Privacy policy
Last updated
This policy explains how Kaavit handles personal data: what is collected, why, who receives it, how long it is kept, and what you can ask for.
Who is responsible
Kaavit is provided by Severi Reivinen, in Finland (“we”, “us”). We are the controller of the personal data described here. Contact us about anything in this policy at privacy@kaavit.com.
When an organisation uses Kaavit, the content its members put on its boards is processed on the organisation’s behalf. For that content the organisation is the controller and we are its processor, under our data processing agreement. Questions about content on an organisation’s boards are best sent to that organisation first.
What we collect
Your account. Your name, email address and, if you set one, a hash of your password. We never store the password itself. We record whether your email address is verified.
Signing in with Google or GitHub. If you choose to, Google or GitHub tells us your name, your email address, whether they have verified it, and your account id with them. We keep the account id, so we know it is you next time, and use the rest to create or find your Kaavit account. We do not receive your Google or GitHub password. We do not keep the access they grant us, and we do not copy your profile picture.
Your sessions. When you sign in we record the session’s IP address, your browser’s user agent and when the session expires. You can see and end your sessions in your account settings.
What you create. Boards and everything on them: text, shapes, connectors, images you upload, comments, suggested changes, board versions, and the names you give things. We record who created a board, comment, image, suggestion or version, who accepted, declined or reverted a suggestion, and who edited a board between versions.
AI requests. When you use AI on a board we store the prompt you typed, which part of the board it covered, the name, type and size of any file you attached to it, the model used, its cost, and the changes it made, so they can be shown in the board’s history and reverted. The attached file itself is not kept: see AI features.
AI tools you connect. If you connect an AI tool such as Claude Code to Kaavit, we keep the connection: the tool’s name as it gives it, the web address it publishes its details at or returns you to, the organisation you chose, what you allowed it to do, when you connected it and, to the hour, when it last used the connection. We store its sign-in tokens only in hashed form. When the tool draws on a board we store what it sent — what to add, what to remove, and any change it proposed — in the board’s AI history, with the tool that sent it, so it can be shown and reverted. When the tool creates a board, we record on the board which connection created it.
Paid plans. When an organisation buys a paid plan, the payment goes to Link, Stripe’s payment service, which sells the plan. What you type at checkout — your name, billing address and card or other payment details — goes to Link, not to us, and we never see card details. We keep the organisation’s plan, its Stripe customer and subscription ids, the subscription’s status, period and number of seats, the invoices that brought AI credits, and which member is the billing contact. We send Stripe the organisation’s name and id, the number of members, and the billing contact’s email address and user id; when the billing contact leaves the organisation, we replace their address with an owner’s.
Invitations. The email address of each person you invite to an organisation or a board, who sent the invitation, and whether it was accepted.
Comment notifications. Which comment threads you follow — ones you started, replied in or were mentioned in — whether you muted one, and when you last read it and were last emailed about it. Your choices of which notification emails you get. When we sent you a notification email, kept for an hour to limit how many we send.
Security and abuse prevention. To limit repeated sign-up, sign-in and link-guessing attempts, we count attempts per IP address and per hashed email address for up to one hour. These counters hold nothing else.
Abuse reports and suspensions. When someone reports a board to us, we keep their email and what they wrote. If we suspend a board, an organisation or an account for breaking the terms, we record which one, why, who decided and when.
Errors and usage. When something fails, the app sends us an error report. We also record a small, fixed set of product events, such as a board being created or an AI request finishing. Both carry your user id, never your name or email, and never board contents or prompts. They include your browser, operating system, screen size, time zone and the address of the page without its query. IP addresses are not stored. The event for a new account also records which sign-up button on kaavit.com you used and, if the link that first brought you to kaavit.com was tagged for a social platform or was the “Made with Kaavit” link on a board somebody shared, which of those it was and which kind of link, such as a profile or a post. Both come from a fixed list, never the link’s own text.
This website. If you agree to it on the banner, we measure how kaavit.com itself is used: the pages you open, the links you follow, the page you arrived from, any campaign tag on the link that brought you, and your browser, operating system, screen size, country and time zone. We do not know who you are, we never link these measurements to an account, and if you decline, nothing is stored on your device and nothing is sent.
A link to kaavit.com from a social post or profile can carry a tag that names the platform. Whatever you answer on the banner, the tag stays in the address of the pages you open here and of the links from here to sign up, sign in or buy a plan, so that a new account can record where it came from as described under “Errors and usage”. Keeping it in the address stores nothing on your device. If you agree on the banner, the tag is kept with the other measurements of this website, in the storage described under “Cookies and storage on your device”.
Email delivery. Our email provider keeps a log of the messages we send you: the address, the subject and whether it was delivered. An email telling you that someone mentioned you or replied in a thread you follow quotes up to five of those comments, up to 300 characters each, with their authors’ names, so those words pass through our email provider to your mailbox. You can turn each kind off from the email itself or in your account settings.
We do not use your data for advertising, we do not sell it, and we do not build profiles of you.
Why we use it, and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the service: your account, boards, sharing, comments, AI, connected AI tools, and email about your account and comments | Account, sessions, content, AI requests, connected AI tools, invitations, comment notifications | Performing our contract with you, Art. 6(1)(b) |
| Selling and running a paid plan: checkout, seats, invoices and the billing contact | Paid plans | Performing our contract with the organisation, Art. 6(1)(b) |
| Keeping the service secure and preventing abuse | Sessions, attempt counters, invitations, abuse reports and suspensions | Our legitimate interest in a secure service, Art. 6(1)(f) |
| Finding and fixing errors, and understanding which features are used | Error reports and product events | Our legitimate interest in a working, improving service, Art. 6(1)(f) |
| Measuring how this website is used | The website analytics described above | Your consent, Art. 6(1)(a) — you can withdraw it at any time |
| Keeping records the law requires | Whatever the obligation covers | Legal obligation, Art. 6(1)(c) |
You can object to processing based on our legitimate interests. Write to us and we will stop unless we have a compelling reason to continue.
AI features
When you ask for an AI result, we send the prompt and the part of the board it covers (up to 200 elements: their text, type, position and size) to a model provider. Your name, email and user id are not sent. The providers we use are listed on the subprocessors page. Under their terms for business API customers, they do not use this data to train their models, and they may keep it for a limited time to detect abuse.
You can attach one file to a prompt: a PDF, an image, or a text or Word document. A Word document is turned into text in your browser before it is sent to us. We store the file only so that it can be sent to the model provider with your prompt, and delete it as soon as the result is finished, or up to two hours after you attached it if it is never used. We count its pages or characters to show what reading it will cost, and nothing else of it is read by us or kept anywhere. Its name is not sent to the provider. When you attach a file and nothing on the board is selected, the board is not sent with it unless you choose to include it.
Only people who can edit a board and have a verified email address can use AI on it.
Links on boards
When you add a link to a web page to a board, by pasting its address or with Link → Web address, our server requests that address once to read the page’s title and description. They are saved on the board as the card’s text, which anyone who can edit the board can change. The server asks again only when someone changes the card’s address or chooses “Refresh preview”. Opening a board never makes us request anything.
Only people signed in to Kaavit who can edit the board can make our server do this, and how often each of them can is limited.
The site sees a request from our server, which names itself KaavitBot and links to this section, and nothing about you: no cookie, no sign-in, no name, and not the board it is for. The server reads only the beginning of the page, where its title is. It follows a redirect only within the same site and fetches nothing else from it, such as pictures or scripts. Because each request is one page that a person has just added, it does not read robots.txt.
The address is kept only on the board, as part of its contents. Our server does not log it or keep a copy of the page or of what it read, and our product events record only whether a title was found, never the address or the site.
Opening a card opens the page in a new tab. The site does not learn which board linked to it, or that a Kaavit board did.
Who else sees your data
People you work with. Other people on a board see your name, your cursor and what you select while you are there. Board contents, comments, suggestions and history are visible to everyone the board is shared with, including anyone holding a share link. A task assigned to you shows your name on that board to the same people.
Link and Stripe. When an organisation buys a paid plan, Link, Stripe’s payment service, is the seller. It processes the payment, the receipts, invoices and tax, and payment disputes and support under its own privacy policy, and it can contact the buyer about the purchase. Stripe also processes the paid-plan data we send it, as listed on the subprocessors page.
Google and GitHub. If you sign in with one of them, you sign in on their site, under their own privacy policy (Google, GitHub), and they learn that you signed in to Kaavit. We send them nothing else about you.
AI tools you connect. An AI tool you connect works for you, not for us. It reads the boards you can open in the organisation you chose, and what it reads goes to the tool, and to whoever provides it, under your own agreement with them: it is not one of our subprocessors, and nothing it reads or sends goes to the model providers we use for Kaavit’s own AI. It cannot delete a board or change who can see one that already exists. A board it creates is private to you, unless it is created shared: with a team, with everyone in the organisation where the organisation allows it, or with the same people as a board you manage. It can rename a board it created, and no other. It can change or delete what it drew itself. It cannot delete anything else, and a change to anything else on a board waits as a suggestion for a person to accept. You can disconnect it at any time in your account settings, and an organisation’s owners and admins can end any connection into their organisation, or turn connecting off.
Service providers. We use the subprocessors listed on the subprocessors page to host, secure and run the service. Each processes data only on our instructions, under a contract that requires them to protect it.
Authorities. We disclose data when the law requires it, and only what is required.
Transfers outside the EU
The servers and database are in the EU (the Netherlands). Some subprocessors are in the United States. Those transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s standard contractual clauses.
How long we keep it
| Data | Kept |
|---|---|
| Your account | Until you delete it |
| Sessions | 7 days after your last use |
| Boards and their contents | Until deleted, then 30 days in the trash, then removed |
| Automatic board versions | Up to 30 days, fewer as they age; named versions until the board is removed |
| AI request log | As long as the board exists |
| Files attached to AI prompts | Until the result is finished, or up to 2 hours if the file is never used |
| Suggestions | Open and accepted ones as long as the board exists; declined or withdrawn ones 30 days after the decision |
| Invitations | Usable for 48 hours (organisation) or 7 days (board), then deleted 30 days later |
| Password reset links | Deleted once they expire, an hour after they are sent |
| Google or GitHub sign-in | Until you disconnect it in your account settings, or delete your account |
| Connected AI tools | Until you or the organisation disconnect it, you leave the organisation, or you delete your account |
| The organisation chosen while connecting an AI tool | 1 hour |
| Attempt counters | Up to 1 hour |
| Notification email send times | 1 hour |
| Paid-plan records | While the organisation exists; Link keeps its own sales records as the law requires |
| Suspensions | Until lifted, or until the board, organisation or account is deleted |
| Abuse reports | As long as the report and any appeal need, then deleted |
| Queued emails | Deleted within a day of sending |
| Error reports and product events | 1 year |
| Website analytics | 1 year |
| Database backups | Up to 5 weeks |
When you delete your account, your sessions, password, Google or GitHub sign-in, connected AI tools, memberships and access grants are removed at once. What you created on shared boards stays with those boards, shown as by “Deleted user”, because it is part of other people’s work. Data in backups is removed as the backups expire.
Cookies and storage on your device
The app uses only what it needs to work, so it asks for no consent:
- A session cookie that keeps you signed in, for up to 7 days. It is sent to every
kaavit.comaddress, including this site, which ignores it. - A cookie that remembers whether the sidebar is open, and your theme choice in local storage.
- Your private board drafts, kept in your browser’s storage until you sign out or reveal them.
- Suggestions you have not submitted yet, kept in your browser’s storage until you submit or discard them, or sign out.
Error reporting and product events in the app store nothing on your device.
This website asks. kaavit.com measures how it is used, and the cookies for that are set only after you agree on the banner. They are set for kaavit.com alone and are never sent to the app, so agreeing or declining here changes nothing about your account. Your answer is remembered for six months in one small cookie, whichever way it goes; that one is set either way, because we have to remember that we asked. To change your mind, use “Cookies” at the bottom of any page — declining also deletes what the analytics had stored.
Your rights
You have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable format. You can change your name, email address and password, choose which notification emails you get, connect or disconnect Google and GitHub, disconnect AI tools, and delete your account, in your account settings. For anything else, including a copy of your data, write to privacy@kaavit.com. We answer within a month.
If you think we handle your data unlawfully, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the authority where you live.
Children
Kaavit is not meant for anyone under 16, and we do not knowingly collect their data.
Changes to this policy
When we change this policy we update the date at the top.