Privacy Policy

Last updated: September 5, 2026

Introduction

OpenKBS ("Company", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy describes the types of information we collect when you use our AI-powered application building platform at https://openkbs.com (the "Platform"), how we use it, who we share it with, and the measures we take to keep your data secure.

This Privacy Policy applies to all users of the Platform, including visitors to our website. By using the Platform, you agree to the collection and use of information in accordance with this policy.

For information on how we process personal data on behalf of our Customers (as a data processor), please refer to our Data Processing Addendum (DPA) at https://openkbs.com/dpa.

1. Information We Collect

1.1. Information You Provide

We collect information that you provide directly to us, including:

Account Information: Name, email address, company name, and account credentials when you register.
Payment Information: Billing address, payment method details, and transaction history. Payment card details are processed by our third-party payment processor and are not stored on our servers.
Customer Data: Data, documents, prompts, configurations, and other materials you upload to or create on the Platform.
Communications: Information you provide when you contact us for support, submit feedback, or communicate with us via email or other channels.
Expert Services Data: Information you provide in connection with Expert Services requests, including project descriptions, specifications, and business requirements.

1.2. Information We Collect Automatically

When you use the Platform, we automatically collect:

Usage Data: Interactions with the Platform, features used, pages visited, session duration, and actions performed.
Device and Browser Information: IP address, browser type and version, operating system, device type, and screen resolution.
Log Data: Server logs including access times, pages viewed, referring URL, and system activity.
Cookie Data: Information collected through cookies and similar tracking technologies (see Section 7).

1.3. Information from Third Parties

We may receive information from:

SSO Providers: When you register or log in through a third-party service (e.g., Google), we receive basic profile information as permitted by your settings with that provider.
Payment Processors: Transaction confirmation and fraud prevention data.
AI Service Providers: Metadata related to API usage (not the content of your data).

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1. Providing and Maintaining the Platform

Processing your registration and managing your Account;
Providing access to Platform features and services;
Processing transactions and managing Credits;
Transmitting your Input Data to AI service providers to generate output;
Providing Expert Services when requested;
Providing customer support.

2.2. Improving the Platform

Analyzing usage patterns and trends to improve functionality;
Developing new features and services;
Monitoring and improving Platform performance and reliability;
Conducting research and analytics using aggregated, anonymized data.

2.3. Security and Compliance

Detecting, preventing, and addressing fraud, abuse, and security incidents;
Enforcing our Terms of Use;
Complying with legal obligations.

2.4. Communications

Sending service-related notices (e.g., account confirmations, security alerts, billing notifications);
Sending product updates and announcements (you may opt out of non-essential communications at any time).

3. Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Performance of a Contract: Processing necessary to provide the Platform and services you have requested (Sections 2.1).
Legitimate Interests: Processing necessary for our legitimate interests, such as improving the Platform, ensuring security, and conducting analytics, where those interests are not overridden by your rights (Sections 2.2, 2.3).
Legal Obligation: Processing necessary to comply with applicable laws (Section 2.3).
Consent: Where required, such as for marketing communications (Section 2.4) and for analytics, advertising, and personalization cookies (Section 7). You may withdraw consent at any time.

4. Data Security

We take data security seriously and implement appropriate technical and organizational measures to protect your information:

Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis.
Infrastructure Security: We utilize cloud infrastructure (including AWS) that maintains independent certifications such as ISO/IEC 27001 and SOC 2.
Secure Transmission: All data transmitted between your device and the Platform is encrypted using TLS/SSL.
Data Isolation: Customer data is logically isolated between projects and accounts.
Regular Security Reviews: We review and update security measures periodically to address evolving threats.

5. Sharing Your Information

We do not sell or rent your personal information to third parties. We may share your information in the following circumstances:

5.1. AI Service Providers

In the course of providing the Platform, your Input Data may be transmitted to third-party AI service providers (such as OpenAI, Anthropic, or Google) for processing. These providers are contractually bound to process data only for the purpose of providing AI services and in accordance with our Data Processing Addendum.

5.2. Infrastructure and Service Providers

We use trusted third-party providers for hosting (AWS), payment processing, email delivery, and analytics. These providers process data on our behalf and are contractually required to maintain confidentiality and security.

5.3. Legal Requirements

We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of the Company, our users, or the public.

5.4. Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

5.5. With Your Consent

We may share information with third parties when you have given us explicit consent to do so.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

6.1. For All Users

Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete personal data.
Deletion: Request deletion of your personal data, subject to legal retention requirements.
Data Export: Export your Application Code and Customer Data through the Platform's available tools.

6.2. Additional Rights for EEA/UK Users (GDPR)

Restriction of Processing: Request that we restrict the processing of your personal data.
Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
Object to Processing: Object to processing based on legitimate interests or for direct marketing.
Withdraw Consent: Withdraw consent at any time where processing is based on consent.
Lodge a Complaint: File a complaint with your local data protection authority.

6.3. For California Residents (CCPA/CPRA)

You have the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of any sale of personal information. We do not sell personal information.

To exercise any of these rights, please contact us at office@openkbs.com. We will respond within the timeframe required by applicable law (typically 30 days for GDPR, 45 days for CCPA).

7. Cookies and Tracking Technologies

We use cookies and similar technologies on openkbs.com and its subdomains (including platform.openkbs.com). When you first visit, a cookie banner lets you accept all, reject all, or choose categories. Except for necessary cookies, nothing is set and no tracking data is sent until you consent. Independently of cookies, we keep a record of your interactions with the Platform (such as pages visited, purchases, and emails we send you) to operate, support, and improve the service. Product emails we send (such as welcome and activity reminders) may contain a tracking pixel and tracked links so we can see whether they were opened or clicked; account emails such as verification codes and invoices do not.

7.1. Cookie Categories

Necessary Cookies: Required for the website and Platform to function (e.g., authentication, session management, your cookie consent choice, security). These cannot be disabled and do not require consent.
Analytics Cookies: Help us understand how visitors use the website and Platform. Provider: Google Analytics (Google Ireland Limited). Collects device information, pages visited, and a truncated IP address.
Advertising Cookies: Measure the effectiveness of our advertising campaigns and attribute sign-ups to the ad that led to them. Providers: Meta Pixel (Meta Platforms Ireland Limited) and the OpenAI Measurement Pixel (OpenAI, for ads shown in ChatGPT). These providers may receive your IP address, browser information, the pages you visited, an advertising click identifier, and conversion events such as account registration. Meta and OpenAI may combine this data with information they hold about you under their own privacy policies.
Personalization Cookies: Remember your settings and preferences and allow personalized content.

7.2. First-Party Attribution Cookies

Independently of the categories above, when you arrive at openkbs.com from a link that carries campaign, referral, or affiliate parameters, we store those parameters in first-party cookies on openkbs.com (named openkbs_utm, openkbs_ref, and openkbs_aff) for up to 60 days. They contain no personal identifiers, are read only by us to record how a new account found us and to credit affiliate partners, and are never shared with advertising networks.

7.3. Scope and Duration of Your Consent

Your cookie choice is stored in a single cookie on the openkbs.com domain and applies to openkbs.com and all of its subdomains, including platform.openkbs.com. A choice made on either site is honored on the other. Your choice is kept for 180 days, after which we will ask you again.

7.4. Managing and Withdrawing Consent

You can change or withdraw your consent at any time by clicking "Cookie settings" in the footer of openkbs.com or on the login, registration, and dashboard pages of platform.openkbs.com. Withdrawing consent removes the analytics and advertising cookies already set and stops further data collection by those providers; it does not affect the lawfulness of processing before withdrawal. You can also configure your browser to refuse cookies, but disabling necessary cookies may prevent you from using the Platform.

7.5. Legal Basis

Analytics, advertising, and personalization cookies are set only with your consent (Article 6(1)(a) GDPR and the ePrivacy Directive). Necessary cookies and first-party attribution cookies are used on the basis of our legitimate interest in operating, securing, and measuring the reach of the Platform (Article 6(1)(f) GDPR).

8. Data Retention

We retain your personal data for as long as necessary to provide the Platform and fulfill the purposes described in this policy:

Account Data: Retained while your Account is active and for a reasonable period after deletion for legal and operational purposes.
Customer Data: Retained while your Subscription is active. Upon termination, you may request export within fifteen (15) days, after which we may delete all Customer Data.
Payment Records: Retained as required by applicable tax and financial regulations.
Usage Logs: Retained for up to 24 months for analytics and security purposes.
Support Communications: Retained for up to 36 months after resolution.

9. International Data Transfers

OpenKBS operates globally across multiple regions (EU, US, and Asia-Pacific), and your data may be processed in countries other than your country of residence. When we transfer personal data outside the EEA/UK, we ensure appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs) approved by the European Commission;
Adequacy decisions by the European Commission;
Other legally recognized transfer mechanisms.

For more information about our data transfer safeguards, please contact us at office@openkbs.com.

10. Children's Privacy

The Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will take steps to delete it promptly.

11. Sub-Processors

We use the following categories of sub-processors to provide the Platform:

| Category | Purpose | Location | |----------|---------|----------| | Cloud Infrastructure | Hosting, compute, storage | US, EU, Asia-Pacific | | AI Service Providers | AI model inference | US, EU | | Payment Processing | Subscription billing | US, EU | | Email Services | Transactional emails | US, EU, Asia-Pacific | | Analytics | Usage analytics (Google Analytics), with your consent | US, EU | | Advertising Measurement | Ad conversion measurement (Meta Pixel, OpenAI Measurement Pixel), with your consent | US, EU |

A current list of specific sub-processors is available upon request by contacting office@openkbs.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we will provide notice through the Platform or via email.

We encourage you to review this policy periodically.

13. Contact Information

If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about our data practices, please contact us:

Email: office@openkbs.com

For EEA/UK users: If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.