← Back to Home

Privacy Policy

Last Updated: 1 October 2026

🔒 Your Privacy Matters

At KITT-AI, we take your privacy seriously. This policy explains what data we collect, how we use it, and your rights regarding your personal information.

We do not sell your personal data to third parties.

Service provider

KITT-AI (kitt-ai.app) is operated by CODELABS STUDIO, S.L., CIF B88708797, Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain. Contact: [email protected].

1. Information We Collect

1.1 Information You Provide

Data Type Purpose Required
Email address Account creation, authentication, communications Yes
Name Personalization, account management Optional
Payment information Processing subscriptions (via Stripe) For paid tiers
Profile preferences Language, settings, personalization Optional

1.2 Information Automatically Collected

Data Type Purpose
Device information Browser type, OS, device model for compatibility
Usage data Features used, session duration, interaction patterns
IP address Security, fraud prevention, approximate location
Cookies & local storage Session management, preferences, analytics

1.3 Conversation Data

When you interact with KITT-AI:

  • Text conversations: Stored to provide service continuity and improve AI responses
  • Voice recordings: Processed in real-time for speech-to-text, not permanently stored
  • Conversation history: Retained in your account for up to 90 days (deletable anytime)

2. How We Use Your Information

2.1 Primary Uses

  • Service Delivery: Process AI requests, generate responses, maintain conversation context
  • Account Management: Authentication, subscription management, billing
  • Communication: Service updates, billing notifications, support responses
  • Improvement: Analyze usage patterns to enhance features and fix bugs
  • Security: Detect fraud, prevent abuse, ensure system integrity

2.2 AI Processing

Your conversation data is processed by:

  • OpenAI (GPT-4o-mini, Whisper, gpt-4o-mini-tts): Speech recognition, text generation and voice synthesis of the answers

These providers have their own privacy policies. We have data processing agreements in place to protect your information.

3. Data Sharing and Disclosure

3.1 Third-Party Service Providers

We share data only with trusted partners necessary to operate the Service:

Provider Purpose Data Shared
OpenAI AI conversation processing and voice synthesis Voice recordings and typed messages, answer text, usage metadata
Stripe Payment processing Payment details, purchased pack
Keycloak Authentication Account data, preferences
Analytics providers Usage analytics Anonymized usage patterns

3.2 Legal Requirements

We may disclose information if required by law or in response to:

  • Valid legal processes (subpoenas, court orders)
  • Requests from government authorities
  • Protection of our rights, safety, or property
  • Investigation of fraud or security issues

3.3 Business Transfers

If KITT-AI is acquired or merged, your data may be transferred to the new entity. We will notify you of any such change.

4. Data Security

4.1 Security Measures

We implement industry-standard security practices:

  • Encryption: All data transmitted via HTTPS/TLS
  • Database Security: Encrypted at rest, access controls
  • Authentication: Secure password hashing, optional 2FA
  • Access Controls: Limited employee access on need-to-know basis
  • Monitoring: Automated security scanning and alerts

4.2 Data Breaches

In the unlikely event of a data breach, we will:

  • Notify affected users within 72 hours
  • Report to relevant authorities as required
  • Provide details about the breach and mitigation steps

5. Data Retention

Data Type Retention Period
Account information Until account deletion + 30 days
Conversation history 90 days (user-deletable)
Payment records 7 years (legal requirement)
Usage analytics 24 months
Support tickets 3 years

6. Your Rights (GDPR & CCPA)

6.1 Access and Control

You have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate information
  • Deletion: Request deletion of your data ("right to be forgotten")
  • Portability: Receive your data in machine-readable format
  • Opt-out: Unsubscribe from marketing communications
  • Restriction: Limit how we process your data
  • Object: Object to certain data processing activities

6.2 California Residents (CCPA)

California residents have additional rights:

  • Right to know what personal information is collected
  • Right to know if personal information is sold (we don't sell data)
  • Right to delete personal information
  • Right to opt-out of sale (not applicable)
  • Right to non-discrimination for exercising CCPA rights

6.3 Exercising Your Rights

To exercise your rights, contact us at [email protected] or through your account settings. We will respond within 30 days.

7. Cookies and Tracking

7.1 Types of Cookies

Cookie Type Purpose Required
Essential Authentication, security, basic functionality Yes
Functional Remember preferences, language settings Optional
Analytics Understand usage patterns, improve service Optional
Marketing Meta pixel, to measure the effectiveness of our ads (only after you accept “Advertising”) Optional

7.2 Cookie Management

You can control cookies through:

  • Our cookie consent banner (first visit)
  • Cookie settings in your account
  • Browser settings (may affect functionality)

7.3 Meta Pixel (Advertising)

Purpose: we use the Meta pixel (also called “dataset”) to learn whether a visit comes from one of our ads on Facebook or Instagram and whether it ends in a sign-up, so we can measure and improve our advertising.

Legal basis: your consent (art. 6(1)(a) GDPR and art. 5(3) ePrivacy Directive). The pixel loads only after you accept the “Advertising” category in the cookie banner. If you decline, or have not chosen yet, nothing is requested from Meta. You can withdraw consent at any time from “Cookie settings” in the footer.

Data and transfer: Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) receives the page you visit, the date and time, your IP address, your browser and device type and the identifiers of the cookies _fbp and _fbc. We send no name, email or phone number, and the pixel's automatic event collection is turned off. Meta may transfer data to its group companies outside the European Economic Area under the safeguards described in Section 9.

Details and the cookie list are in our Cookie Policy.

See our Cookie Policy for more details.

8. Children's Privacy

KITT-AI is not intended for children under 13.

We do not knowingly collect personal information from children. If we discover we have collected data from a child under 13, we will delete it immediately. Parents who believe their child has provided information should contact us at [email protected].

9. International Data Transfers

Your data may be processed in countries outside your residence, including the United States. We ensure adequate protection through:

  • Standard Contractual Clauses (EU-approved)
  • Data processing agreements with all providers
  • Compliance with applicable data protection laws

10. Third-Party Links

KITT-AI may contain links to external websites. We are not responsible for the privacy practices of these sites. Please review their privacy policies before sharing information.

11. Changes to Privacy Policy

We may update this Privacy Policy periodically. Material changes will be notified via:

  • Email to registered users
  • Prominent notice on the website
  • In-app notification

Continued use after changes constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related questions, requests, or concerns:

  • Email: [email protected]
  • Data Protection Officer: [email protected]
  • Support: [email protected]
  • Website: https://kitt-ai.app/privacy

13. Supervisory Authority

If you are in the EU/EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority. In Spain, that is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

14. Governing Law and Jurisdiction

This Privacy Policy is governed by Spanish law and by Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD). If you use the Service as a business or professional, any dispute shall be submitted exclusively to the Courts of Málaga (Spain), where CODELABS STUDIO, S.L. has its registered office, with waiver of any other forum. If you are a consumer, the courts that mandatory law determines for your case shall have jurisdiction, and the Courts of Málaga only where the law allows it. This does not affect your right to complain to the supervisory authority.

See also our Terms of Service, Cookie Policy and Legal Notice.

📧 Questions?

If you have any questions about how we handle your data, please don't hesitate to contact us at [email protected]. We're here to help!