Privacy Policy

This Privacy Policy explains how Kyndium LLC, a limited liability company registered in the Commonwealth of Virginia (“Kyndium,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you use kyndium.com and the Kyndium application (collectively, the “Service”).

We are the data controller for information processed under this policy. If you have questions, contact us at privacy@kyndium.com.

By using the Service, you acknowledge you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

We collect personal information in three ways: information you provide directly, information generated automatically, and information from third-party services you connect.

We do not collect: Social Security numbers, government ID numbers, financial account credentials, or health information.

Directly from you — when you create an account, fill in your profile, create projects and tasks, communicate with us, or respond to surveys.

Automatically — when you use the Service, we receive technical information such as your IP address, browser characteristics, pages visited, and time spent. This happens through server logs, cookies, and (if you consent) analytics tools. See our Cookie Policy for details.

From third parties — if you sign up via an OAuth provider (e.g. Google) we receive the information that provider shares per your authorization. Payment information is handled by Stripe and we receive only a tokenized reference, never full card details.

We use your personal information to:

(a) create and manage your Account and authenticate your sessions;

(b) deliver, operate, maintain, and improve the Service;

(c) process payments and manage your Subscription;

(d) send transactional communications — password resets, billing receipts, security alerts, and service notices (these cannot be opted out of while you hold an Account);

(e) send product update emails and newsletters (you may opt out at any time);

(f) analyze aggregate usage patterns to improve product features (only with your consent for analytics cookies);

(g) investigate and prevent fraud, abuse, and security incidents;

(h) comply with applicable laws, regulations, and legal process;

(i) enforce our Terms of Service and other policies.

We do not sell your personal information to third parties. We do not use your personal information for targeted advertising. We do not use your Content to train AI or machine learning models without your separate, explicit consent.

Sub-processors. We share your information with trusted service providers who process it on our behalf, subject to confidentiality obligations:

Other users. Content you share within a project (tasks, comments, files) is visible to other project members at the permission level you grant them. Public share links make a read-only view of your project accessible to anyone with the link.

Business transfers. If Kyndium LLC is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will provide notice before your information is subject to a different privacy policy.

Legal requirements. We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Kyndium, our users, or others.

We retain your personal information for as long as your Account is active plus a 30-day grace period to allow data export after deletion. Consent records are retained for 5 years for compliance purposes. Server access logs are purged after 90 days. Analytics data is subject to Google Analytics 4's 26-month default retention period (if analytics consent is granted).

When we no longer need personal information, we delete or anonymize it securely. Some residual information may remain in encrypted backups for up to 90 additional days before those backups are overwritten.

We implement industry-standard technical and organizational measures to protect your personal information, including:

• TLS encryption for all data in transit between your browser and our servers

• Row-Level Security (RLS) policies in our database ensuring your data is only accessible to your authenticated session

• Hashed password storage via Supabase Auth (bcrypt)

• Principle of least privilege for internal system access

• Regular security reviews of dependencies and configurations

Despite these measures, no security system is impenetrable. If you believe your Account has been compromised, contact us immediately at security@kyndium.com.

Depending on your state of residence, you may have the following rights regarding your personal information. To exercise any of these rights, email privacy@kyndium.com from the address associated with your Account. We will respond within 45 days (extensions permitted by applicable law will be communicated to you).

Right to Know / Access. You may request a copy of the personal information we hold about you and how it is used.

Right to Correct. You may update most of your personal information directly in your account settings. For corrections we cannot make available in-app, contact us.

Right to Delete. You may request deletion of your Account and associated personal information. We will process the request within 30 days, subject to exceptions required by law (e.g., financial records, consent audit logs).

Right to Data Portability. You can export all of your project data at any time via the “Export” function within any project (JSON or CSV format). You may also request a full data export by emailing us.

Right to Opt Out of Sale / Sharing. We do not sell or share personal information for cross-context behavioral advertising. No opt-out is necessary, but you may contact us to confirm.

Virginia residents have rights under the Virginia Consumer Data Protection Act (VCDPA), including the rights above plus the right to appeal a denial of your request. To appeal, email privacy@kyndium.comwith “VCDPA Appeal” in the subject line.

California residents have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know categories of information shared with third parties and the right to non-discrimination for exercising your rights.

We will never discriminate against you for exercising your privacy rights.

We use cookies and similar technologies to operate the Service, remember your preferences, and (with your consent) analyze usage. Our Cookie Policy describes every cookie we set, its purpose, and how to control it.

You can manage your cookie preferences at any time through the cookie settings panel accessible from the footer of any page.

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child under 16 has created an Account, contact us at privacy@kyndium.com and we will promptly delete the Account and all associated data.

The Service may contain links to third-party websites or integrations. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party site you visit through links on the Service.

We may update this Privacy Policy periodically. When we make material changes (new categories of data collected, new purposes for processing, new third-party recipients), we will:

(a) update the “Effective” date at the top of this page;

(b) notify registered users by email at least 14 days before changes take effect;

(c) where consent is the legal basis, re-request consent before processing under the new terms.

Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

For privacy questions, data requests, or to exercise your rights:

Email: privacy@kyndium.com

General enquiries: hello@kyndium.com

We aim to acknowledge all privacy requests within 5 business days and respond substantively within 45 days.