Privacy Policy
This policy explains what personal data Kayts collects, why, how long we keep it and what rights you have. We wrote it to be read, not skimmed past. If anything is unclear, write to us (section 1).
1. Who is responsible for your data
Kayts ("we") is responsible for your personal data. You can reach us at [email protected] about anything in this policy.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account: email address, and the name and profile details your sign-in provider shares (Google, Apple, Microsoft or ORCID) | You, when you sign in |
| Profile: the name you give us and your date of birth | You, when you set up your account |
| Conversations: your messages, files and images you attach, papers and files you add in Research (their text is kept with the conversation), and the answers Kayts writes | You, when you use Kayts |
| Private chats: the same as conversations above, marked as private. A private chat doesn't appear in your chat history or search, can't be shared, and Kayts doesn't use or update Memory in it. It is still stored on our servers, like your other conversations | You, when you start a private chat |
| Memory (Pro plan): short facts about you that Kayts picks up from what you type, such as your job or how you like answers written. Never contact details, passwords or ID numbers. Health, religion or beliefs, political opinions, sex life or orientation, ethnic origin or trade union membership only if you are an adult and turn on “Include sensitive topics in memory” in Settings → Memory (off by default) | Kayts, from your messages, while memory is on |
| Shared links: which conversations you shared, and up to which message | You, when you share a chat |
| Usage: how many tokens (pieces of text) you use per model in the current 24-hour and 7-day windows, and your plan | Our server, while you use Kayts |
| Sign-up protection: a hashed (unreadable) form of your IP address and email address from when you set up your account, so one person can't collect the free allowance over and over with new accounts | Our server, when you set up your account |
| Consents and choices: which version of the Terms and this policy you accepted and when, and whether conversations may be used for training | You, when you set up your account and in Settings |
| Waitlist: your email address, the language of the page, when you joined and when you confirmed the address, and until you confirm it a hashed (unreadable) form of your IP address | You, when you join the waitlist on our home page before Kayts opens |
| Technical data: IP address, browser type and error logs | Your browser, automatically |
Settings such as theme or text size, and the "About you" text in Personalization, are stored only in your browser. The "About you" text is sent with each message so answers fit you, and is not stored on our servers.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, answering your messages, keeping your chat history, applying your plan's limits | Performing our contract with you (art. 6(1)(b)) |
| Memory: remembering facts about you to use in new chats, while you keep it on | Performing our contract with you (art. 6(1)(b)); you can switch it off and delete what it remembers anytime |
| Memory of sensitive topics: remembering the special categories of personal data listed above, only while you keep “Include sensitive topics in memory” on | Your explicit consent (art. 9(2)(a) and art. 6(1)(a)); we record when you gave it. Turning it off withdraws your consent and deletes those facts |
| Showing a chat you shared to anyone who has its link | Performing our contract with you (art. 6(1)(b)), at your request |
| Waitlist: emailing you a link to confirm your address, then writing to you once when Kayts opens | Your consent (art. 6(1)(a)), given with the checkbox when you join and confirmed with the link. You can withdraw it anytime by writing to [email protected]; we then delete your address |
| Waitlist: keeping out automated sign-ups (a check that tells people from scripts, and a limit on sign-ups from one IP address) | Our legitimate interest in a list of real people (art. 6(1)(f)) |
| Checking your age, and whether a parent's consent is needed | Legal obligation (art. 6(1)(c) and art. 8) |
| Keeping the service secure, preventing abuse, fixing errors | Our legitimate interest in a safe, working service (art. 6(1)(f)) |
| Keeping conversations for, and later fine-tuning, Kayts models on them, if "Help improve Kayts" is on (section 4) | Our legitimate interest in improving the service (art. 6(1)(f)); for users under 18 only if they switch it on themselves |
| Billing and accounting, once paid plans start | Legal obligation (art. 6(1)(c)) |
4. Training on conversations
Kayts runs on open-source language models that we host ourselves. To make Kayts better at what people actually ask it, we plan to fine-tune these models on real conversations: further training that adjusts an existing model with examples, rather than building a new one from scratch. We are not training on conversations yet. Fine-tuning starts in a later stage of development; until then, conversations of accounts with "Help improve Kayts" on are kept so they can be used once it does. Before that happens we will update this section with the details of the first run.
Who is included
- For adults "Help improve Kayts" is on by default. You can switch it off when you set up your account or anytime in Settings → Privacy. Switching it off is your right to object (art. 21 GDPR): from then on your conversations are not used for training, including the ones you had before.
- For users under 18 it is off unless they switch it on themselves.
- The setting is checked at the moment training data is prepared, not when you write a message. Whatever you choose before a training run is what counts.
- Private chats are treated like your other conversations: they are included while "Help improve Kayts" is on.
What is used
- Used: the messages you type, the answers Kayts writes, and your ratings of answers (thumbs up or down, with the comment you add). Ratings matter most: they teach the model which answers people find helpful.
- Not used: files, images and papers you attach or add in Research (they are often other people's work), conversations you deleted, what Kayts remembers about you (Memory), your account and profile details, and your usage.
How it works
- No separate copy while you chat. Training data is taken from chat history only when a training run is prepared. If you delete a conversation or switch training off before then, it is simply not there.
- Selection. We take conversations of accounts that allow training at that moment and leave out everything listed under "Not used".
- Cleaning. We automatically remove identifiers we can detect, such as email addresses, phone numbers, national ID numbers (such as PESEL), card and bank account numbers, and IP addresses, and replace them with placeholders like [EMAIL]. Automatic cleaning can miss things, so please don't share secrets or other people's personal data in chats.
- Training. The cleaned data set is not linked to your account or name. It is copied to rented graphics processors (RunPod, section 5) only for the training run and deleted from them afterwards. The data set is never published or sold.
- Record. We record which conversations went into which training run, so we can honor your choices later.
The trained model answers all Kayts users. Conversations already used in a finished training run cannot be taken back out of that model, but once you switch training off or delete them they are never used again.
5. Who else processes your data
We do not sell your data and do not share it for advertising. We use these service providers, bound by data processing agreements:
- Supabase: database, sign-in and the sign-in emails. Data is stored in the European Union (Ireland).
- RunPod (Runpod, Inc., USA): runs the Kayts models on rented graphics processors, today in a data center in Iceland (European Economic Area). Your messages and files pass through these servers while the answer is written.
- Sign-in providers (Google, Apple, Microsoft, ORCID), only if you choose to sign in with them.
- Cloudflare: our domain kayts.ai, the website itself and its protection from attacks, the forwarding of emails you send to our @kayts.ai addresses, sending our emails (such as the waitlist confirmation link), and a check at sign-in and on the waitlist that tells people from automated scripts (Turnstile). The check sees your browser's request, not your email or conversations.
- OpenAlex: when you add a paper in Research, we send its title or DOI (not your conversation) to look it up.
Voice typing uses your browser's built-in speech recognition. In Chrome and Edge your voice goes to Google or Microsoft under their own privacy policies; Kayts only receives the text.
Some providers are US companies. Where data could leave the EU, transfers are protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses (art. 45 and 46 GDPR).
6. How long we keep it
- Account, profile and conversations: until you delete them or your account. Deleted data leaves our backups within 30 days.
- Private chats: like other conversations, until you delete your account or all your chats (Settings → Privacy → Delete all chats, which includes private chats). Because they are not in your chat history, you can't delete them one by one; write to us if you want a specific one deleted. They are included in the data export (Settings → Account).
- Memory: until you delete a fact, switch memory off and delete everything, or delete your account. Sensitive facts also go when you turn off “Include sensitive topics in memory”. Deleting a conversation does not delete what Kayts learned in it.
- Shared links: until you stop sharing, or delete the conversation or your account. Anyone who opened the link before then may have kept a copy.
- Usage counts: for as long as your account exists, and up to 13 months after a paid plan ends.
- Sign-up protection: the hashed addresses are kept for 30 days after you set up your account, also if you delete it in that time.
- Waitlist: addresses not confirmed within 7 days are deleted. Confirmed addresses are kept until we send the email that Kayts is open, then deleted within 30 days; at most 12 months after you joined. Earlier if you ask us to remove your address. The hashed IP address is deleted when you confirm.
- Billing records: as long as tax law requires (in Poland, usually 5 years after the end of the year).
- Technical logs: up to 30 days.
- Under 16: if you are under 16, your account is deleted as soon as you enter your date of birth, until we can collect a parent's consent.
7. Children
Kayts is not for children under 13. In Poland, the age of digital consent is 16 (art. 8 GDPR), so users aged 13 to 15 need a parent's or guardian's consent. We are still building the way to collect it; until then, accounts of users under 16 are deleted straight away and no data is kept. If you believe a child under 13 has given us data, write to us and we will delete it.
8. Your rights
You have the right to:
- see the data we hold about you and get a copy (art. 15),
- correct it (art. 16),
- delete it (art. 17),
- restrict how we use it (art. 18),
- take it with you in a common format (art. 20),
- object to uses based on legitimate interest, including training (art. 21),
- complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (PUODO, uodo.gov.pl); you can also contact the authority where you live.
You can use some of these rights yourself in the chat: Settings → Account lets you correct your name, download a copy of all your data (a JSON file you can take elsewhere) and delete your account with everything in it; Settings → Personalization shows what Kayts remembers about you and lets you delete it. For anything else, write to [email protected]. We answer within one month.
9. AI and automated decisions
Kayts is an AI system and its answers are generated automatically. They can be wrong and are not professional advice. We do not make decisions about you with legal or similarly significant effects based solely on automated processing.
10. Security
Data is encrypted in transit (HTTPS) and at rest. Each account can access only its own data, enforced by the database itself (row-level security). Only a small number of people at Kayts can access the systems, and only when needed to run them.
11. Changes
If we change this policy in a way that matters, we will tell you in Kayts or by email before the change applies. The version and date are at the top of this page.