Privacy Policy
What we collect when you use Kiteloom, why we collect it, and the rights you have over it.
Zuletzt aktualisiert am 2026-08-06 · v1.0
1. Who this policy covers
This policy explains how Kiteloom ("we", "us") handles personal data when you visit our website, create an account, or use the Kiteloom canvas application.
2. Who we are
3. What we collect and why
The full list of what we collect, the purpose of each category, the legal basis we rely on, and how long we keep it lives in one place — our Data Declaration, so it never drifts out of sync with this policy. In short: account details you give us directly, the board content and files you create, and a small set of operational data (sessions, audit logs, rate-limit counters) needed to run the service securely.
4. Who we share it with
We don't sell your data. We share it only with the service providers that run Kiteloom on our behalf, each only for the purpose named:
- Convex — our database and backend runtime; stores your account, boards, and files.
- Vercel — hosts our web application.
- Railway — hosts the real-time collaboration server that syncs a board while you're editing it.
- Paddle — processes payments as our merchant of record. We never see or store your card details.
- Resend — sends transactional email (verification, invites, security alerts).
- Google — only if you choose "Sign in with Google," to authenticate you.
- Sentry — receives error reports so we can fix bugs. Scrubbed of personal data where possible.
- PostHog — product analytics, and only once you've given consent through our cookie banner.
- Upstash — powers abuse-prevention rate limiting; stores short-lived counters, not your content.
- Cloudflare — stores our encrypted backups.
We may also disclose data if required by law, or to protect the rights, safety, or security of Kiteloom, our users, or the public.
5. International transfers
6. How long we keep it
Retention periods vary by data category — the exact figure for each is in the Data Declaration's table, right next to what it's for.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data (rectification)
- Ask us to delete your data (erasure)
- Ask us to limit how we use it (restriction)
- Receive your data in a portable format (portability)
- Object to certain processing
- Withdraw consent at any time, where processing is based on consent
You can exercise most of these yourself: edit your profile or delete your account from Settings, or export a board from its export menu. For anything else, reach us through our contact pageand we'll respond as required by applicable law.
8. Automated decision-making
We don't use your personal data to make any automated decision that produces a legal or similarly significant effect on you.
9. Complaints
10. Children's data
Kiteloom is not directed at, and we do not knowingly collect data from, anyone under 16. If you believe a child has given us personal data, contact us and we'll delete it.
11. Cookies
See the cookie table on our Data Declaration page for exactly which cookies we set, why, and for how long.
12. Changes to this policy
We'll update the "Last updated" date and version number at the top of this page whenever this policy changes, and post a notice on our site for any change that materially reduces your rights.