Privacy Policy

Privacy Policy

Kyvvu B.V. Nijmegen, the Netherlands Chamber of Commerce: 99594234 Email: privacy@kyvvu.com

Last updated: 12 October 2026

Introduction

Kyvvu B.V. (“we”, “our”, “Kyvvu”) is the controller of the personal data described in this policy. It covers our website (kyvvu.com), our business relationships with customers, partners and prospects, and job applications.

For the personal data that customers process through the Kyvvu platform, the customer is the controller and Kyvvu is the processor. That processing is governed by the data processing agreement that forms part of our terms, not by this policy. Section 3 describes it briefly.

1. What data we collect

Website visitors

Our website is a static site. We do not use cookies, analytics or tracking technologies, and the site has no forms that collect personal data.

The site is served by GitHub Pages. As with any web host, GitHub receives technical request data (IP address, browser type, requested page) in order to deliver the page and secure its service. The site loads its typeface from Google Fonts, so Google receives the same technical request data when a page is loaded. Kyvvu has no access to these logs and does not combine them with other data.

If you email us, we receive whatever you choose to send.

Customers, pilot participants and partners

  • Name, business email address, company, role
  • Billing details, where applicable
  • Our correspondence with you
  • Account details for the Kyvvu platform (name, email address, organization, authentication data)

We collect this when you sign an agreement with us, create a platform account at platform.kyvvu.com, or communicate with us about our services.

Business contacts and prospects

Name, business email address, company, role, and a record of our contact with you. We obtain this from you directly, at events, or from public professional profiles such as LinkedIn.

Job applicants

The information you send us when you apply: CV, cover letter, contact details, and notes from interviews. If you apply through a recruiter, we receive your details from the recruiter.

  • Contract (Art. 6(1)(b) GDPR): delivering our services, managing customer accounts, handling your application at your request.
  • Legitimate interest (Art. 6(1)(f) GDPR): operating and securing our website, answering inquiries, maintaining business relationships and contacting business prospects about our services. You can object at any time.
  • Legal obligation (Art. 6(1)(c) GDPR): tax and accounting records.
  • Consent (Art. 6(1)(a) GDPR): only where we ask for it explicitly, for example to keep an application on file. You can withdraw consent at any time.

3. The Kyvvu platform

Kyvvu is an Agent Security Kernel: a library that runs inside the customer’s own agent process and evaluates each agent action there.

The Kyvvu control plane, which we host on Amazon Web Services in Frankfurt (eu-central-1), stores customer accounts, configuration and policies, agent registrations, and a log of each step an agent takes under Kyvvu’s policies: the type of step, the policy decision and a tamper-evident audit trail. The customer configures how much of each step’s input and output the agent includes in that log, from none at all up to the full input and output. We process this data as processor, on the customer’s instructions and under the data processing agreement, and keep it for the duration of the agreement. We access customer data only when the customer authorizes it for support.

4. How we use your data

  • To deliver and support the Kyvvu platform and related services
  • To manage accounts, agreements and billing
  • To answer inquiries and maintain business relationships
  • To inform business contacts about our services; every such message can be refused for the future
  • To assess job applications
  • To meet legal obligations

We do not sell or rent personal data, and we do not share it with advertisers or data brokers.

5. Who receives your data

We use service providers that process personal data on our behalf, under a data processing agreement:

  • Amazon Web Services (EU, Frankfurt): hosting of the Kyvvu platform
  • Google Workspace (data stored in the EU): email, documents and file storage
  • Notion: customer and contact administration, internal documentation
  • Slack: internal communication, which may mention customer names and contact details
  • GitHub: website hosting and source code
  • Anthropic and OpenAI: AI assistants used for internal work such as drafting and coding, which can involve business contact details

Other recipients:

  • Our accountant and the Dutch tax authorities: billing and financial records
  • Implementation partners: only when you engage them for a pilot or implementation, and only what is needed to deliver it
  • Authorities: where the law requires it

6. Transfers outside the EU

Platform data is hosted in the EU. Some of our service providers (Notion, Slack, GitHub, Anthropic, OpenAI, and Google for support purposes and font delivery) are US companies and may process personal data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

If you deploy the Kyvvu platform on infrastructure outside the EU, you control that location.

7. How long we keep data

  • Customer and business contact data: for the duration of the relationship; records needed for tax and accounting are kept for 7 years afterwards, as Dutch law requires
  • Prospect data: until you object, or 2 years after our last contact
  • Platform account data: for the duration of the agreement, then deleted
  • Agent step logs on the Kyvvu platform (processed for the customer): for the duration of the agreement, then deleted
  • Job applications: up to 4 weeks after the procedure ends, or up to 1 year if you consent to us keeping your application on file

After these periods the data is deleted.

8. Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. Email privacy@kyvvu.com; we respond within 30 days.

You can also lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

9. Security

Kyvvu operates an information security management system based on ISO/IEC 27001. Measures include encryption in transit and at rest, multi-factor authentication, role-based access, logging and monitoring, and an incident response procedure. More detail is on our security page.

10. Children

Our services are not directed at individuals under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy. The date at the top shows the latest version. We notify customers by email of changes that materially affect how we process their data.

12. Contact

Kyvvu B.V., Nijmegen, the Netherlands Email: privacy@kyvvu.com