Legal

Privacy Policy

Effective date: 1 May 2026 · Last updated: 1 May 2026 · Version: 1.0

This Privacy Policy explains how Kitero, operated by Sakthi Robotics & Automations Private Limited ("Kitero", "we", "us", "our"), collects, uses, stores, and protects your personal data when you use the Kitero service. We process personal data in compliance with India's Digital Personal Data Protection Act 2023 (DPDP Act).

    Our core commitment: We never sell your personal data. We never use your conversations to train AI models. We never show you advertisements. Your study data is yours.
  

1. Data controller

The data controller responsible for your personal data is Sakthi Robotics & Automations Private Limited, Chennai, Tamil Nadu, India. For privacy enquiries, contact us at privacy@kitero.ai.

2. Who can use Kitero

Kitero is available to users aged 18 years and above only, based in India. We do not knowingly collect data from anyone under 18. If we discover a user is under 18, we will immediately delete their account and all associated data.

3. What data we collect

Data type	What we collect	Why we collect it
Account data	Name, email address, country, hashed password	To create and manage your account
Chat data	Messages you send, AI responses, chat titles, folder names	To provide the study assistant service and save your history
Usage data	Message count, feature usage, login timestamps	To enforce fair usage limits and improve the service
Payment data	Subscription status, billing country. Card details are handled by Stripe — we never see your full card number	To process payments
Technical data	IP address (anonymised after 30 days), browser type, device type	Security, fraud prevention, and service reliability

4. How we use your data

Purpose	Legal basis (DPDP Act 2023)
Providing and operating the Kitero service	Consent / Contract
Processing payments	Contract
Sending service emails (account, billing, security)	Consent / Legitimate use
Safety and security monitoring	Legitimate use
Compliance with legal obligations	Legal obligation
Improving the service (aggregate, anonymised data only)	Legitimate use

We do not use your conversations to train AI models. Your chats are processed by OpenAI's API solely to generate responses. We have enabled data retention opt-out with OpenAI where available.

5. Data sharing

We share your data with trusted third-party service providers only where necessary:

Provider	Purpose	Data shared
OpenAI	AI response generation	Chat messages (no personal identifiers sent in prompts)
Stripe	Payment processing	Email, subscription status, billing country
MongoDB Atlas	Database hosting	All user data (encrypted at rest)
SMTP provider	Transactional email	Email address, name

All providers are contractually bound to process data only for specified purposes. We do not sell, rent, or trade your personal data with any third party.

6. Data retention

Account data: Retained while your account is active, deleted within 30 days of account deletion
Chat history: Retained while your account is active. Deleted when you delete a chat or your account
Payment records: Retained for 7 years for tax and legal compliance
Security logs: Retained for 90 days, then deleted

7. Your rights under the DPDP Act 2023

Right to information — know what data we hold about you
Right to correction and erasure — correct or delete your data
Right to grievance redressal — raise complaints with us or the Data Protection Board of India
Right of nomination — nominate a person to exercise rights on your behalf

To exercise any right, email privacy@kitero.ai with subject "Privacy Request". We will respond within 30 days. You can also manage your data directly in the app at Settings → Privacy.

8. Security

All data encrypted in transit using TLS 1.2+
Database encrypted at rest
Passwords hashed using bcrypt (never stored in plain text)
JWT tokens with short expiry and refresh rotation
Rate limiting on all API endpoints
Two-layer content moderation on all AI inputs

To report a security vulnerability, email security@kitero.ai.

9. Cookies and local storage

Authentication token (localStorage / httpOnly cookie) — keeps you logged in. Essential for the service.
Theme preference (localStorage) — remembers your light/dark mode preference.
Refresh token (httpOnly cookie) — secure session management. Cannot be accessed by JavaScript.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

10. Changes to this policy

We will notify you of material changes by email or in-app notification at least 14 days before changes take effect. The "Last updated" date at the top always shows the most recent version.

11. Contact

Privacy enquiries: privacy@kitero.ai
Security issues: security@kitero.ai
Data controller: Sakthi Robotics & Automations Private Limited, Chennai, Tamil Nadu, India