Privacy Policy

1. Who we are#

This Privacy Policy explains how KaiBuild ("we", "us") collects and processes personal data when you use our website builder and related services (the "Service").

We operate from Surat, India, and serve customers worldwide. Sections 5 to 8 say what applies where you are; everything else in this policy applies to everyone.

Privacy questions and requests: Krushang Vachhiyat at [email protected].

Two different relationships#

Read this policy knowing which of two things you are. If you have an account with us — you sign in, you build sites, you pay us — then this policy is about you, and we are the one who decides what happens to your data.

If you are visiting a website that one of our customers built and published with us, we hold your data on their instructions, not our own. Their privacy notice governs it, and a request about it is theirs to answer. We help them answer it. The split is set out in the DPA & Subprocessors page.

2. Data we collect#

Everything below is something the Service actually stores or sends somewhere. Where a category depends on a feature you have to switch on yourself, it says so.

• Account data: your email address, your name and profile picture as Google returns them, the Google account identifier that links your sign-in to your account, your role, and which workspace you belong to. Sign-in is Google-only, so we never receive or store a password.
• Session data: a signed session token in a cookie, which is how the Service knows you are you between page loads. See the Cookie Policy for its name and lifetime.
• Guest builder sessions: if you try the builder before signing up, we create an anonymous session identified by a cookie, and count how many prompts it has used so the free allowance can be enforced. We store a salted one-way hash of the IP address that started it, not the address itself.
• Billing and plan data: your plan, subscription status, credit balance and any negotiated price. Card details are entered with Dodo Payments and never reach our servers — we hold references and status, not payment instruments.
• Site and content data: the sites, pages, sections, media and settings you create; the published versions we serve; the backups and version history behind them; and the prompts and chat transcripts of your conversations with the building agent.
• Usage counters: for each published site we count requests served and bytes sent, per billing cycle, so that plan limits can be enforced and shown to you. These are counts, not visitor records.
• Form submissions on your published sites: when a visitor fills in a form on a site you published, we store what they typed, which form and site it came from, the time, and a salted one-way hash of their IP address. This is your data, held for you — see section 2.1 and the DPA.
• Anti-abuse counters: to stop a script filling a customer's inbox, we keep a per-day count of public form submissions keyed by IP address. It is used for rate limiting and nothing else, and it is not joined to any submission.
• Communications: emails you send us — support, billing, grievances and abuse reports — and our replies.
• Security signals: when you use guest compose, Cloudflare Turnstile may process client signals (such as IP address, TLS fingerprint, User-Agent, and site key) to distinguish humans from bots. See section 3.
• Diagnostics and server logs: ordinary web-server and application logs — request paths, status codes, timings, error traces. They exist to keep the Service running and to investigate incidents. We do not build a profile of you from them.
• Cookies and local storage: named individually in the Cookie Policy, which lists every one we set and what it is for.

2.1 What we do not collect#

• No passwords. Google is the only sign-in method, so there is no credential of ours to lose.
• No card numbers. Payment details are entered with Dodo Payments on their surface.
• No advertising profile. We run no advertising pixels. If that ever changes, it changes here first and behind consent.
• Analytics only with consent. When Google Analytics (GA4) or PostHog is configured, those scripts load only after you opt in via the cookie banner. Without that consent, no analytics script runs.
• We do not sell personal data, and we do not use your site content to train anyone's models. See the AI Disclosure for exactly what reaches an AI provider and why.

3. Cloudflare Turnstile (bot protection)#

KaiBuild uses Cloudflare Turnstile in invisible mode on guest compose and certain public forms. Turnstile runs silently in the background when you submit a prompt or form — there is no visible checkbox or puzzle unless Cloudflare requires an additional challenge.

Turnstile processes minimal client-side signals solely to detect and block automated abuse. Cloudflare states it does not use Turnstile to directly identify individuals from those signals. For details on what Turnstile collects, how Cloudflare uses it, and your rights, see the Turnstile Privacy Addendum (supplemental to Cloudflare's Privacy Policy). For privacy questions about Turnstile data processed on our behalf, contact us at [email protected]; for questions about Cloudflare's own processing to improve Turnstile, contact Cloudflare's Data Protection Officer at [email protected].

Bot protection on your own site is yours, not ours. Forms on a site you publish use the captcha keys you enter in your site settings — your Turnstile or hCaptcha account, your relationship with that provider. Until you configure one, no captcha provider is called for your site's forms at all. We do not silently put our keys in front of your visitors.

4. Why we use your data#

These are the reasons we process personal data, wherever you are. The legal label attached to each reason differs by country — the sections that follow give the labels that apply to you — but the reasons themselves do not change.

• Contract — providing the Service, authentication, hosting your sites, billing, and support.
• Legitimate interests — security, fraud prevention, product improvement, and essential operations (balanced against your rights).
• Consent — non-essential cookies/analytics/marketing (PECR / UK GDPR); optional communications where required.
• Legal obligation — tax, accounting, and responding to lawful requests.

We do not sell personal data, and we do not use your site content to train models for anyone else. See the AI Disclosure for what reaches an AI provider and why.

Automated processing#

The building agent generates and edits site content automatically. It writes copy and chooses layouts; it does not make decisions about you — it does not price you, score you, or decide whether you may hold an account. The two automated decisions the Service does make are mechanical: whether a plan limit has been reached, and whether a submission looks like a bot. Both are appealable by writing to [email protected], and a person will look.

5. India#

We operate from Surat, India, so Indian data-protection law applies to our processing. In its terms, we are the entity that decides why and how your personal data is handled.

• We tell you what we collect and why at the point we collect it, and we process it only for those purposes.
• Where we rely on your consent, you can withdraw it at any time. That does not undo processing already carried out, and withdrawing consent needed to run the Service means we can no longer provide it.
• You can ask for access to your data, correction of anything wrong, and erasure where we are not required to keep it.
• You can nominate someone to exercise these rights on your behalf if you are unable to.
• You can ask what we have shared with a third party in connection with your account, and section 9 lists every provider we use with the reason we use it.

Grievances go to Krushang Vachhiyat at [email protected]. We acknowledge within 24 hours and aim to resolve within 15 days. That is a commitment we make, not a summary of a statute — if the law requires us to be faster, the law wins and this page changes.

6. If you are in the EEA or the UK#

Where the GDPR or UK GDPR applies to you, the reasons in section 4 map to these legal bases:

• Contract — providing the Service, authentication, hosting your sites, billing, and support.
• Legitimate interests — security, fraud prevention, product improvement, and essential operations, balanced against your rights.
• Consent — non-essential cookies, analytics, and optional communications.
• Legal obligation — tax, accounting, and lawful requests.

You have the rights in section 12, including the right to object to processing we base on legitimate interests and the right to receive your data in a portable form. Withdrawing consent is as easy as giving it, and does not affect processing already done.

You may complain to the supervisory authority in your own country. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA it is your national data protection authority. We would rather you wrote to us first — but that is a preference, not a condition, and nothing here requires you to exhaust us before going to a regulator.

We are established in India and have not appointed a representative in the EEA or the UK. If a reviewer tells us one is required for the processing we actually do, we will appoint one and name them here.

7. If you are in the United States#

If you are a California resident (or resident of another US state with similar privacy laws), you may have rights to know, access, correct, delete, and opt out of certain sharing of personal information.

• We collect the categories listed in section 2 for the business purposes described in section 4, and we disclose them to the service providers in section 9 for those purposes only.
• We do not sell personal information for money. If we engage in "sharing" for cross-context behavioral advertising (e.g. future ad pixels), we will offer an opt-out and honor Global Privacy Control (GPC) signals as an opt-out of sale/share where required.
• We do not use sensitive personal information for purposes that require a right to limit beyond what is necessary to provide the Service, except with appropriate notice/consent where required.
• To exercise rights, email [email protected]. We will verify your request and respond within applicable timelines. You will not be discriminated against for exercising privacy rights — no worse price, no worse service.
• An authorised agent may make a request for you. We will ask for proof that you authorised them, because otherwise the request is a way to get at your data rather than a way to protect it.

8. If you are somewhere else#

The sections above name three regimes because they are the ones with detailed rules, not because they are the only customers we have. If you are somewhere else, everything in this policy still applies to you: we collect what section 2 lists, for the reasons in section 4, we keep it for the periods in section 11, and you can exercise the rights in section 12 by writing to [email protected]. Where your own law gives you more than that, it applies too.

We do not answer a request differently because of the passport of the person making it. The response commitment in section 5 is the one we apply to everybody.

9. Processors and sharing#

We use a small number of providers to run the Service. Each one is listed here with what it is used for, because a name on its own tells you nothing. The same list, with the processor terms attached, is on the DPA & Subprocessors page.

• Google — sign-in. Google authenticates you and returns your email, name, profile picture and an account identifier. This is the only way to sign in, so using the Service means using Google for it.
• Google Analytics (GA4) — usage measurement on the marketing site, only after you opt in to Analytics cookies. Page URLs and device/browser signals may be sent to Google for reporting.
• PostHog — product analytics (page views, feature usage), only after you opt in to Analytics cookies. Event data is sent to PostHog's US cloud.
• Dodo Payments — checkout, subscriptions, invoices and the customer billing portal. Card details go to them, not to us.
• Amazon Web Services — the servers the Service runs on and the storage its data sits in.
• Cloudflare — DNS, TLS, delivery of published sites, and Turnstile bot protection on our own guest compose flow.
• SendGrid — delivery of transactional email: receipts, plan notices, and the alert that tells you a form on your site was filled in.
• OpenAI — the models that plan, write and edit site content, and that build the search index over our component library. Your prompts and the text of the site being built reach them.
• Google (Gemini) — image generation, when that feature is enabled. Only the image prompt is sent.
• Sentry — error monitoring. Provisioned but not currently active: with no reporting key configured, error capture is a no-op and nothing leaves the Service through it. We will update this page before switching it on.

Beyond these, we share personal data only when the law requires it, to establish or defend a legal claim, or to act on an abuse report — and in that last case only the minimum needed to act. See the Acceptable Use Policy.

If we are ever bought, merged, or reorganised, your data moves with the Service and this policy travels with it. We will say so before it happens, not after.

10. International transfers#

We operate from India, and the providers listed in section 9 operate in the United States, the EEA, the UK and elsewhere. Your data will therefore cross borders in the course of running the Service.

Where the law that applies to you requires safeguards for a transfer — Standard Contractual Clauses, the UK Addendum, an adequacy decision, or an equivalent — we rely on the appropriate mechanism for each provider. Where your law restricts transfers to particular countries, we honour that restriction.

Two things we undertake regardless of which mechanism applies. We do not move data to a provider that will not accept processor obligations in writing. And where you tell us your own rules restrict where a particular category of data may go, we will tell you honestly whether we can meet that before you rely on us, rather than after.

11. Retention#

How long each kind of data lives. Where something is deleted automatically, the table says so; where it is deleted on request, it says that instead, because a policy that promises an automatic purge nobody built is a promise that will be broken quietly.

Where a period above is longer than you would like, ask. We would rather delete something early than hold it because nobody asked.

12. Your rights#

Wherever you are, you can ask us to give you a copy of your data, correct anything wrong, delete it where we are not required to keep it, restrict or object to particular processing, or hand it over in a portable form. Where we rely on consent, you can withdraw it.

How to make a request. Write to [email protected] from the address on your account, say what you want, and name the account or site it concerns. There is no form to fill in and no fee. We acknowledge within 24 hours and aim to resolve within 15 days. If a request is genuinely complicated we will tell you that, and why, inside that window rather than after it.

We may need to verify who you are first. An account's data is not something we hand to whoever asks for it, and the easiest way to steal someone's data is to ask for it politely. Usually replying from the account's own email address is enough.

If your request is about a site we host for someone else — you filled in a contact form on a customer's website, say — send it to that business. They decide; we act on their instruction. If you cannot reach them, write to us anyway and we will pass it on and tell you we have.

If your own country gives you a right not listed here, or a regulator to complain to, that stands alongside this section. Sections 5 to 8 name the specific routes we know about.

13. Children#

The Service is not directed to children under 16 (or the higher age required in your jurisdiction). We do not knowingly collect their personal data, and we do not offer accounts to them.

If you believe a child has an account or that a child's data has reached us through one, write to [email protected] and we will remove it. We will not ask you to prove your case first.

If you build a site aimed at children, the obligations that come with that are yours — you decide what your site collects. Say so in your own privacy notice and tell us, so we can tell you honestly whether the Service is a good fit.

14. Security#

These are measures that exist in the Service today, not aspirations. We hold no security certification, and we do not claim one.

• No password to lose. Sign-in is delegated to Google.
• Session cookies are locked down — not readable by page scripts, sent only on same-site navigation, and marked secure in production.
• Traffic is served over HTTPS between your browser and us.
• IP addresses attached to a form submission or a guest session are hashed with a secret salt before storage, so the stored value cannot be read back as an address.
• Captcha secrets you configure are never sent to a browser — the public part of your configuration and the secret part are separated in code, and a test holds that separation in place.
• Identifiers taken from a URL are sanitised before they are used to locate stored data, so a crafted request cannot reach another site's files.
• Administrative surfaces are restricted to a privileged role. Where support needs to view an account, it is done with a signed token that expires after two hours and records who acted.
• Public form submissions are capped per IP per day, so a script cannot flood a customer's inbox.

If something goes wrong. We undertake to investigate any suspected breach of personal data immediately, to tell affected customers what happened, what data was involved and what we are doing about it as soon as we have facts worth telling rather than speculation, and to notify any regulator that requires it. We have not published a fixed notification deadline, because a deadline nobody has checked against the law that binds us would be a number rather than a promise. The undertaking to tell you is the promise.

No method of transmission or storage is completely secure, and anyone who tells you otherwise is selling something.

15. Changes#

We may update this policy. Every version carries a version number and an effective date at the top of this page. Material changes will be reflected there and, where appropriate, by additional notice in-product before they take effect.

Where a change would need your consent, we will ask for it rather than assume it from your continued use.

16. Contact#

Krushang Vachhiyat, 3/2392, Salabatpura, Surat 395003, Gujarat, India — [email protected]. A real person reads that address.