Privacy Policy

1. Who we are

Kevor ("Kevor", "we", "us") is an AI-powered onboarding analysis platform. For the purposes of data protection law, the data controller is Kevor, operating from Bengaluru, India. This Privacy Policy explains what personal data we collect when you use Kevor (the "Service"), why we collect it, where it goes, and the choices you have.

This policy applies to the Service available at kevor.app and any related websites or services we operate. Questions, requests, and complaints about your data can be sent to contact@kevor.app - this address also serves as our designated grievance contact under India's Digital Personal Data Protection Act, 2023 (DPDP).

By creating an account, you acknowledge the processing described in this policy.

2. What Kevor does

Kevor is a business tool for HR and People teams. You create workspaces, upload your organisation's onboarding documentation (PDF, Word, or plain text), and Kevor converts those documents into a structured model of your onboarding process, with AI-generated analysis such as health scores, identified friction points, and recommended action items. Kevor is not a social network: your workspaces are private and are never visible to other users.

3. Information we collect

Account information. When you sign up, we collect your email address and password. We store only a securely hashed version of your password - we never see or store it in readable form. If you sign in with Google, we receive your name, email address, and profile picture from Google. Your onboarding wizard may also collect your name, company, role, and goals, which are used only to personalise your experience.

Content you provide. This includes workspace names and descriptions, documents you upload, text you paste, edits you make to your flow (stages, tasks, teams), and action items you create. Important detail: when you upload a document, we extract its text content and store the text in our database. The original file is processed in memory and is not retained.

Profile avatar. If you upload a profile picture, it is rebuilt by our servers into a clean standard image format (WebP, maximum 512px), which also removes any hidden content, and is stored in our file storage.

Preferences and activity. Settings toggles you choose, and a technical activity log per workspace (for example, "analysis completed" or "task added"), used to show you your workspace history.

Session and security information. Login sessions, and technical data such as your IP address and browser type, used to protect your account and prevent abuse.

Support communications. Emails or messages you send us, which we keep as long as needed to resolve your request.

4. How we use your information

We use the information above only to:

• Provide, maintain, and improve the Service (for example, analysing your documents to produce your results, saving your workspaces, and displaying your data back to you);
• Authenticate you and keep your account secure;
• Send you transactional emails you request, such as password-reset links;
• Prevent abuse, such as rate-limiting repeated requests and verifying that logins come from humans;
• Respond to your support requests and exercise or defend legal rights.

5. Legal basis for processing

Under applicable data protection laws, we must have a legal basis for processing your personal data. We rely on the following:

• Contract performance - We process your account information, workspace data, and uploaded documents to provide the Service you have contracted to use.
• Legitimate interests - We process session data, analytics events, and security information to improve the Service, prevent abuse, and ensure account security. These interests are not overridden by your rights and freedoms.
• Legal obligations - We may process data to comply with legal requirements, respond to lawful requests, or enforce our Terms of Service.
• Consent - Where we process data for purposes beyond the above (such as optional analytics features), we will seek your explicit consent.

6. How we do NOT use your information

We do not sell your personal data. We do not share it with advertisers. We do not use your documents or any of your content to build advertising profiles or sell to third parties. Your workspaces are private to your account and are never shown to other users.

7. AI processing of your documents

The core of the Service is AI analysis of your uploaded documents. To provide it, the extracted text of your workspace's documents is sent to third-party AI providers, currently Google (Gemini), Groq, Mistral, and Cloudflare (Workers AI), which return the analysis shown in your workspace.

These transfers happen for one purpose only: generating your analysis. Kevor processes extracted document text through third-party AI providers. These providers may use submitted content to improve their models in accordance with their terms of service. For this reason, we advise against uploading documents containing highly sensitive personally identifiable information (such as government IDs, financial account details, or medical records). Enterprise customers requiring zero-retention and no-training guarantees should contact us to discuss dedicated processing arrangements. The specific models used may change over time as providers update their offerings; the provider companies listed above are current as of the date of this policy.

Because your documents may contain personal data about your employees (names, roles, contact details found in onboarding documents), you should only upload documents you are entitled to share, and you are responsible for informing your employees as required by your local obligations.

8. Companies that process data for us

Like most software services, we use specialist providers to host and operate Kevor. Each receives only the data needed for its function:

Vercel - hosting of the application (processes data in transit).

Neon - our PostgreSQL database, where your account and workspace data is stored (hosted on AWS).

Cloudflare - file storage for avatars (R2) and bot detection on sign-in (Turnstile).

Google, Groq, Mistral, Cloudflare - AI processing of document text, as described in Section 6.

Resend - delivery of transactional email (password resets) from our addresses.

Upstash - anonymous counters for rate limiting, which expire within minutes and contain no personal content.

PostHog - product analytics and session recordings (hosted in the EU), as described in Section 8. Receives only technical usage data such as page views, feature usage, errors, and short session recordings; does not receive the content of your documents.

We may update this list as our infrastructure evolves. Where a change is material, we will note it in an updated version of this policy.

9. Cookies and tracking

Cookies. We use only strictly necessary cookies - the session cookie that keeps you signed in - and Cloudflare Turnstile may set a short-lived token during login to verify you are human. We do not set any cookies for analytics, advertising, or tracking purposes.

Product analytics and session recordings. We use PostHog, a product analytics platform, to understand how the Service is used, identify bugs, and improve the product. PostHog is configured in a privacy-first, cookieless mode: it does not set persistent tracking cookies, does not build advertising profiles, and does not share data with advertisers. The data collected includes technical events (page views, feature usage, errors). Session replay masks all sensitive text content and input values to protect document privacy while allowing us to understand usage patterns and improve the product. PostHog's servers for our account are located in the European Union (Frankfurt, Germany). We do not use cross-site trackers or any third-party tracking of the kind that follows you around the internet. When you are signed in, analytics events are linked to your account so we can understand your journey through the Service and identify where users encounter problems.

10. Data storage and security

All traffic between your browser and Kevor is encrypted with HTTPS/TLS. Passwords are stored using industry-standard hashing. Every request to access or change data is verified server-side to ensure it belongs to the signed-in user. Uploaded files are verified by their actual content (not their filename), size-limited, and images are rebuilt by our servers to neutralise hidden payloads.

Your primary data is stored in a database hosted in Singapore (AWS), and the application serving your requests runs in Mumbai, India. Avatar files are stored on Cloudflare's global network. AI processing and email delivery occur in the providers' own infrastructure, which may be located in other regions. Section 12 below explains what this means for you.

11. Data retention and deletion

Active data. We keep your data for as long as your account is open and a workspace is active, so you can keep using the Service.

Deleted workspaces. When you delete a workspace, it enters a 30-day recovery window during which it is hidden but restorable (from within the Service, or by emailing us). After 30 days, deleted workspaces are permanently and automatically erased. This includes all documents, knowledge models, and workspace-specific data. However, a record of the deletion event itself is retained in your account's activity log for audit and compliance purposes. This log entry contains only the fact that a workspace was deleted (name and timestamp), not its contents.

Deleted accounts. Deleting your account (Settings > Delete Account) permanently removes your profile, workspaces, and documents from our live production systems immediately. Database backups containing this data are automatically aged out and destroyed within 30 days. This cannot be undone.

Short-lived data. Password-reset tokens expire within one hour. Rate-limit counters expire within minutes. Bot-check tokens expire almost immediately.

12. Your rights

Regardless of where you live, we provide the following, most of which are available to you directly inside the product:

• Access - everything we hold about you is visible in your dashboard, profile, and settings.
• Export - Settings > Data & Privacy > Export lets you download all of your data (workspaces, tasks, documents, action items) as JSON or CSV, anytime.
• Correction - edit your profile and workspace details directly in the product.
• Right to complain - If you believe we have not complied with applicable data protection laws, you have the right to lodge a complaint with your local data protection authority. For EU residents, this is the supervisory authority in your member state.
• Deletion - delete any workspace, or delete your entire account for immediate full erasure (Section 10).
• Grievance and questions - email our grievance contact at contact@kevor.app. We aim to acknowledge within 7 days and resolve within 30 days.
• Data Processing Agreement (DPA) - For customers subject to GDPR, UK GDPR, or other data protection laws requiring a DPA, a standard DPA is available upon request by contacting contact@kevor.app.

13. Users outside India

Kevor is operated from India, and this policy is written to satisfy India's DPDP Act, 2023. If you access Kevor from another country, your data is handled as described in this policy under Indian law. Kevor is committed to protecting user privacy in accordance with applicable data protection laws. Users in the European Economic Area, United Kingdom, and other jurisdictions with specific data protection requirements may contact us at contact@kevor.app to discuss compliance arrangements. By using the Service, you acknowledge that your data will be stored and processed in the locations described in Section 9.

14. Children

Kevor is a business service intended for adults acting on behalf of an organisation. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

15. Changes to this policy

We may update this policy as the Service evolves. The "last updated" date at the top reflects the latest version. For material changes, we will notify you by email or a prominent notice before the change takes effect. Continued use of the Service after an update constitutes acceptance of the updated policy.

16. Contact

Kevor - Bengaluru, India. Email: contact@kevor.app (privacy requests, grievances, and general questions).