Privacy

This notice describes how Kelvane (“we”) handles personal data when you use kelvane.dev and related APIs. Kelvane is operated by a single-person company. This is a working notice written to match the product as shipped, not a SOC 2 report and not a substitute for counsel. Questions: hello@kelvane.dev.

Who is responsible

For accounts and marketing-site visits, Kelvane is the controller. Auth0, Stripe, and Anthropic process data we send them to provide login, billing, and model inference. If the app is later hosted outside Kelvane, that host is not us unless a written agreement says so.

What we collect

Account

Auth0 sends us an identifier (sub), email, and any name you have on that identity. We keep a prepaid credit balance and ledger for builds, plus free daily/monthly grant counters. Cutover and hosting remain quote-based and are not charged self-serve.

Sessions and generated work

Briefs, chat/build events, workspace files the agent writes, preview artifacts, share/publish metadata, and session status. Files and process are meant to survive refresh and show in your sidebar until you delete the session.

Uploads

For a new app you may attach screenshots, CSV/TSV seed data, and short specs (PDF/text/markdown). Those are size-capped, type-checked by magic bytes, scanned, and only then copied into the session workspace. HTML, SVG, executables, and office macros are rejected.

For an existing system, source archives and SQL are accepted only after you accept the session NDA. Objects land in quarantine (incoming/). The agent and Discovery job read only clean/ copies. Failed scans are not marked clean and are not sent to the model. Share and preview never serve customer source from clean/.

Wrap questionnaire and estimates

Answers about system size, shape, pain, and compliance are stored on the session so we can show a range. That range is not a binding quote. A paid cutover is a conversation after NDA and code access.

Payments

Stripe processes cards for prepaid credit packs. We store Stripe customer and checkout/payment references needed to fulfill packs — not full card numbers. Human quotes for cutover or hosting are handled separately.

Logs

Technical logs, rate-limit counters, audit events (including upload accept/reject and guardrail hits), and job usage (token counts used to meter our cost). We do not need your password; Auth0 holds that.

Cookies and local device

See Cookies. Cookie preference is stored in your browser (localStorage), not as a server profile.

Why we use it

• To create and keep your account and workspaces.
• To build new apps and to map and rebuild existing systems.
• To scan uploads and keep malware and disallowed types out of the model path.
• To enforce rate limits and refuse abusive jobs.
• To respond to you at the email on the account.
• Optional: page-view analytics if you consent and Plausible is configured.

Legal bases, where GDPR applies: contract (providing the service), legitimate interests (security, abuse prevention, operating a small SaaS), and consent (optional analytics).

Models and subprocessors

We do not operate a Kelvane foundation model and we do not train one on your sessions. Greenfield and wrap jobs send prompts and allowed snippets to Anthropic. Wrap zips are not sent until they scan clean. Do not put live secrets in a brief when a redaction will do. Anthropic’s terms govern that inference.

• Auth0 — authentication and session cookies.
• Stripe — checkout for prepaid credit packs and related invoices.
• Anthropic — agent, Discovery, and Facade inference.
• Plausible — page views, only after analytics consent, and only if we have set a domain.

Preview today runs on an isolated worker we operate (local process in development; a sandbox provider if configured). Untrusted shell does not run on the Next.js request path. We may change hosting as the product matures; this notice will be updated when processors change in a material way.

Those vendors may process data in the United States or other countries. If that is a problem for your data, do not upload it.

What we are not

Kelvane preview is not, by default, a production host, a HIPAA environment, or a PCI store. We do not offer a BAA in this version of the product. Do not put real patient records, live card data, or production secrets into briefs, CSVs, or wrap zips. HIPAA-ready processing, if ever, is a later written engagement — not implied by ticking a compliance chip on the questionnaire.

We do not sell personal data. We do not run ad pixels today.

Retention and deletion

• Workspace files last until you delete the session (the product exposes session delete) or you ask us to delete the account.
• Wrap objects that fail scan are not promoted to clean. We intend rejected objects not to linger; email us if you need confirmation a specific upload is gone.
• Records of quoted engagements are kept as long as we must for tax and dispute handling.
• You may request access or deletion at hello@kelvane.dev. We will need enough to identify the Auth0 account. We may retain what the law requires (fraud, accounting).

Apps that leave Kelvane (export) fall under that other host’s notice. Apps that remain on Kelvane stay under this one.

Cookies

Essential. Auth0 sets session cookies so we know who is signed in. Without them you cannot log in. They are not used for ads and they are not optional if you use the product.

Analytics (optional). If you accept, and if Plausible is configured, we load a page-view script. It is not a marketing pixel. It does not run until you agree. Rejecting analytics does not change builds or login.

“Reject all” stores that preference in your browser so we do not load analytics on later visits. Re-open Cookie settings from the footer. We do not currently run Google Ads tags or similar.

Children

The service is for people 18 or older who can form a contract. We do not knowingly collect data from children.

Changes

If we add a processor, start using analytics in production, or change retention in a way that affects you, we will update this page and the date above. Continued use after the date is acceptance of the updated notice, except where the law requires a new consent (analytics).