The short version
Kitt helps businesses connect operational systems, preserve business context, review evidence, and surface items that need attention. We collect and process information needed to provide those functions, secure accounts, operate integrations, and communicate with users.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. Kitt is not built around advertising profiles.
Information we collect
The information Kitt processes depends on how you use the service and which systems your business chooses to connect.
- Account and identity information, such as email address, authentication events, account-security information, membership status, role, delegated Kitt capabilities, invitation state, and notification preferences.
- Business profile information, such as business name, owner or administrator name, industry, website, business contact details, address, service area, locality, and time zone.
- Connected-service data that you authorize Kitt to access. For example, the current QuickBooks integration can process invoice, customer, balance, due-date, source, synchronization, and connection metadata needed to provide the requested accounting context.
- Content and interactions you provide to Kitt, including chat messages, questions, corrections, notes, business rules, policy proposals, review decisions, and other business context.
- Technical and security information, such as IP address, browser or device information, session information, request logs, timestamps, diagnostics, and information used to detect abuse or protect the service.
- Email-delivery and notification information, such as which operational notifications are enabled and delivery status information supplied by our email provider.
Connected services and credentials
When you connect a third-party service, you authorize Kitt to access the data and permissions shown during that connection flow. The third party continues to control its own service, account, and terms.
Kitt stores connection state and, where needed, credentials such as OAuth refresh tokens. The current connector credential layer encrypts stored QuickBooks refresh tokens before storage and restricts credential access to trusted server-side runtime paths. Disconnecting or revoking a service stops Kitt from treating that connection as active, although limited security, audit, or historical records may remain.
You are responsible for having the authority to connect a business system and allow Kitt to process information from it, including information relating to customers, employees, vendors, or other people.
AI and automated processing
Kitt uses AI systems to answer questions, interpret business information, organize evidence, and propose useful summaries or business knowledge. To provide those features, selected prompts, business context, connected data, and conversation content may be processed by AI service providers, currently including OpenAI.
Kitt does not use customer business data to train a general-purpose Kitt model. Third-party AI providers process information under their applicable service terms and our provider arrangements.
Kitt deliberately distinguishes observed evidence, proposed interpretations, and business knowledge that an authorized person has explicitly reviewed or accepted. A model-generated statement is not treated as verified business truth merely because an AI system produced it.
How we use information
We use information to provide and operate Kitt, authenticate users, maintain tenant and role boundaries, connect and synchronize approved services, answer requests, preserve provenance and audit history, generate operational attention, deliver requested emails, support users, improve reliability, investigate errors, protect accounts, prevent abuse, and comply with legal obligations.
We may also use aggregated or de-identified information that no longer reasonably identifies a person or business to understand service reliability and improve Kitt.
How we share information
We share information only as reasonably necessary to operate Kitt, at your direction, or for legal and security purposes.
- Service providers. Current core providers include Supabase for database and authentication infrastructure, Vercel for web hosting and server-side delivery, Northflank for application runtime hosting, Resend for transactional email, and AI providers such as OpenAI for requested AI functionality.
- Connected services. When you deliberately connect or interact with a service such as QuickBooks, information is exchanged with that provider as needed for the authorized connection.
- Your organization. Business owners, administrators, members, and viewers may see information according to their Kitt role and explicitly delegated permissions. An organization may manage access to its business workspace.
- Legal, safety, and security. We may disclose information when reasonably necessary to comply with law, enforce agreements, protect rights and safety, investigate fraud or abuse, or respond to lawful process.
- Business transactions. If Kitt or substantially all of its assets are involved in a merger, acquisition, financing, reorganization, or sale, information may transfer as part of that transaction subject to appropriate protections.
Business accounts and other people's information
Much of the information in Kitt belongs to or is controlled by the business that uses the workspace. If your employer or another organization gives you access, that organization may control your membership, permissions, and access to business data.
When Kitt processes personal information contained in a connected business system on behalf of a customer, the customer may be the party primarily responsible for deciding why that information is processed. Privacy requests about that business data may need to be directed to the business itself.
Retention
We retain information for as long as reasonably necessary to provide Kitt, maintain an active business workspace or connection, protect the service, resolve disputes, preserve required audit and provenance history, and meet legal obligations.
Kitt is designed to preserve historical context. Removing a user's future access or delegated authority does not automatically erase historical records showing what happened, what information was reviewed, or what an authorized person previously approved. Security, audit, backup, and fraud-prevention records may also remain after other account data is removed.
Retention periods vary by data type, account status, connected service, legal requirements, and operational need. We may delete or de-identify information when it is no longer reasonably needed.
Security
We use administrative and technical safeguards designed to protect Kitt data, including authenticated access, tenant-scoped authorization, role and capability controls, server-side secrets, restricted database procedures, and encryption for supported connector credentials.
No online service can guarantee absolute security. You are responsible for protecting your account credentials, using appropriate authentication methods, and promptly notifying us if you believe your account or a connected service has been compromised.
Cookies, sessions, and tracking
Kitt uses cookies or similar browser storage when needed for authentication, session continuity, security, and basic product functionality.
We do not currently use Kitt to build cross-site advertising profiles. Our current transactional email configuration for thisiskitt.com does not use Resend click/open tracking. If our tracking practices materially change, this policy will be updated.
Your choices and privacy rights
You can manage optional daily-digest, attention-alert, and policy-review emails from your Kitt account. Security, ownership, invitation, and access-change notices may still be sent when needed to operate and protect the service.
Depending on where you live, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information, or to appeal a privacy-request decision. Because Kitt does not sell personal information or share it for cross-context behavioral advertising, there is no sale or targeted-advertising opt-out required for those practices today.
We may need to verify a request before acting on it. Some requests may be limited where retention is required for security, fraud prevention, legal compliance, business-account integrity, or preservation of an authoritative audit trail.
Sensitive and regulated information
Kitt is a general business-operations service. Unless Kitt expressly supports a category under a separate agreement, do not use the service to store full payment-card numbers, account passwords, government identification numbers, regulated health records, or other highly sensitive information that is not needed for the supported business workflow.
Children
Kitt is intended for business users and is not directed to children. You must be at least 18 years old to create or administer a Kitt business account. We do not knowingly collect personal information from children through the service.
International processing
Kitt and its service providers may process information in the United States and other countries where they operate. Those locations may have data-protection laws different from the laws where you live.
Changes to this policy
We may update this Privacy Policy as Kitt, its integrations, or applicable requirements change. If a change is material, we will provide notice through the service, by email, or by another reasonable method. The effective date at the top of this page identifies the current version.
Contact and privacy requests
Questions or privacy requests may be sent to support@thisiskitt.com. Please do not include passwords, payment-card data, or other unnecessary sensitive information in a support request.
We want these documents to describe how Kitt actually works. If the product changes materially, these pages should change with it.