Privacy Policy

1. Information we collect

Account information: an email address and profile identifiers provided when you register or sign in through a third-party provider.

Memory content: the notes, summaries, tags, and related data that you or your connected AI agents choose to save. This content leaves your device and is stored on our servers.

Billing records (once paid plans are open): records we receive from Paddle about your purchase. These are the Paddle customer, subscription and transaction identifiers, your plan, subscription status and billing period, amounts and currency, and refunds or chargebacks. We do not store card numbers, other payment-method details, or billing addresses. See section 3.

Daily save counts: the number of new memories saved each day, used to apply plan limits.

Cookies and similar technologies: section 10 lists what they store and how to refuse them.

Usage and technical data: logs such as timestamps, request metadata, approximate location from IP, and diagnostic information used to operate and secure the Service.

2. How we use information and our legal bases

To provide the Service: to store your content, index and embed it, build and query the knowledge graph, and return results to you and the teammates, projects, or agents you authorize. Legal basis: performing our contract with you.

To bill you and apply your plan: to apply plans and limits, answer billing questions, and prevent duplicate charges. Legal basis: performing our contract with you.

To keep accounting and tax records: to keep the payment records the law requires. Legal basis: complying with our legal obligations.

To operate, secure, and improve the Service, including preventing abuse and debugging. Legal basis: our legitimate interest in running the Service safely and improving it.

To send service notices about your account, security, plan, or changes to our terms. Legal basis: performing our contract with you and complying with our legal obligations.

To measure our ads on the marketing site with the Google tag (section 10). Legal basis: your consent, where the law requires consent.

We do not sell your personal information, and we do not use your memory content to train third-party foundation models.

3. Service providers and payments

We use trusted providers for hosting, storage, and generating the vector embeddings needed to search your content. They process data on our behalf under confidentiality and security obligations, only as needed to run the Service.

Paid plans are sold through our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders, which means Paddle is the seller in your purchase. Paddle collects your payment details, billing address and tax information directly from you and handles them under its own terms and privacy policy, not on our instructions.

To start a purchase, the only personal information we send Paddle is your account email address and an internal identifier. Paddle sends us notifications about your subscription, payments, refunds and chargebacks, and we read the same records from Paddle when we need to check a purchase. These notifications can include limited payment details, such as the cardholder name and the last four digits of a card. We discard those when we receive them and do not store or log them. We keep only the billing records listed in section 1.

4. Sharing

Your content is shared only within the teams, projects, and domains you configure, and with agents you connect. Content you choose to make public is published as you chose.

Apart from that, we share personal information only with: the service providers in section 3; Paddle, as Merchant of Record for paid plans; professional advisers such as lawyers and accountants, under duties of confidentiality, where needed; and authorities, courts or others where the law requires it or where it is needed to protect the Service, its users, or the public.

If we are ever involved in a merger or acquisition, information may transfer as part of that transaction, subject to this Policy.

5. Retention and deletion

We keep your content until you delete it or close your account. The console lets you view, export, and delete your content and projects.

Memories in a personal or team memory that has not been used for a long time, or whose payment stopped, may be moved to a separate archive in the Service under the criteria in section 5 of our Terms of Service, and may be deleted three years after they were archived. You can still ask to access, download (port) or delete archived memories.

When you ask to delete your account, we delete your account information and the memories in your personal memory after a set period (currently 30 days), and you can cancel the request before then (section 9 of our Terms of Service). Memories you saved in a team memory owned by someone else belong to that team, so they stay in that team after your account is deleted.

When you request deletion, we remove the content from active systems within a reasonable period; short-lived backups are overwritten on their normal cycle. Some records may be retained where required by law.

Billing records are kept for 5 years, also after your account is deleted, to handle refunds and disputes and to meet accounting and tax obligations. This follows the retention period for payment records under Korea’s Act on the Consumer Protection in Electronic Commerce. Billing records contain identifiers, dates and amounts, not your content.

6. Security

We use technical and organizational measures to protect your data. No system is perfectly secure, so we cannot guarantee absolute security; please use a strong, unique credential and save only what you intend to store.

7. Your rights

Depending on where you live (for example, in the European Economic Area, the United Kingdom or Korea), you may have the right to: access your personal information; correct it; delete it; restrict how we process it; receive it in a portable format; object to processing based on our legitimate interests; withdraw your consent at any time where processing is based on consent (this does not affect processing before you withdraw); and complain to a data protection supervisory authority (in Korea, the Personal Information Protection Commission).

You can view, export, and delete most of your information directly in the console. For other requests, email [email protected]. We respond within one month of receiving your request. If a request is complex or we receive many, we may extend this period as the law allows and will tell you why. We may ask for information to confirm that the request comes from you.

Records the law requires us to keep, such as the billing records in section 5, may be kept for that period even if you ask us to delete them.

8. International transfers

Our service providers may process and store data outside the Republic of Korea, including in the United States. Where they do, we protect the data through contractual safeguards with those providers, such as data processing terms, and other safeguards the law requires.

9. Children

The Service is not directed to children below the age of digital consent in their jurisdiction, and we do not knowingly collect their personal information.

10. Cookies and ad measurement

We use cookies and similar technologies that store small amounts of data in your browser. They serve the three purposes below and nothing else.

Strictly necessary: a session cookie that keeps you signed in to the console (app.aiakiv.com). Blocking it prevents sign-in.

Preferences: the colour theme you pick on the marketing site (www.aiakiv.com) is kept in browser local storage and is never sent to our servers.

Ad measurement: the marketing site alone loads the Google tag (gtag.js) so that a visit can be tied back to a click on an ad we run on Google. Google sets its own cookies (for example _gcl_au) and reads the ad-click identifier, acting as an independent controller for that processing. The signed-in console does not carry this tag.

Ad click ID: only if you choose “Accept” in the cookie banner, we keep the Google ad click ID and the time you arrived from that ad in a cookie on aiakiv.com (k2g_ads_click) for 90 days. If you later sign up through an AI client and first open the console (app.aiakiv.com), we read this cookie, link it to your new account, and report the signup to Google Ads as a conversion (the ad click ID and the signup time). We do not send your name or email address. Google processes what it receives as an independent controller.

How to refuse: choose “Decline” in the marketing site's cookie banner, or withdraw consent at any time under “Cookie settings” in the footer; withdrawing deletes the ad click ID cookie right away. You can also block or delete cookies in your browser settings, and turn off Google's ad personalization at google.com/settings/ads. Blocking strictly necessary cookies will break sign-in and other features.

We do not display third-party advertising in the Service.

11. Changes to this Policy

We may update this Policy. We will update the date above and, for material changes, provide notice where appropriate.