Skip to content
KYZEN.
Start free

Legal

Privacy Policy

Last updated August 28, 2026

This Privacy Policy describes how KYZEN ("we," "us," or "our") collects, uses, discloses, and protects information when you use our websites, applications and services (collectively, the "Services"). By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Important Notice Regarding Third-Party AI Services

CRITICAL DISCLOSURE: Our Services include an AI assistant built on third-party large language models ("LLMs") and artificial intelligence services provided by external vendors ("Third-Party AI Providers"). We do not own, operate, or control these AI models. When you use the assistant, or any other AI feature of our Services:

  • The prompts and instructions you send to the assistant, together with the board content it reads in order to answer you — board, list and card titles, card descriptions, comments, action items and the names of the people on the board — are transmitted to and processed by Third-Party AI Providers to produce the response or the change you asked for.
  • We reach these models through a routing provider, OpenRouter, which passes each request to the model you select for that conversation — currently models operated by Anthropic, OpenAI and Google.
  • Short background tasks run on a smaller model of our choosing rather than yours: naming a conversation goes through the same routing provider, and summarizing a card description is sent directly to OpenAI.
  • Where you use the assistant's web search, the search terms it derives from your request are sent to our search provider, Tavily.
  • These Third-Party AI Providers operate under their own privacy policies and terms of service, which are separate from and independent of this Privacy Policy.
  • While we cannot control the Third-Party AI Providers' systems, we can and do configure certain settings provided by these providers, in a manner designed to protect your privacy and confidentiality.

1.1 — Protection of Your Board Content

IMPORTANT: We have configured our accounts with Third-Party AI Providers to disable training on user data. Specifically:

  • No-Training Configuration: We have enabled "no training" or equivalent data protection settings with our Third-Party AI Providers to prevent your prompts and your board content from being used to train, improve, or develop their AI models.
  • Work Product Protection: Your prompts, your board content and the assistant's responses are processed solely to provide you with the requested output, and are not used for model training purposes by Third-Party AI Providers (subject to their adherence to these settings).
  • API-Level Settings: We use API-level access with Third-Party AI Providers that includes enhanced data protection controls and contractual commitments regarding data usage.
  • Ongoing Compliance: We regularly verify and maintain these no-training settings to ensure continued protection of your content.

1.2 — Limitations and Disclaimers

While we take the above measures to protect your data, you should be aware of the following limitations:

  • We rely on Third-Party AI Providers to honor the no-training settings we have configured. We cannot independently verify or guarantee their compliance with these settings.
  • Third-Party AI Providers may retain data temporarily for operational purposes, abuse prevention, or legal compliance, even with no-training settings enabled.
  • Technical failures, security breaches, or policy changes by Third-Party AI Providers could affect data protection, which are beyond our control.
  • We make no representations or warranties regarding the absolute security or privacy practices of Third-Party AI Providers, despite our configuration of available protection settings.

BY USING OUR SERVICES, YOU ACKNOWLEDGE THAT: (1) WE HAVE CONFIGURED NO-TRAINING SETTINGS WITH THIRD-PARTY AI PROVIDERS TO PROTECT YOUR BOARD CONTENT; (2) WE RELY ON THESE PROVIDERS TO HONOR SUCH SETTINGS; AND (3) YOU UNDERSTAND THE LIMITATIONS DESCRIBED ABOVE. WHILE WE TAKE MEASURES TO PROTECT YOUR DATA, YOU SHOULD EXERCISE CAUTION WITH HIGHLY SENSITIVE OR CONFIDENTIAL INFORMATION AND REVIEW THE PRIVACY POLICIES OF THE THIRD-PARTY AI PROVIDERS.

2. Information We Collect

2.1 — Information You Provide

We collect information that you voluntarily provide when using our Services, including:

  • Account Information: Name, email address, password, profile photo, and the account settings and preferences you choose.
  • Payment Information: Billing details processed by our third-party payment processor (we do not store complete payment card information).
  • Workspace and Board Content: The workspaces, boards, lists and cards you create, together with card titles, descriptions, comments, action items, labels, votes, card groups, board chat messages, and any files you attach.
  • Assistant Inputs: Prompts and instructions you send to the AI assistant, the conversations it keeps, and anything you ask it to remember across conversations.
  • Generated Content: AI-generated outputs and your edits to them.
  • Communications: Messages with our support team and feedback.
  • Other Voluntary Submissions: Survey responses, preferences, and settings.

2.2 — Automatically Collected Information

We automatically collect certain information when you access our Services:

  • Device Information: IP address, browser type, operating system, device identifiers, and mobile network information.
  • Usage Data: Pages visited, features used, time spent, click patterns, and interaction data.
  • Cookies and Similar Technologies: Information collected through cookies, web beacons, and similar tracking technologies.
  • Log Data: Access times, error reports, referring URLs, and other diagnostic data.

3. How We Use Your Information

We use collected information for the following purposes:

  • Service Provision: To provide, operate, maintain, and improve our Services.
  • AI Assistance: To process your requests to the assistant and produce the answers and board changes you ask for, through Third-Party AI Providers.
  • Collaboration: To make your content available to the other members of your workspace, according to the access you and your workspace administrators grant.
  • Account Management: To manage your account and provide customer support.
  • Payment Processing: To process transactions and prevent fraud.
  • Service Improvement: To analyze usage patterns, troubleshoot issues, and enhance user experience.
  • Communications: To send service-related notices, updates, security alerts, board notifications, and promotional messages (with your consent where required).
  • Security and Abuse Prevention: To detect and prevent fraud, abuse, and security threats.
  • Legal Compliance: To comply with legal obligations and enforce our terms.
  • Research and Development: To conduct internal research, analytics, and development (excluding use of your content for training AI models without your explicit consent).

IMPORTANT: We do not use your board content, your assistant inputs or your generated content to train or improve our own AI models.

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

4.1 — Third-Party AI Providers

Your prompts and the board content the assistant reads are transmitted to Third-Party AI Providers to produce the outputs you request. We have configured our accounts with these providers to enable no-training settings, which means your content should not be used to train or improve their AI models. However, these providers operate independently and are governed by their own privacy policies. You should review the privacy policies of Third-Party AI Providers to understand how they handle your data.

4.2 — Service Providers and Sub-Processors

We may share information with trusted third-party service providers who assist in operating our Services, including payment processors, hosting providers, analytics services, customer support platforms, and email service providers. These service providers are contractually obligated to use your information only for the purposes of providing services to us and to maintain appropriate security measures.

The providers we currently rely on are:

  • Vercel — application hosting, website analytics and performance monitoring.
  • Supabase — database hosting, and file storage for the attachments and profile photos you upload.
  • Stripe — payment processing and subscription billing.
  • Resend — transactional email, including verification, password reset, invitations and notifications.
  • OpenRouter — routing of assistant requests to the model providers named above.
  • OpenAI — short background AI tasks, such as summarizing a card description.
  • Tavily — web search on the assistant's behalf, where you use it.
  • Sentry — error monitoring and diagnostics.
  • PostHog — product analytics.
  • Google Analytics — website analytics on our marketing pages.

4.3 — Your Workspace and the People You Share With

KYZEN is collaboration software, and content you create inside a workspace is visible to the other members of that workspace according to the access granted to them. Workspace administrators can administer every board in the workspace; members see the boards they are granted access to; limited members see only the cards they created or are assigned to. Your name, email address and profile photo are visible to the other members of the workspaces you belong to, and your activity on a board — cards created, moved, assigned, commented on — is recorded in that board's history and shown to the people who can see that board.

If you make a board public and share it by link, its content becomes accessible to anyone holding that link, without an account. If you share content through any other public feature, that information will be accessible to others according to your sharing settings. You should carefully consider what information you share publicly. Content shared with third-party applications or services is governed by their own privacy policies.

4.4 — Applications You Connect

You can issue API keys and authorize third-party applications, AI agents and other clients to act on your behalf. An application you authorize acts with your access: it can read and change the same content you can, until you revoke it from your account settings. What that application then does with the data it retrieves is governed by its own privacy policy, not by this one.

4.5 — Legal Requirements and Protection

We may disclose information when required by law, court order, or governmental request, or when we believe in good faith that disclosure is necessary to: (a) comply with legal obligations; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing, fraud, or abuse; (d) protect the safety, security, and integrity of our Services, users, or the public; or (e) protect against legal liability. We may share information with government authorities, industry peers, or other third parties to comply with these obligations.

4.6 — Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction.

4.7 — Affiliates

We may share information with our affiliates (entities that control, are controlled by, or are under common control with us). Our affiliates will use your information in a manner consistent with this Privacy Policy.

4.8 — No Sale or Sharing for Advertising

IMPORTANT: We do not "sell" your personal information or "share" your personal information for cross-contextual behavioral advertising as those terms are defined under applicable state privacy laws (including the California Consumer Privacy Act). We do not process your personal information for "targeted advertising" purposes. We also do not process sensitive personal information for the purpose of inferring characteristics about you.

5. Data Retention

We retain your information for as long as necessary to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements:

  • Account Information: Retained until you request deletion or your account is terminated for inactivity.
  • Content and Usage Data: Retained for the duration of your account and up to 30 days after deletion, unless longer retention is required by law.
  • Payment Information: Retained by payment processors according to their policies and applicable financial regulations.
  • Log and Analytics Data: Retained for operational, security, and legal compliance purposes, typically for up to 90 days.
  • Legal and Safety Data: Information related to legal matters, security incidents, or policy violations may be retained longer as necessary to resolve disputes, prevent fraud, or comply with legal obligations.

Content You Contributed to a Workspace: Work you contributed to a workspace belongs to that workspace's record of the work, and does not disappear from it when you leave or delete your account. Cards you created, comments you wrote and files you attached remain with the boards they were added to, alongside the name and profile photo you had at the time you wrote them. Your account, your sessions, your assistant conversations and memories, your API keys and your profile photo are deleted with your account.

Third-Party AI Provider Retention: With our no-training configuration enabled, your data should only be retained by Third-Party AI Providers for limited operational purposes (such as generating outputs, abuse monitoring, and legal compliance) rather than indefinite retention for model training. However, specific retention periods are determined by Third-Party AI Providers' policies, which you should review independently.

Deleted Content: When you delete content or your account, we will remove it from our active systems within 30 days, unless we are legally required to retain it longer. Some cached or archived copies may persist in backup systems for a limited time.

6. Data Security

We implement reasonable administrative, technical, and physical security measures to protect your information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit (TLS 1.2+) and at rest (AES-256), access controls, secure authentication, and regular review of our security posture. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your data, particularly once it is transmitted to Third-Party AI Providers. If we experience a data breach that affects your personal information, we will notify you and relevant authorities as required by law.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

7.1 — Rights Available to All Users

  • Access: See the personal information we hold about you.
  • Correction: Correct inaccurate or incomplete information.
  • Deletion: Delete your personal information (subject to legal obligations and legitimate business purposes).
  • Opt-Out of Marketing: Unsubscribe from promotional emails using the link in the email, and choose which notifications you receive in your account settings.
  • Data Portability: Obtain a copy of your personal data in a portable, machine-readable format.
  • Account Deletion: Delete your account through your account settings.

7.2 — How to Exercise Your Rights

Your account settings cover most of these directly: you can see and correct your profile, change your email address and password, choose which notifications you receive, review and revoke the applications and API keys connected to your account, read and delete everything the assistant has remembered about you, and delete your account entirely from the Security page. Deleting your account is confirmed by email before it takes effect. For access, portability, or anything the settings do not cover, email us at the address at the end of this policy and we will respond within the period your jurisdiction requires.

7.3 — Verification Process

To protect your personal information from unauthorized access, disclosure, or deletion, we may require you to verify your identity before processing your privacy request. We may ask you to provide: (a) your email address and account information; (b) confirmation from the email address on the account; or (c) government-issued identification if we suspect fraudulent or malicious activity. If you do not have an account with us, we may require additional information to verify your identity.

7.4 — Authorized Agents

You may designate an authorized agent to make privacy requests on your behalf. To do so, you must: (a) provide the agent with written permission signed by you; (b) verify your identity with us; and (c) confirm that you have authorized the agent to act on your behalf. We may require the agent to provide proof of authorization, such as a power of attorney document, before processing the request.

7.5 — Important Limitations

CRITICAL LIMITATION: We cannot retrieve, modify, or delete information that has been transmitted to and processed by Third-Party AI Providers. For requests related to data held by Third-Party AI Providers, you must contact these providers directly. The providers we use are named in this policy, to assist you in making such requests.

Content in a Shared Workspace: Where you have contributed content to a workspace you do not own, we may be unable to delete that content on your behalf without also destroying another party's records. In those cases we will remove or de-identify what we can and explain what remains and why.

We will not discriminate against you for exercising any of your privacy rights.

8. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to keep you signed in, remember your preferences, collect usage information, improve user experience, analyze Service performance, and deliver personalized content. Analytics cookies are set by the analytics providers named in this policy. You can control cookie preferences through your browser settings. Note that disabling cookies may limit functionality of our Services — in particular, we cannot keep you signed in without them.

9. Children's Privacy

Our Services are not intended for children under 13 years of age (or 16 in certain jurisdictions). We do not knowingly collect personal information from children under the applicable minimum age.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States and locations where Third-Party AI Providers operate. These countries may have different data protection laws than your jurisdiction. When we transfer personal information internationally, we implement appropriate safeguards, such as standard contractual clauses approved by the European Commission, to protect your information. By using our Services, you consent to such transfers.

11. California Privacy Rights (CCPA/CPRA)

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete personal information, the right to correct inaccurate information, the right to opt-out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right to non-discrimination for exercising these rights.

Important Disclosure: We do not sell your personal information. We do not share your personal information for cross-contextual behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those specified in the CCPA.

"Shine the Light" Law: California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

12. European Union Users (GDPR)

If you are located in the European Union, European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) and equivalent laws, including rights to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing, and the right not to be subject to automated decision-making. You also have the right to lodge a complaint with your local supervisory authority if you believe we have violated your rights.

Legal Basis for Processing: We process your personal information based on the following legal grounds: (a) performance of a contract with you (providing the Services); (b) legitimate interests (improving Services, security, fraud prevention); (c) consent (where you have provided it); and (d) legal obligations (compliance with laws). You have the right to withdraw consent at any time where processing is based on consent.

13. Other U.S. State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, and other U.S. states with comprehensive privacy laws have similar rights to those described above, including the right to access, correct, delete, and obtain a copy of their personal information, as well as the right to opt-out of targeted advertising and the sale of personal information. The specific rights and processes may vary by state.

14. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. We will notify you of material changes by posting the updated policy on our websites, updating the "Last Updated" date, and providing notice through the Services or via email. Your continued use of our Services after changes become effective constitutes acceptance of the revised Privacy Policy. We encourage you to review this Privacy Policy periodically.

15. Disclaimer of Warranties

THE SERVICES AND ALL CONTENT, FEATURES, AND FUNCTIONALITY ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. WE DISCLAIM ALL WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE MAKE NO REPRESENTATIONS OR WARRANTIES REGARDING THE ACCURACY, SECURITY, OR PRIVACY PRACTICES OF THIRD-PARTY AI PROVIDERS.

16. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING DAMAGES FOR LOSS OF PROFITS, DATA, USE, OR OTHER INTANGIBLE LOSSES, ARISING FROM OR RELATED TO YOUR USE OF THE SERVICES, THIRD-PARTY AI PROVIDER PRACTICES, DATA BREACHES, OR UNAUTHORIZED ACCESS TO YOUR INFORMATION, EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

17. Acceptance of Terms

By using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this Privacy Policy, you must not use our Services.

Contact Us

If you have questions about this Privacy Policy, or wish to make a request about your personal information, please contact us at:

hello@balloon.black