1. Who we are
Kiteframe is operated by Sansa Group AB, organization number 559111-9507, operating through its Sansa Vision division. The registered address is Soldathemsgatan 20, 415 28 Göteborg, Sweden. Sansa Group AB is the controller for the website, accounts, service usage, and direct customer relationship. Link is the merchant of record and an independent controller for self-serve payment transactions processed through Stripe Managed Payments. When customers use Kiteframe to process end-user conversations or connected-source data, Sansa Group AB generally acts as their processor under a data processing agreement.
Privacy questions and rights requests can be sent to support@kiteframe.xyz or mailed to the registered address above.
2. Information we collect
Information you provide
- Account details such as name, work email, organization, and authentication records.
- Workspace content such as agent configuration, source connections, uploaded files, prompts, evals, actions, and support messages.
- Billing and transaction metadata. Payment-card data is processed by the payment provider and is not stored by Kiteframe.
- Communications, feedback, and privacy or support requests.
Information collected automatically
- Request logs, IP address, device and browser information, security signals, timestamps, and approximate region.
- Usage records such as feature events, conversation units, latency, model route, errors, and release identity.
- Necessary local storage and, only after consent where required, analytics or marketing identifiers.
Customer-controlled data
Customers decide which public or authorized sources, end-user conversations, identities, and business-system records they connect. Customers must have authority to provide that data and must give their users any required notice.
3. Why we use information
| Purpose | Typical information | EU/EEA basis |
|---|---|---|
| Provide and secure the service | Account, session, workspace, logs | Contract and legitimate interests |
| Authentication and transactional email | Email, OTP, magic link, security event | Contract and legitimate interests |
| Billing and accounting | Subscription, invoice, usage ledger | Contract and legal obligation |
| Support and incident response | Contact details, message, diagnostics | Contract and legitimate interests |
| Optional analytics and marketing | Consent state, analytics identifiers | Consent where required |
| Prevent abuse and enforce terms | Security signals, audit events | Legitimate interests and legal obligation |
Our legitimate interests are keeping Kiteframe reliable and secure, preventing fraud and misuse, supporting customers, and improving business-service performance. We balance those interests against affected individuals’ rights. Where processing is necessary to create or administer an account, workspace, support request, or purchase, not providing the requested information may prevent us from providing that function. Optional analytics and marketing remain optional.
4. Sources and recipients
We receive information directly from users and customers, automatically from use of the service, from customer-authorized sources and connectors, and from service providers involved in authentication, security, support, and transactions. We disclose information only as needed to run the service, follow customer instructions, complete corporate transactions, protect rights and safety, or comply with law. Deployed provider categories include Cloudflare for compute, storage, security, AI, retrieval, and email, and Stripe and Link for checkout, subscription management, fraud prevention, transaction support, and merchant-of-record obligations. Customer-selected connectors receive only the data authorized for that connection.
Kiteframe does not sell personal information for money or share it for cross-context behavioral advertising. If that practice changes, this policy and the required opt-out controls will change first.
5. International transfers
Service data may be processed outside your country. Where required, transfers use an applicable legal mechanism such as an adequacy decision or standard contractual clauses, together with technical and organizational safeguards.
6. Retention
Account and contract records are kept while the relationship is active and for required legal, security, and dispute periods afterward. Customer content follows workspace retention settings and contract terms. Unclaimed public-site audits expire after 24 hours. Authentication codes and magic links expire within minutes and are single use. Backup and deletion workflows may require a limited additional period before data disappears from every system.
7. Security
Kiteframe uses tenant-scoped access, encrypted transport, scoped bindings and secrets, one-time authentication tokens, rate limits, audit events, data minimization, release controls, and tested export and deletion workflows. No online service can guarantee absolute security.
8. Your choices and rights
Depending on your location, you may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent. California residents may also request categories or specific pieces of information, deletion, correction, and information about disclosures, and may opt out of sale or sharing if applicable. See the data rights matrix and California notice at collection. Withdrawing consent does not affect processing that was lawful before withdrawal.
EEA residents may complain to their local supervisory authority or to Sweden’s Authority for Privacy Protection (IMY).
9. Automated decisions
Kiteframe does not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects for our direct account relationship. Kiteframe can provide configurable AI responses and governed actions for customers; the customer determines its use case, instructions, safeguards, and required human review.
10. Children
Kiteframe is a business service and is not directed to children under 16. Do not submit children’s data unless an applicable customer contract and lawful basis expressly permit it.
11. Changes
We will post material changes here and update the effective date. When a change materially affects account data, we will provide additional notice through the service or email where appropriate.