Privacy Policy
Who we are
This site, kyvo-ai.com, is operated by Kyvo Private Limited ("Kyvo", "we", "us"). We decide why and how the personal data described here is processed — in GDPR terms we are the data controller, and in DPDP terms the data fiduciary.
Our address is:
- 304/5 M.G. Road, 2nd Floor
- Cowas Manzil, Camp
- Pune, Maharashtra 411001
- India
CIN: U62013PN2026PTC256202
What we collect
If you sign in with Google
Signing in is optional. If you use it, Google tells us your name, email address, profile picture and Google account identifier. We never see or receive your Google password, and we request no access to your Gmail, Drive, contacts or any other Google service — only the basic profile scopes openid, email and profile.
Once signed in, you can also fill in a profile under Your account. Every field is optional. If you fill them in, we store your name, mobile number, city, company, job title, industry and company website with your account, so the team knows who they are talking to and you don't have to retype them. You can change or clear them at any time.
If you contact us
When you submit the demo form or give your details in the chat assistant, we store what you provide: name, email address, phone number, company, industry and your message. If you used the chat assistant, the full transcript of that conversation is stored with your enquiry.
Automatically
We record the page you submitted from, the referring site, any campaign parameters in the URL (utm_*), and your browser's user agent string. Our hosting provider processes your IP address to serve the site and keeps short-lived server logs.
We use Google Analytics and PostHog to understand how the site is used. They collect pseudonymous usage events — pages viewed, features used, and your IP address. They do not receive your name or email address.
What we do not collect
We do not ask for or store payment details or government identifiers. We do not store passwords, because sign-in is handled entirely by Google.
Photos you upload to the demos
Our live studio demos let you see a product in your own space or on yourself. To do that, they ask you to upload a photograph:
- Stone Studio and Fabric Studio — a photo of a room, which may incidentally include people or personal surroundings.
- Frame Studio — a photo of your face, used to show frames on you and to estimate how well they fit.
- Ethnic Studio — a full-body photo, used to show an outfit on you.
What happens to it. The photo is sent to our image generation provider (fal.ai, listed below) to produce the rendered result, and the result is returned to you. A copy is kept in your own browser's storage on your own device, so the demo can show it again without asking you to upload it twice.
[REQUIRES CONFIRMATION — what happens to the photo after that has not yet been established, and this section deliberately makes no claim about it. Specifically unconfirmed: whether the uploaded photo is stored anywhere after the render completes; whether the generated image is stored; for how long, if so; what deletion is available to you; what fal.ai retains and for how long; whether fal.ai uses uploaded or generated images to train or improve models; and whether any other provider retains either image. All of this must be answered and stated plainly here before this page is published.]
Face and body measurements. Frame Studio estimates measurements from your photo — including the distance between your pupils — so it can tell you whether a frame is the right size. These are estimates derived from the photo, presented as estimates, and are used only to size and rank frames within that session. We do not use them to identify you, we do not match your face against any other photo or database, and we do not build a face profile that persists between sessions. [REQUIRES CONFIRMATION — whether this processing is treated as biometric data under GDPR art. 9 or the DPDP Act depends on purpose and on legal advice. It is described here factually; a lawyer should confirm the classification and whether explicit consent is required before this section is published.]
Please do not upload photographs of other people without their knowledge, or photographs of children.
Clearing it from your own device. Clearing your browser's site data for the demo removes the copy held on your device. That is the one deletion step available to you today; see the confirmation note above for what we cannot yet tell you.
If you apply for a job
When you apply through our careers page, we store what you provide: name, email address, phone number, city, the role you applied for, your experience, any links you add, your note, and your resume, along with the page you applied from and your browser's user agent. Your resume is stored in a private file store at our database provider (Supabase, listed below) that is not publicly accessible, and a link to it is emailed to our team through Resend.
We use this only to consider you for the role you applied for and for similar roles at Kyvo, and to contact you about your application. We do not use it for marketing and we do not share it outside Kyvo other than with the providers that store and deliver it. Legal basis: your consent, given when you submit the form, and steps taken at your request before entering an employment contract.
You can ask us at any time to delete your application and resume by writing to office@kyvo-ai.com. [REQUIRES CONFIRMATION — how long applications and resumes are kept when no deletion is requested has not been decided. It must be stated here before this section is published.]
Why we use it
- To answer your enquiry and arrange a demo. Legal basis: steps taken at your request prior to entering a contract, and our legitimate interest in responding to business enquiries.
- To keep you signed in and to save you retyping your details. Legal basis: your consent, given by choosing to sign in.
- To operate and secure the site, including rate limiting to prevent abuse of our public endpoints. Legal basis: our legitimate interest in keeping the service available and affordable to run.
- To understand how the site is used in aggregate. Legal basis: consent where required by local law, otherwise legitimate interest.
- To produce the visualisation or try-on you asked for from a photo you chose to upload. Legal basis: your consent, given by uploading the photo for that purpose.
We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.
Who we share it with
We use the service providers below to run this website. Each processes personal data on our behalf and only for the purpose shown.
| Provider | What it does | Data involved | Processing location |
|---|---|---|---|
| Google LLC | Sign-in with Google. Google authenticates you and tells us your name, email address and profile picture. We never receive your Google password. | Name, email address, profile picture, Google account identifier | United States, and other countries in which Google and its subprocessors operate |
| Supabase | Database hosting for account records and enquiries. | Account details and everything submitted through our forms and chat | Mumbai, India (AWS ap-south-1) |
| Vercel Inc. | Website and API hosting. Vercel processes every request in order to serve the site, and retains short-lived server logs. | IP address, request metadata, user agent | Mumbai, India (AWS bom1) |
| OpenRouter | Powers replies in the chat assistant by routing your messages to a large language model provider. | The contents of your chat messages | United States, and the country of the model provider that serves each request, which may be outside India and the EEA |
| Resend | Sends the automated emails a demo request triggers: the confirmation to you, and the notification to us. Resend receives the whole message in order to deliver it. | Name, email address, and everything submitted through the demo form or the chat gate | Virginia, United States (AWS us-east-1) |
| Google Analytics | Aggregate website usage statistics. | Pseudonymous usage events, IP address | United States, and other countries in which Google operates |
| PostHog | Product analytics — how features on the site are used. | Pseudonymous usage events, IP address | United States (PostHog Cloud US) |
| fal.ai | Generates the visualisations and virtual try-ons in the studio demos. Your uploaded photo is sent to fal.ai to produce the rendered image. | The room, face or full-body photo you upload, and the product images being applied to it | United States (AWS us-east-1) |
| Render | Hosting for the studio demos' application server. | IP address, request metadata, uploaded images in transit | Singapore |
| Langfuse | Records traces of AI requests so we can monitor quality and cost of the studio assistants. | Chat message contents and model request metadata | Frankfurt, Germany (Langfuse Cloud EU, AWS eu-central-1) |
Note on the chat assistant: messages you type into it are sent to a large language model provider through OpenRouter in order to generate a reply. Please do not enter confidential information or personal data about other people into the chat.
We may also disclose personal data where we are legally required to, or to establish or defend legal claims. If Kyvo is involved in a merger, acquisition or sale of assets, personal data may transfer as part of that transaction.
International transfers
Some of the providers above process data outside your country. Where personal data is transferred out of the EEA or the UK, that transfer relies on an adequacy decision or on Standard Contractual Clauses with the provider concerned. Contact us for details of the safeguards applying to a specific provider.
Cookies and browser storage
We use the following cookies. The sign-in cookies are only set if you actually sign in — browsing the site without signing in sets none of them.
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
kyvo_session | Keeps you signed in. Contains your name, email address and profile picture, cryptographically signed so it cannot be altered. | 30 days, extended while you keep using the site (maximum 1 year) | Strictly necessary (only set if you sign in) |
kyvo_user | A readable copy of your name and picture so the site can show you as signed in without a delay. | Same as kyvo_session | Strictly necessary (only set if you sign in) |
Google Analytics / PostHog cookies | Set by our analytics providers to measure site usage. | Varies by provider | Analytics |
You can delete cookies at any time in your browser settings. Removing the sign-in cookies signs you out.
Browser storage
We also use storage built into your browser. This is not a cookie: it stays on your device, is not sent to us with every request, and is not always removed by a "clear cookies" action — you may need to clear site data instead.
| What | Purpose | How long |
|---|---|---|
| Session storage (kyvo-ai.com) | Remembers, for the current browser tab only, that your sign-in state has already been checked — so the page does not re-check it on every navigation. | Cleared when you close the tab |
| Session storage (kyvo-ai.com), first visit | Remembers how you arrived on the first page of your visit (the referring site, any campaign parameters in the link, and that first page) so an enquiry or sign-in later in the same visit can be credited to it. | Cleared when you close the tab |
| Local storage (studio demos) | Holds a randomly generated identifier for your demo session so the assistant can follow the conversation from one page load to the next. The identifier is a random value and says nothing about you; the conversation itself is kept on our servers against it, not in your browser. | Remains until you clear your browser's site data. Starting a demo over replaces the identifier with a new one rather than removing it. |
[REQUIRES CONFIRMATION — analytics cookies are not strictly necessary, and there is currently no consent mechanism on the site. If Kyvo targets or monitors visitors in the EU or UK, one is required before analytics is served to them. This must be resolved before this version is connected to the live site.]
How long we keep it
These periods are enforced automatically by a scheduled job, not by someone remembering to run one.
- Enquiries: Kept for 2 years from the date you contacted us, then automatically removed. Removal means the personal details — your name, email, phone number, message and any chat transcript — are erased; an anonymous record that an enquiry happened is retained for business reporting.
- Account records: Removed automatically after 2 years without signing in, or immediately whenever you delete your account yourself.
- Sign-in sessions: a session lasts 30 days and is extended while you keep using the site, up to a maximum of one year from sign-in, after which you must sign in again.
- Server logs: retained by our hosting provider for a short period for security and debugging.
- Photos uploaded to the demos, and the images generated from them: [REQUIRES CONFIRMATION — not yet established. See the section on photos above. No retention period is stated here because none has been confirmed, and this page will not assert one until it has.]
How we protect it
The site is served entirely over HTTPS. Sign-in cookies are marked HttpOnly, Secure and SameSite=Lax, and are cryptographically signed so their contents cannot be altered. Database access uses a credential held only on our servers — no database credential is ever sent to your browser — and the tables holding your data have row-level security enabled with no public access policies.
No system is perfectly secure, and we cannot guarantee absolute security. We do not claim certification against any particular security standard.
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Delete your data ("right to erasure")
- Receive a copy in a portable, machine-readable format
- Object to or restrict processing based on legitimate interests
- Withdraw consent at any time, without affecting processing already carried out
To exercise any of these, email office@kyvo-ai.com. Access and deletion can also be done instantly and without contacting us — see below.
If you are in the EEA or UK and believe we have handled your data improperly, you may complain to your local supervisory authority. We would appreciate the chance to address it first.
If you are in India, you may raise a grievance with us at the address above under the Digital Personal Data Protection Act, 2023, and escalate to the Data Protection Board of India if it is not resolved.
Getting a copy of your data, and deleting it
If you have signed in, open the account menu in the top-right of the site and choose Your account:
- Your profile shows the details you have given us, and you can correct or clear any of them there.
- Delete my account permanently removes your account record and profile. Your past enquiries are stripped of personal information — name, email, phone, message and chat transcript — while the anonymous business record of the enquiry is retained. This cannot be undone.
For a full copy of everything we hold about you, or if you contacted us without signing in, email office@kyvo-ai.com and we will handle the request.
Children
This is a business-to-business website and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
We may update this policy. The effective date and version at the top of this page always reflect the current version. Material changes will be communicated by a notice on the site.
Contact us
For any privacy question or request: office@kyvo-ai.com, or write to Kyvo Private Limited at the registered address above.
See also our Terms of Use.