1. Introduction

Kapi ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our developer tools platform. Please read this policy carefully. By using the Platform, you consent to the practices described in this policy.

2. Information We Collect

Personal Information

We may collect personal information that you voluntarily provide, including:

Name and email address
Account credentials (passwords are stored only as a one-way hash — we never see them)
Payment information — handled entirely by Stripe. Card details are entered on Stripe's own checkout page and never reach our servers; we store only your Stripe customer and subscription identifiers, plan, and renewal date
Organization name and role
Profile information you choose to share

Usage Information

We automatically collect certain information when you use the Platform:

Blueprint configurations and deployment metadata
Agent workflow usage patterns
Interaction with AI-powered features
Device information and browser type
IP address and general location
Pages visited and features used

3. How We Use Your Information

We use the information we collect to:

Provide and personalize our developer tools and services
Process transactions and manage subscriptions
Deploy and maintain your blueprint environments
Improve our AI agent features and evaluation systems
Communicate with you about your account and updates
Send product updates and feature announcements (with your consent)
Analyze usage patterns to improve the Platform
Prevent fraud and ensure platform security
Comply with legal obligations

4. AI Features and Your Data

Our Platform includes AI-powered features to help you build and deploy agent workflows:

AI agents process your uploaded documents and knowledge bases within your workspace
Your blueprint configurations and agent interactions may be used to improve our services
We do not use your proprietary data to train third-party AI models
AI-generated content is processed in accordance with our data security standards
Your manifests, configurations, documents, and application data are yours — we claim no ownership, and you can export them at any time

Deleting a project deletes its agent runs, traces, documents, and knowledge base. There is not yet a self-serve control for erasing interaction history separately from the project that produced it — until there is, email [email protected] and we will do it for you.

5. Information Sharing

We do not sell your personal information. We may share your information with:

Microsoft Azure: Hosting, databases, document storage, vector search, and the Azure OpenAI models that run your agents. This is where your content lives and is processed.
Stripe: Payment processing and subscription billing
Google Analytics: Aggregate usage analytics on our web properties
Web search and integrations: If you enable web search or connect an external integration, the relevant query or request content is sent to that provider — for example Tavily, Brave Search, or an MCP server you connect. This only happens for the features you turn on.
Business Transfers: In connection with a merger, acquisition, or sale of assets
Legal Requirements: When required by law or to protect our rights
With Your Consent: For any other purpose with your explicit permission

Prompts and model responses are sent to Azure OpenAI to generate your agents' output; we do not pass your name or account identity along with them. Our tracing and observability system runs on our own infrastructure rather than a third-party service, so agent traces are not shared outside Kapi.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption in transit, access controls, and hashed credentials.

A note on how deployed applications are isolated, because the distinction matters: deployed applications run on shared Azure Container Apps infrastructure, not one container per customer. Requests are routed to your application by its subdomain, and separation between customers is enforced in software — each tenant's configuration, documents, and vector search index are namespaced and scoped to that tenant. This is logical isolation, not physical isolation. Customers who require dedicated or air-gapped infrastructure should contact us about an enterprise deployment.

No method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Preview environments expire 24 hours after they are created and stop serving traffic; published deployments do not expire. Deleting a project removes its associated data, and you can request deletion of your account and its data at any time by emailing [email protected]. We may retain certain information as required by law or for legitimate business purposes, such as resolving disputes or enforcing agreements.

8. Your Rights

Depending on your location, you may have the following rights:

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your personal information
Portability: Request a copy of your data in a portable format
Opt-out: Unsubscribe from marketing communications
Restrict Processing: Request limitation of how we use your data

To exercise these rights, please contact us at [email protected].

9. California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information. To submit a CCPA request, please contact us at [email protected].

10. Cookies and Tracking Technologies

We use cookies and similar technologies to:

Keep you signed in to your account (a session cookie — required; the Platform will not work without it)
Remember your preferences, such as light or dark appearance
Measure aggregate usage through Google Analytics

We do not use advertising cookies or cross-site trackers on the Platform, and we do not sell or share cookie data with advertisers. You can control cookies through your browser settings; blocking the session cookie will prevent you from signing in.

11. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. Children's Privacy

The Platform is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete such information promptly.

13. International Data Transfers

Our infrastructure runs in Microsoft Azure regions in the United States, so if you are outside the US your information is transferred to and processed there, under different data protection laws than your own. By using the Platform, you consent to that transfer. Customers with data residency requirements should contact us before storing regulated data on the Platform.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Platform or sending you an email. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Email: [email protected]

Address: Kapi AI, California, USA