Privacy Policy
1. Data controller
The data controller for Kyvel is Koi Wave Labs, VAT/Tax ID (P.IVA/CF) 05792360280, registered office at Via della costituzione, 31, Vigonza, Italy.
Contact for any privacy matter: info@koiwavelabs.com.
2. Data we collect
Account data. When you create an account we collect your email address. If you sign in with Google, we also receive your name and profile picture from your Google account. We never see or store your Google password.
Billing data. Payments are processed entirely by Stripe. We receive your subscription status, plan and invoicing details; your full card number never touches our systems.
Usage and preference data. Settings you save in the product (watchlists, collections, notes, notification and onboarding preferences), and the record of your acceptance of our Terms of Service and this Privacy Policy (document version, date, sign-up method).
Support communications. If you email us, we keep the correspondence.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service, authentication, saving your preferences | Art. 6(1)(b) — performance of a contract |
| Billing and invoicing | Art. 6(1)(c) — legal obligation |
| Service security, abuse prevention, aggregate product analytics | Art. 6(1)(f) — legitimate interest |
| Transactional email (account confirmations, password resets, digests you enabled) | Art. 6(1)(b) — performance of a contract |
We do not sell personal data and we do not use it for third-party advertising.
4. Processing of public web content
Kyvel's core function is analysing publicly available posts and conversations from the open web to extract aggregated market insights ("need clusters"). These public posts may incidentally contain personal data (for example a username or details the author chose to publish).
- Legal basis: legitimate interest (Art. 6(1)(f)) in producing aggregated, statistical market research from information the authors made public.
- Minimisation: our pipeline extracts the need expressed in a post, not the identity of its author. Insights shown in the product are aggregated across many posts; evidence links point back to the original public source rather than copying profiles.
- Information duty: given that content is collected at scale from public sources, informing each author individually would involve disproportionate effort (Art. 14(5)(b)); this policy serves as the public notice.
- Objection: if you are the author of a public post processed by Kyvel and wish to object (Art. 21) or request erasure, contact info@koiwavelabs.com and we will remove the related content from our systems.
5. Processors and recipients
We share data only with the service providers needed to run Kyvel, under data-processing agreements:
| Provider | Role |
|---|---|
| Supabase | Database and authentication hosting |
| Vercel | Application hosting and cookieless analytics |
| Stripe | Payment processing |
| "Sign in with Google" authentication | |
| Resend | Transactional email delivery |
| Google (Gemini API) | LLM processing of public web content and generation of reports |
| DataForSEO | Search-volume data (no personal data of our users is sent) |
6. International transfers
Some providers process data outside the EU/EEA (primarily in the United States). Where that happens, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
7. Retention
Account and preference data are kept for as long as your account exists and deleted when the account is deleted. Billing records are kept for the period required by tax law (10 years in Italy). Aggregated market insights contain no user personal data and may be retained indefinitely.
8. Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to info@koiwavelabs.com; we reply within 30 days. You can also lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
9. Changes to this policy
We may update this policy as the product evolves. Material changes will be announced in the product; the "Last updated" date below always reflects the current version.