Legal

Privacy Policy

Last updated: April 10, 2026 · Effective: April 10, 2026

This policy explains what data we collect, why we collect it, and how we use it. We are committed to handling your data with care and transparency. KUVEX does not sell your personal data to third parties.

1. Who We Are

KUVEX ("we", "us", "our") operates CodePilot, an autonomous AI software engineering tool available at kuvex.ai. This Privacy Policy applies to all users of our website and desktop application.

For privacy-related inquiries, contact: privacy@kuvex.ai

2. Data We Collect

2.1 Data you provide directly

Account information: Email address, password (stored as a secure hash), name (if provided via OAuth)
OAuth profile data: If you sign in with Google or GitHub, we receive your public profile name, email address, and avatar as provided by those services
Support communications: Any information you provide when contacting our support team

2.2 Data collected automatically

Usage data: Features used, commands issued, session duration, error logs
Device data: Operating system, app version, general region (not precise location)
Authentication data: Session tokens stored locally on your device

2.3 Code and content

When you use CodePilot's AI features, code snippets and instructions you provide are transmitted to AI model providers to generate responses. This data is processed in transit and is not permanently stored by KUVEX beyond what is necessary to fulfill your request. We do not use your code to train AI models.

2.4 Payment data

Payment processing is handled entirely by Paddle.com Market Limited. KUVEX does not receive or store your full payment card number, CVV, or banking credentials. We receive only a subscription status confirmation and your email address from Paddle.

3. How We Use Your Data

Purpose	Legal Basis
Providing and operating the Service (authentication, subscription gating, download access)	Contract performance
Processing payments and managing subscriptions via Paddle	Contract performance
Sending transactional emails (account confirmation, billing receipts)	Contract performance
Diagnosing bugs and improving the Service	Legitimate interest
Preventing fraud and enforcing our Terms of Service	Legitimate interest
Complying with legal obligations	Legal obligation
Sending product update emails (you may opt out at any time)	Legitimate interest / Consent

4. Third-Party Services

We rely on the following trusted third-party services to operate CodePilot:

Service	Purpose	Data Shared
Supabase	Authentication, user database, subscription status	Email, subscription status, session tokens
Paddle	Payment processing, subscription management, tax compliance	Email, billing details (handled by Paddle directly)
Google	Optional OAuth sign-in	Public profile if you choose Google sign-in
GitHub	Optional OAuth sign-in	Public profile if you choose GitHub sign-in
AI Providers (Anthropic, OpenAI, etc.)	Generating AI responses to your coding requests	Code snippets and prompts submitted by you

Each of these providers maintains their own privacy policy. We encourage you to review them.

5. Data Retention

Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
Subscription data: Retained for 7 years as required for financial record-keeping compliance.
Code/prompts sent to AI providers: Not retained by KUVEX beyond the request/response cycle.
Support communications: Retained for 2 years.
Usage logs: Aggregated and anonymized after 90 days.

6. Cookies and Local Storage

Our website uses minimal cookies:

Authentication session cookie: Set by Supabase to keep you logged in. Required for the Service to function. Expires when you log out or after 7 days of inactivity.
No tracking or advertising cookies are set by KUVEX on our website.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion of your account and associated personal data
Portability: Request your data in a machine-readable format
Objection: Object to processing based on legitimate interest
Opt-out of marketing: Unsubscribe from marketing emails at any time via the unsubscribe link or by emailing us

To exercise any of these rights, email privacy@kuvex.ai. We will respond within 30 days.

8. Data Security

We implement industry-standard security measures including:

HTTPS encryption for all data in transit
Passwords stored as bcrypt hashes (never in plaintext)
Authentication handled by Supabase with row-level security policies
Payment data handled entirely by Paddle — we never touch your card details

No method of transmission over the internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. International Transfers

Your data may be processed in countries outside your jurisdiction, including by our third-party service providers (Supabase, Paddle, AI providers). We ensure appropriate safeguards are in place for such transfers in accordance with applicable data protection laws.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or via a notice on our website. Continued use of the Service after such notice constitutes acceptance of the updated policy.

Privacy Contact

For any privacy-related questions, requests, or concerns:

📧 privacy@kuvex.ai

🌐 kuvex.ai

🏢 KUVEX