Privacy Policy

KD Vector is the controller of the personal data described in sections 2 and 3, which we collect to run the Service. Where you put personal data about other people into templates or send it to the API to be rendered, you are the controller of that data and we process it on your instructions (section 4). Contact for anything in this policy: support@kdvector.com.

• Account. Your email address, a display name if you give one or your sign-in provider supplies one, your plan, and the time your account was created and last updated. Sign-in is by email link or Google; we receive your Google account's email and name and nothing else from Google.
• Workspaces and invites. Workspace names, who belongs to them and with what role, and, for people you invite, the name and email address you enter. Invitees receive one email with the invite link; an invite that is not accepted expires after 7 days.
• Content. The templates, themes, custom blocks and uploaded files (PDF, PNG, JPEG, TTF, OTF, WOFF) you or your workspace store, with who created and last edited each and when, and every published revision.
• API keys. A key's name, scopes, owner, creator, expiry and the times it was created, last used and revoked. We store only a hash of the key itself, so the key cannot be recovered from our records.
• Render requests. The data you send with a render request is used to produce that one output and is not stored afterwards. It does not appear in logs or error reports.
• Usage and device data. Request logs with the endpoint, method, status, timing and a request id; the IP address and browser or client identifier attached to requests by our hosting provider; and page-view analytics (page path, referrer, country, device type and browser). Analytics use no cookies and do not track you across sites.
• Billing. When you subscribe, Stripe collects your payment details directly. We receive your subscription status, plan, billing email, the last four digits and brand of your card, and invoice history. We never see your full card number.
• Support. Anything you send us by email, and our replies.

• To provide the Service (performance of our contract with you): signing you in, storing and rendering your Content, sharing it inside workspaces, enforcing plan limits and API key scopes, billing, and emailing you sign-in links, invites and account notices.
• To keep it secure and reliable (our legitimate interests): request logs, rate limiting, abuse detection and debugging. Logs are kept for no more than 30 days unless needed for an ongoing investigation.
• To understand how the Service is used (our legitimate interests): aggregate page-view analytics. We do not build individual profiles from it.
• To tell you about changes (our legitimate interests and, where required, your consent): emails about changes to terms, pricing, security incidents and features that affect your account. You can opt out of feature news; you cannot opt out of notices the law or these terms require.
• To meet legal obligations: tax records, responding to lawful requests, and enforcing our terms.

We do not sell personal data, share it for cross-context behavioural advertising, or use your Content to train machine learning models.

Templates often contain, or are rendered with, personal data about your own customers, employees or users: names, addresses, order details, anything you bind into a document. For that data you are the controller and we are your processor. We process it only to store your templates and render the outputs you request, keep it inside the account or workspace that owns it, and delete render data as soon as the output is produced. Our sub-processors are listed in section 6. A data processing agreement with standard contractual clauses is available on request.

The Service sets only cookies it needs to function:

• Session cookies from our sign-in provider that keep you signed in. They are removed when you sign out and expire on their own.
• Preference cookies that remember which workspace you last opened and whether the sidebar is collapsed.

There are no advertising or cross-site tracking cookies, so there is no cookie banner. The editor keeps some working state in your browser's local storage; it never leaves your device.

We share personal data only with providers that help us run the Service, under contracts that limit what they may do with it:

• Supabase (database, authentication and file storage), hosted in the United States (AWS us-east-1).
• Vercel (application hosting, request logs and page-view analytics), United States.
• Resend (delivery of sign-in links, invites and account email), United States.
• Google (sign-in, only if you choose "Continue with Google").
• Stripe (payments and invoicing for paid plans).

Beyond that, we disclose personal data only if the law requires it, to protect the rights, safety or property of KD Vector or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply and we will tell you before your data becomes subject to a different one. We will update this list before adding a sub-processor that handles Content.

Personal data is stored and processed in the United States. If you use the Service from the European Economic Area, the United Kingdom or Switzerland, that is a transfer outside your region. We rely on the European Commission's standard contractual clauses, and the UK addendum where relevant, with each provider in section 6, and on your instructions to process Content there. Copies are available on request.

• Account and Content: for as long as your account exists. Deleting your account (section 9) removes it immediately from the live database and file storage; copies in encrypted backups roll off within 30 days.
• Workspace content stays with the workspace after you leave it, because it belongs to the workspace, not to you personally.
• Render data: not kept.
• Request logs: up to 30 days.
• Invites: until accepted, withdrawn or expired, then with the workspace's records until the workspace is deleted.
• Billing records: 7 years, as tax law requires.
• Support email: up to 2 years after the thread closes.

You can do most of this yourself, without asking us:

• See and correct your email and name on the account page, and your Content in the editor or through the API.
• Export any template, theme, asset or block through the API, which returns them in full.
• Delete your account from the account page. This is immediate and permanent.
• Revoke an API key or leave a workspace at any time.

Depending on where you live you may also have the right to ask us for a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, to data portability, and to withdraw consent where we rely on it. Residents of California and other US states with privacy laws may also ask what we collect and share, and are entitled not to be treated differently for exercising those rights. Email support@kdvector.com and we will answer within 30 days, after confirming the request comes from the account holder. If you are unhappy with our answer you may complain to your local data protection authority; in the EEA that is the authority in your country, and in the UK the Information Commissioner's Office.

If your data reached us through someone else's template or render request, please contact that organization first; we will help them respond.

All traffic to the Service is encrypted in transit, and data is encrypted at rest by our hosting providers. Access to your Content is enforced in the database itself, per account and per workspace, on every request. API keys are stored as hashes. Only the engineers who need production access for support and operations have it, and that access is logged. No system is perfectly secure; if we learn of a breach that affects your personal data we will tell you without undue delay and, where the law requires, within 72 hours of becoming aware of it.

The Service is not directed at children under 13 and we do not knowingly collect their personal data. If you believe a child under 13 has an account, email us and we will delete it.

When we change this policy we will update the effective date at the top. For changes that reduce your rights or expand what we collect or share, we will email the address on your account at least 14 days before they take effect. The Terms of Service describe your options if you do not agree.