Privacy Policy

1. Introduction & Scope

Kivara AI ("Kivara," "we," "our," or "us") provides an advanced artificial intelligence platform enabling interactive character conversations, contextual long-term memory, custom character creation, and image generation. This Privacy Policy governs your use of Kivara AI across our web application (kivara.app), Telegram Mini Apps, Telegram bots, and related APIs (collectively, the "Service").

We are committed to transparent data stewardship and aligning our practices with global data protection frameworks, including the European Union General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

2. Information We Collect

We adhere to the principle of data minimization, collecting only information necessary to deliver, secure, and personalize our AI services:

2.1 Account & Identity Information

• Direct Registration: Email address, hashed credentials, and chosen display name.
• Single Sign-On (Google OAuth): Name, verified email address, Google unique account identifier, and profile picture URL as permitted by your Google account settings.
• Telegram Authentication: Telegram User ID, first and last name, public username, language code, and cryptographic validation hash when using our Telegram Bot or Telegram Mini App.

2.2 Conversational Content & Creative Assets

• Chat Transcripts & Roleplay: Messages exchanged between you and AI characters, including conversation branching, variant choices, and interaction parameters.
• Vector Memory Embeddings (RAG): Vectorized mathematical representations of character knowledge, dialogue context, and episodic memory generated to maintain long-term memory continuity across chat sessions.
• Character Builder Configurations: Custom character names, avatar images, psychological traits, background lore, greetings, and system prompts you author.
• Image Generator Inputs & Outputs: Text prompts, negative prompts, aspect ratio selections, seed parameters, and synthesized visual artwork.

2.3 Payment & Subscription Data

Payments for subscriptions and credits are processed via secured third-party providers (including Telegram Stars and certified card payment gateways). Kivara AI does not collect or store raw payment card numbers, CVVs, or bank account credentials. We receive only billing tokens, plan status, transaction identifiers, and credit balances.

2.4 Telemetry, Diagnostics & Device Information

• IP address, approximate geographic location (country/city level), and timezone.
• Browser engine, operating system, device model, and display resolution.
• Locale preferences (English, Russian, Ukrainian, German, Japanese) and active theme (dark/light mode).
• Error logs, rate limit metrics, and API latency diagnostics to maintain platform availability.

3. How We Use Your Information

We process personal and conversational data strictly for legitimate operational purposes:

• Providing AI Services: Generating responses, executing character personalities, recalling contextual memories, and rendering visual artwork.
• Memory Retrieval & Continuity: Querying vector embeddings within your private database partition to preserve ongoing character storylines.
• Billing & Account Management: Managing credit balances, subscription renewals, and Telegram Stars allocations.
• Platform Security & Abuse Prevention: Detecting automated scraping, denial-of-service attempts, fraudulent chargebacks, and violations of our Acceptable Use Policy.
• Essential Communications: Delivering transactional receipts, security verification codes, password resets, and critical policy changes.

4. Generative AI Processing & Zero Data Retention Guarantees

Your conversational privacy is fundamental to our platform design:

When processing inference requests, prompt tokens are transmitted to secure inference infrastructure (including Vercel AI Gateway and enterprise cloud partners) over encrypted TLS connections. Under our enterprise data processing agreements, inference providers process inputs transiently and are legally prohibited from retaining or training on your content.

5. Data Storage, Vector Databases & Security Architecture

We implement defense-in-depth technical and organizational safeguards:

• Encryption Standards: All data in transit is encrypted using modern TLS 1.3 protocols. All databases, vector stores, and object backups are encrypted at rest using AES-256 encryption.
• Vector Isolation: Semantic embeddings used for character recall are partitioned by account and character ID, preventing cross-tenant leakage.
• Access Controls: Production database access is governed by strict principle of least privilege, multi-factor authentication (MFA), and automated audit trails.
• Cloud Storage: Generated artwork and custom avatars are stored in secure cloud object repositories with protected access URLs.

6. Third-Party Service Providers (Sub-processors)

We share data only with vetted sub-processors essential to operating Kivara AI. Each sub-processor is bound by data processing agreements requiring standards equivalent to this policy:

7. Cookies & Local Storage

Kivara AI uses strictly necessary cookies and local storage tokens to manage user sessions, ensure CSRF security, and preserve your chosen theme (dark/light) and language preference across visits. We do not deploy third-party advertising cookies or cross-site tracking pixels.

8. Your Global Privacy Rights (GDPR & CCPA)

Regardless of your geographic location, we provide comprehensive rights over your personal data:

• Right to Access & Portability: You may request a complete export of your personal information, character creations, and chat archives in a structured, machine-readable format.
• Right to Rectification: You can edit your profile information, character lore, and generation parameters directly in the application at any time.
• Right to Erasure ("Right to be Forgotten"): You may permanently delete individual chat histories, custom characters, or your entire account. Deletion immediately invalidates sessions and cascades through relational tables and vector memory databases.
• Right to Restrict & Object: You have the right to object to or restrict processing of your information under applicable statutory circumstances.
• Non-Discrimination: We will never deny you service, charge different prices, or degrade quality for exercising statutory privacy rights.

To exercise these rights, submit a request via our in-app settings or contact privacy@kivara.app. We respond to verified requests within statutory timeframes (normally 30 calendar days).

9. Data Retention & Account Deletion Policy

We retain conversational history, custom characters, and generated assets as long as your account remains active so you can resume stories at your convenience.

When you initiate account deletion from your profile settings:

• Your account is immediately deactivated and rendered inaccessible.
• Conversational messages, system prompts, and custom character profiles are permanently purged from primary databases within 7 days.
• Associated vector memory embeddings are wiped from vector search indexes.
• Backups containing encrypted data are automatically rotated and purged in accordance with standard 30-day snapshot retention cycles.
• Minimal transaction references are preserved only where required by tax or financial reporting regulations.

10. Children's Privacy

Kivara AI is strictly designed for users who are at least 13 years old (or 16 years old for residents of the European Economic Area and the United Kingdom). We do not knowingly collect, solicit, or process personal information from children below these age thresholds. If you learn that a minor has created an account without parental consent, please contact us immediately at privacy@kivara.app for prompt account investigation and data eradication.

11. International Data Transfers

Your information may be stored and processed in server locations across the United States, the European Union, and global edge networks. When transferring data internationally, we utilize approved transfer mechanisms such as the European Commission Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements to ensure adequate cross-border protection.

12. Security Incident Notification

In the unlikely event of a security compromise affecting personal data, Kivara AI maintains an incident response protocol to contain the threat and notify impacted users and relevant regulatory authorities within 72 hours of verification, as mandated by applicable law.

13. Updates to This Policy

We may revise this Privacy Policy periodically to reflect technological advancements, new product capabilities, or legal requirements. When substantive revisions occur, we will provide prominent notice through the platform interface or via email with an updated "Last Updated" revision timestamp.

14. Contact Us

For questions, feedback, or data subject requests regarding this Privacy Policy, please reach out to our privacy compliance team: