DRAFT — this policy is a standard draft pending legal review by the owner. It describes how the service processes data today but has not yet been reviewed by a lawyer.

Privacy Policy

Last updated: 12 June 2026

This policy explains what personal data Kirava processes, why, and what rights you have under the GDPR. The short version: we store your email address and your orders so we can deliver the service — we never see your card details, we don't sell data, and we don't use advertising cookies.

1. Who is responsible

Kirava is the data controller for the processing described here. Contact us by replying to any email you have received from Kirava, or via the contact details on the start page.

2. What we collect

We process the following data:

  • Your email address — used for login (magic links), delivery of your automations and service messages.
  • Your order descriptions and the generated results — so you can access them in the portal and request revisions.
  • Payment information — handled entirely by Stripe. We never receive or store your card number.
  • Login session cookies — strictly necessary for the customer portal and admin to work.

3. Why we process it (legal bases)

  • To deliver the service you have purchased — performance of a contract (GDPR art. 6.1 b).
  • To protect the service against abuse and attacks — legitimate interest (art. 6.1 f).
  • To keep accounting records — legal obligation (art. 6.1 c, Swedish Bookkeeping Act).

4. Who processes the data for us

We use a small number of service providers (data processors) to run Kirava:

  • Stripe — payment processing.
  • Supabase — database where orders and token balances are stored.
  • Resend — email delivery (login links, order deliveries).
  • Anthropic — AI generation of your automations (your order description is sent to the AI model).
  • Vercel — hosting of the website.

5. Transfers outside the EU/EEA

Some of our providers process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or standard contractual clauses (SCCs) with supplementary safeguards.

6. How long we keep data

Account data, orders and deliveries are kept while your subscription is active and for a reasonable period afterwards so you can return. Accounting records are kept for seven years as required by Swedish law.

You can request deletion at any time — see your rights below.

7. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data deleted (where we have no legal obligation to keep it).
  • Receive your data in a portable format.
  • Object to processing based on legitimate interest.
  • Lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se).

8. Cookies

Kirava only uses strictly necessary cookies: a session cookie when you log in to the customer portal and one for the admin view. We do not use advertising or cross-site tracking cookies. Visit statistics, if collected, are aggregated and privacy-friendly.

9. Changes to this policy

We may update this policy as the service evolves. Material changes are announced by email. The date at the top shows when the policy was last revised.

← Back to the start page