personal data.
• You can usually access, correct, or delete your personal data using your account settings and tools that we offer, but if you aren’t able to do that, or you would like to contact us about one of the other rights, scroll down to How to Reach Us to, well, find out how to reach us.

EU individuals also have the right to make a complaint to a government supervisory authority. You can also contact our Data Protection Officer at dpo@kipwise.com.

Links to Third Party Sites

This privacy policy only applies to information collected by Kipwise. This privacy policy does not apply to the practices of companies that Kipwise does not own or control, or employees that Kipwise does not manage. A Kipwise website may contain links to third party websites. Any information you provide to, or that is collected by, third-party sites may be subject to the privacy policies of those sites, if any. We encourage you to read such privacy policies of any third-party sites you visit. It is the sole responsibility of such third parties to adhere to any applicable restrictions on the disclosure of your personally-identifying information, and Kipwise and its affiliates shall not be liable for wrongful use or disclosure of your personally-identifying information by any third party.

Security of Your Information

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. We encrypt the transmission of your information using secure sockets layer technology (SSL).

We’ve also adopted commercially reasonable physical, managerial, and technical safeguards to preserve the integrity and security of your personal information. We regularly back up your data to help prevent data loss and aid in data recovery. We also guard against common web attack vectors, host data in secure SOC 1, SOC 2, ISO 27001 and ISO 9001 compliant data center facilities, and implement industry standard firewalls and access restrictions on our servers to secure our network.

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

In the event that personal information is compromised as a result of a security breach, we will promptly notify the affected parties in accordance with our notification procedures set forth in this Privacy Policy, or as otherwise required by applicable law.

Choice/Opt-out

If we ever send you information by email concerning new products, services or information that you did not expressly request, we will provide you with an email address by which you may request no further notices.

Children's Information

The Services are not directed to children under 13 (or other age as required by local law), and we do not knowingly collect personal information from children. If you learn that your child has provided us with personal information without your consent, you may contact us as set forth below. If we learn that we have collected a child’s personal information in violation of applicable law, we will promptly take steps to delete such information and terminate the child’s account.

Google User Data

This section applies to the Kipwise Agent, our AI assistant for Slack, when you connect one or more Google products to it. Each Google product is connected separately, by you, through Google's consent screen. The agent only acts when you ask it to in Slack.

What we access and why.

Gmail (gmail.modify): to search your mail, read messages, drafts and attachments you ask about, create, edit and delete drafts, reply to messages, archive, trash or restore messages, mark them read or unread, star them, and apply or remove your existing labels. Emails are only sent after you confirm the send in Slack, either immediately or at a time you schedule.
Google Calendar (calendar.events): to list events on your primary calendar and to create, update or delete events when you ask. Invitation updates are sent to attendees when an event has attendees.
Google Drive (drive.readonly): to search, list and read files and folders you ask about. The agent cannot change, share or delete Drive files.
Google Analytics (analytics.readonly): to list your properties and run reports. The agent cannot change anything in Google Analytics.
Google Search Console (webmasters.readonly): to list your sites and read search performance and sitemap data. The agent cannot change anything in Search Console.
Google Ads (adwords): to read accounts, campaigns, keywords, search terms and performance data. The only changes the agent can make are pausing or enabling a campaign and changing a campaign's daily budget when you ask.

How we use it. We use Google user data only to carry out the request you make in Slack and to show you the result in that Slack conversation. We do not use it for advertising, we do not sell it, and we do not use it to build user profiles or for any purpose unrelated to the feature you are using.

AI processing. To answer your request, the relevant Google data (for example the text of an email or a file) is sent as part of the prompt to a large language model hosted on Amazon Web Services Bedrock in the United States. AWS acts as our sub-processor. Under AWS's Bedrock terms, prompts and outputs are not used to train the underlying models. Kipwise does not use Google Workspace data or any other Google user data to develop, improve or train generalized or non-personalized AI or machine learning models.

How we store it. Your Google OAuth access and refresh tokens are stored in our database on AWS in the United States, encrypted at the application level with AES-256-GCM. The agent does not keep a separate copy of your mailbox, calendar or files. To operate and troubleshoot the service, we keep a log of each action the agent takes, which records the action, its inputs, whether it succeeded, and the IDs of the items involved. For Google actions the log does not keep the result (such as email text, file text or calendar details), and it does not keep inputs copied from your Google data (an email body or subject, or an event description). For emails you schedule, we keep the draft reference, recipients, subject and delivery status. The agent's replies are posted in your Slack workspace, where they are subject to your Slack retention settings.

How we share it. We do not share or transfer Google user data to third parties except: AWS, which hosts our service and database and runs the AI model; E2B, a code sandbox provider, only when you ask the agent to run an analysis that requires code and that data is part of the analysis; GitHub, where our engineers receive a private error report when an action fails, containing your request, the action's inputs and the error, but never the data the action returned from Google, and with email bodies, subjects and event descriptions copied from your Google data removed from the inputs; Slack, where results are delivered to you; and where required by law. These providers process data only on our behalf to provide the service.

Human access. Kipwise staff do not read your Google user data except with your explicit permission, when necessary for security purposes such as investigating abuse, to comply with applicable law, or to investigate and fix a failure in an action you requested, as described above.

Retention and deletion. OAuth tokens are kept while your Google connection is active. You can disconnect at any time by asking the agent in Slack, for example "disconnect my Gmail": it revokes the access at Google and deletes the stored token immediately. You can also revoke the Kipwise Agent's access at myaccount.google.com/permissions. After you revoke access there, Google rejects our token and we delete the stored token the next time the agent tries to use it. Action logs and scheduled-email records are currently kept until you ask us to delete them. To delete your stored tokens, action logs and any other Google user data we hold, contact us and we will delete it.

Limited Use. Kipwise's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data Retention

We store the personal information we receive as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

Privacy Policy Changes

Although most changes are likely to be minor, Kipwise may change its privacy policy from time to time, and in Kipwise’s sole discretion. Kipwise encourages visitors to frequently check this page for any changes to its privacy policy. Your continued use of this site after any change in this privacy policy will constitute your acceptance of such change.

Contact Us

If you have any questions about this privacy policy or our sites in general, please contact us.