How Kineviz handles your data

Privacy Policy

Effective date: September 11, 2026 · Last updated: September 11, 2026 Provided by Kineviz, Inc., 455 Market St Ste 1940 PMB 619492, San Francisco CA, 94105-2448

1. Introduction and Scope

This Privacy Policy explains how Kineviz, Inc. (“Kineviz,” “we,” “us,” or “our”) collects, uses, shares, and protects personal data when you use the Kineviz Agentic Analytics Platform, including its web-based interface and desktop application, and related websites and services (the “Service”). It applies to both the Community and Enterprise tiers.

For Enterprise customers, where Kineviz processes personal data within customer data on the customer’s behalf, Kineviz generally acts as a processor (or service provider), and a data processing agreement (“DPA”) governs that processing. For account, billing, website, and similar data, Kineviz generally acts as a controller. This Policy describes our controller practices and provides transparency about our processing generally.

This Policy applies only to the Services and does not extend to other websites, including websites owned and controlled by our partners or third-party websites for which we have provided links, or to any social media platforms, which are governed by their own terms of use and privacy policies. Separate agreements may govern other or additional aspects of delivery, access and use of the Services and/or certain services, resources, or information provided on or through our website. All such agreements between you and the Kineviz are hereby incorporated into this Policy by reference.

By accessing or using our Services or otherwise disclosing information to Kineviz, you provide your specific, unambiguous, freely-given, and informed consent to our collection, use, and sharing of your information in accordance with this Policy.

2. Who We Are

Controller: Kineviz, Inc., 455 Market St Ste 1940 PMB 619492, San Francisco CA, 94105-2448 Privacy and Data Protection contact: privacy@kineviz.com EU/UK representative: Martin Dubbey, +44 20 8076 3269, martin@kineviz.com, 4th Floor, 10 Lower Thames Street, London EC3R 6AF

3. Information We Collect

3.1 Account and contact information

When you register or communicate with us, we collect information such as your name, email address, username, organization/company, role, and, for paid plans, billing and payment-related details. Payments are processed by a third-party payment processor; we do not store full payment card numbers.

3.2 Your Requests

We may collect personal information from you when you fill out a form for a specific request or otherwise choose to provide information through a “contact us” feature, including, for example, your name, address, email, and phone number.

3.3 Content You Submit

We collect the content you submit to the sites operating the Services. This includes all comments, feedback or materials submitted by you to us, including, for example, feedback, testimonials, images, reviews, questions, comments, suggestions or ideas (“Feedback”). You acknowledge and agree that we will be free to use, display, perform, distribute, copy, adapt, and promote, without compensation to you, the Feedback for any purpose whatsoever.

3.4 Usage and analytics data

We collect information about how you interact with the Service, such as device and browser type, operating system, IP address, approximate location (derived from IP), pages or features used, timestamps, referring URLs, and similar diagnostic data. We use cookies and similar technologies for this, as described in Section 8.

3.5 Telemetry data

To operate, secure, and improve the Service — including the AI Agent — we collect telemetry such as application logs, performance and error data, feature usage, agent actions taken, and the prompts and inputs you submit to AI features.

3.6 Information from third parties

We may receive information from third parties such as authentication or single-sign-on providers, integration partners, and analytics or payment providers, consistent with their terms and your settings.

3.7 De-identified and aggregated data

We may aggregate or de-identify personal data so that it can no longer reasonably be used to identify you. De-identified and aggregated information does not constitute personal data and is not subject to this Policy. Where we hold or use de-identified data, we maintain it in de-identified form and do not attempt to re-identify it except as permitted by law.

4. How We Use Information and Legal Bases

We use personal data to: provide, operate, secure, and maintain the Service; authenticate users and manage accounts; process payments and manage subscriptions; provide AI Agent and analytics features you request; provide customer support; monitor, debug, and improve the Service; communicate with you about updates, security, and (where permitted) marketing; detect, prevent, and address fraud, abuse, and security incidents; and comply with legal obligations and enforce our terms.

Where the EU/UK GDPR applies, our legal bases are:

Contract — to provide the Service you request and administer your account.
Legitimate interests — to secure, maintain, and improve the Service, prevent abuse, and conduct limited analytics, balanced against your rights.
Consent — for certain cookies, marketing, or optional features, which you may withdraw at any time.
Legal obligation — to comply with applicable laws, tax, and accounting requirements.

We may use Artificial intelligence (AI) technologies to collect information. Information collected through such tools may be used to process, analyze, and interpret data related to user interactions, preferences, and behavior to improve service delivery, personalization, and overall user experience. Our systems may support data aggregation, trend analysis, predictive modeling, and automated outreach, enabling us to provide more relevant services and communications. We may utilize tools, including AI chatbots, to provide our users with an over-all better user experience.

5. Product Improvement Program

Kineviz operates a Product Improvement Program to develop, maintain, secure, and improve our products and the Service as a whole. The data described here supports the Service generally, including both the AI Agent and non-agentic components.

What it uses. For the Community tier (both free and paid plans), the Program may use your usage data — such as telemetry, feature usage, performance and diagnostic logs, and agent actions taken — together with your content data, such as your prompts and relevant User Content, to improve the Service, including its reliability, quality, safety, performance, and user experience.
Your choice. The Program is enabled by default, and you can turn it off at any time using the Product Improvement Program control in Account Settings. We may change this default regionally where required by law (for example, offering it on an opt-in basis).
Enterprise. We do not use Enterprise-tier usage or content data in the Product Improvement Program. That commitment is set out in the applicable Enterprise agreement or DPA, and we can help Enterprise customers develop their own skills and prompts on request.
Changes. These practices may evolve over time, and we will update this Policy if they do.

We do not sell your personal data. We share personal data only as follows:

Service providers / sub-processors — vendors who host infrastructure, provide AI/model processing, analytics, payment processing, customer support, and security, bound by contract to protect the data. We select AI/model providers whose terms prohibit using your data to train AI models. A current list of sub-processors is available on request.
Enterprise customers — where you use the Service through an organization, that organization’s administrators may access your account and User Content associated with it.
Legal and safety — to comply with law, legal process, or lawful requests, and to protect the rights, safety, and property of Kineviz, our users, or others.
Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
With your direction or consent — such as integrations you enable.

7. Cookies and Similar Technologies

We and our providers use cookies, local storage, and similar technologies to keep you signed in, remember preferences, measure usage, and improve the Service. The categories we use are:

Strictly necessary — required to operate and secure the Service (for example, authentication and load balancing). These cannot be disabled and, where applicable, do not require consent.
Functional — remember your preferences and settings.
Analytics/performance — help us understand how the Service is used so we can improve it.

We do not use cookies for cross-context behavioral advertising or targeted advertising. You can control cookies through your browser and, where required, through our cookie banner or preference center. Some features may not function properly if certain cookies are disabled. In regions that require consent for non-essential cookies (such as the EEA and UK), we obtain consent through a cookie banner or preference center before setting those cookies.

8. International Data Transfers

We operate globally and may transfer, store, and process personal data in countries other than your own. The Service is operated primarily from the United States and United Kingdom. For customers in the EEA and the United Kingdom, we may offer the option to have their data hosted and processed within the UK or the EU. Where we transfer personal data from the EEA, UK, or Switzerland to countries not deemed to provide an adequate level of protection, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or other lawful transfer mechanisms. You may request more information using the contact details below.

9. Data Retention

We retain personal data for as long as needed to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type and context — for example, account data is retained while your account is active and for a reasonable period afterward, and telemetry/logs are retained for a limited period. For Enterprise, retention and deletion of User Content are governed by your settings and the DPA. When data is no longer needed, we delete or anonymize it.

10. Security

We maintain administrative, technical, and organizational measures designed to protect personal data, such as encryption in transit, access controls, and monitoring. We periodically review and update these safeguards in response to evolving threats. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and for the security of data you upload. Report security concerns to security@kineviz.com.

11. Your Privacy Rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to processing of your personal data; the right to data portability; the right to withdraw consent where processing is based on consent; and the right to lodge a complaint with a supervisory authority. To exercise these rights, contact privacy@kineviz.com. If your data is processed by Kineviz on behalf of an Enterprise customer, we will refer your request to that customer.

11.2 California (CCPA/CPRA)

California residents have the right to know/access, delete, and correct personal information, the right to opt out of “sale” or “sharing” of personal information and certain targeted advertising, the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising these rights. We do not sell personal information and do not share personal information for cross-context behavioral advertising. To exercise these rights, contact privacy@kineviz.com. You may use an authorized agent, subject to verification. Additional California and U.S. state disclosures appear in Sections 13–15.

11.3 Other U.S. states and other regions

Residents in other states, and individuals in other jurisdictions, may have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, certain profiling, and any “sale” or “sharing” of personal data. We honor applicable rights as required by law and, where applicable, recognize opt-out preference signals such as Global Privacy Control (GPC). You can exercise these rights by emailing privacy@kineviz.com or using the request method described in this Policy.

11.4 How to exercise rights, verification, and appeals

How to submit. Email privacy@kineviz.com and state the type of request you are making. When you submit a request, please provide information reasonably necessary to process it — for example, your name, email address, and, where applicable, your state or country of residence. Making a request does not require you to create an account.

Verification. Only you, or someone legally authorized to act on your behalf, may make a request about your personal data. We will take reasonable steps to verify your identity before responding and may request additional information for that purpose. We cannot respond to a request or provide personal data if we cannot verify your identity or authority.
Authorized agents. You may use an authorized agent to submit a request. We may require written proof of the agent’s authorization and verification of your identity, and may deny a request from an agent who does not provide adequate proof.
Timing. We will confirm receipt and respond within the timeframes required by applicable law. If we need more time, we will let you know in writing and explain why.
Denials and appeals. If we decline a request, we will explain why to the extent required by law. We may decline where, for example, we cannot verify identity or authority, the request is unfounded or excessive, or an exception applies. Where the law provides an appeal right, you may appeal by contacting privacy@kineviz.com. You may also lodge a complaint with your supervisory authority or state Attorney General.

12. California and U.S. State Privacy Disclosures

Categories of personal information we collect. In the preceding 12 months, Kineviz has collected the following categories of personal information (as defined under the California Consumer Privacy Act, as amended) in connection with account, billing, website, and similar controller data:

Identifiers — such as name, username, email address, and IP address.
California Customer Records information (Cal. Civ. Code § 1798.80(e)) — such as contact details and billing/payment-related information.
Commercial information — such as subscription, plan, and transaction records.
Internet or other electronic network activity — such as usage, telemetry, diagnostic, and log data described in Section 3.
Geolocation data — approximate location derived from IP address.
Professional or employment-related information — such as your organization/company and role.
Sensitive personal information — limited to account log-in credentials (used only to provide and secure the Service).

We do not use or disclose sensitive personal information for purposes that would require us to offer a right to limit under applicable law, and we do not use sensitive personal information to infer characteristics about you.

We do not use your personal information to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

We will not discriminate against you for exercising any of your privacy rights.

13. Shine the Light Law

California’s Shine the Light law (Cal. Civ. Code § 1798.83) permits California residents to request certain information about our disclosure of personal information to third parties for those third parties’ direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing. To make a request or ask a question about this right, email privacy@kineviz.com.

14. Nevada Resident Privacy Rights

Nevada residents may have the right to opt out of the sale of certain covered information under Nevada Revised Statutes Chapter 603A. We do not sell personal information as defined by that statute. If you have questions about this right, contact privacy@kineviz.com.

15. Children’s Privacy

The Service is not directed to children, and we do not knowingly collect personal data from children under the applicable minimum age. That age is 16 by default; in jurisdictions that set a different minimum age for consent to the processing of a child’s personal data, the local minimum age applies (for example, 13 in the United States under COPPA, and ages between 13 and 16 across various EU member states and other countries). If you believe a child below the applicable age has provided us personal data, contact us at privacy@kineviz.com and we will take appropriate steps to delete it.

16. Third-Party Links and Services

The Service may link to or integrate with third-party websites and services that we do not control. Their privacy practices are governed by their own policies, and we are not responsible for them. Review their policies before providing personal data.

17. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (for example, by posting the updated Policy with a new effective date or notifying you in the Service). Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

18. Accessibility

We are committed to making this Policy accessible to people with disabilities. To request this Policy in an alternative format, contact us at privacy@kineviz.com.

19. Contact Us

For privacy questions or to exercise your rights, contact:

Kineviz, Inc. Email: privacy@kineviz.com Address: 455 Market St Ste 1940 PMB 619492, San Francisco CA, 94105-2448 EU/UK representative: Martin Dubbey, +44 20 8076 3269, martin@kineviz.com, 4th Floor, 10 Lower Thames Street, London EC3R 6AF

Appendix A. Google User Data and Google Cloud Platform Services

This Appendix supplements the Policy above and applies where you sign in with Google or where the Service uses Google Cloud Platform. We use Google OAuth 2.0 for authentication and may access Google Cloud Platform (GCP) services to provide our functionality.

Data we receive from Google

Your Google account email address
Your public profile information (name, profile picture)
A unique Google user identifier

Google Cloud Platform services we access

Currently used services:

Google Cloud Spanner — for scalable database operations to support Kineviz data visualization and graph data processing.
Google BigQuery — for data analytics and querying to enhance Kineviz data visualization capabilities and business intelligence.

Services we may use in the future:

Google Cloud Storage — for Kineviz data backup, storage, and distribution to ensure data persistence and availability.
Other GCP services — additional Google Cloud services (compute, networking, monitoring, etc.) primarily for automated deployment and hosting of Kineviz instances on Google Cloud Platform.

If we begin using additional Google Cloud Platform services in the future, we will update this Policy and notify you of any changes that may affect how your data is processed.

How we use Google data and services

To create and maintain your user account on our platform
To authenticate your identity for secure access
To store and process Kineviz visualization data using Google Cloud Spanner for optimal performance
To analyze and query datasets for Kineviz data visualization through BigQuery
To personalize your Kineviz experience within our application
To communicate with you about your account and our services

We do not share, transfer, or disclose your Google user data with any third parties except in the following limited circumstances:

Google Cloud Platform — your data is currently processed using Google Cloud Spanner and BigQuery as part of our platform infrastructure. Any future use of additional Google Cloud services will be governed by Google’s Cloud Data Processing Agreement and our service agreement with Google.
Legal requirements — when required by law, court order, or government regulation.
Security protection — to protect our rights, property, or safety, or that of our users or the public.
Business transfers — in connection with a merger, acquisition, or sale of assets, subject to the same privacy commitments.
Service providers — with trusted service providers who assist in operating our platform, under strict confidentiality agreements. These providers do not have independent rights to use the data.

Google Cloud data protection

When we use Google Cloud Platform services (currently Spanner and BigQuery):

Your data is subject to Google Cloud’s security and privacy protections.
Data processing complies with Google Cloud’s Data Processing Agreement (DPA).
We implement additional security measures and access controls.
Data is encrypted both in transit and at rest.
We follow the principle of least privilege for data access.

Data retention

We retain your Google user data and data stored in Google Cloud services (currently Spanner and BigQuery) only as long as necessary to provide our services or as required by law. You may request deletion of your account and associated data at any time by contacting privacy@kineviz.com.

Your rights

You can:

Revoke our access to your Google data at any time through your Google Account settings at myaccount.google.com/permissions.
Request information about what data is stored in Google Cloud services.
Request deletion of your data from our platform and Google Cloud services.
Contact us for any questions about our use of Google Cloud Platform services.

Revoking access will prevent you from using Google Sign-In for our services and may affect the functionality of features that depend on Google Cloud services.