Privacy Policy

Last updated: 2026-11-05

Kibo ("Kibo", "we", "us") operates the AI assistant available at kibowork.ai (the "Service"). This Privacy Policy explains what data we access, how we use and protect it, who we share it with, and the rights you have. We are committed to handling your data responsibly and transparently. It includes specific sections for the EU/EEA & UK (GDPR), California (CCPA/CPRA) and Japan (APPI).

1. Who we are

The data controller / personal-information-handling business operator is:

• Kibo, operated by Tiberi Massimiliano
• Privacy contact: [email protected]

2. Information we collect

• Account data: name, email, organization name, authentication details.
• Content you provide: messages to the assistant, files you upload or index, preferences.
• Connected-service data: only the data covered by the permissions you grant (see §3).
• Usage data: technical logs, feature usage, and diagnostics needed to operate and secure the Service.

3. Sign-in providers, connected services and connected apps

Signing in with Google gives Kibo your name and email address, nothing else: it is not a mailbox, calendar, contacts or file integration.

Microsoft Outlook (optional). When your organization enables it and you connect your Microsoft account, Kibo accesses only what the feature you switch on requires:

• Outlook calendar — the events of the calendar you pick, shown in Kibo as busy time, and a separate "Kibo" calendar that Kibo writes your dated tasks into.
• Outlook mail — only the messages you tag with the Outlook category "Kibo" (subject, sender and a preview); the text of a message and its attachments are read only when you file it under a task. Kibo never sends mail. Optionally, permission to create the two categories in your mailbox.

You can revoke access at any time from My account → Integrations → Plugins and from your Microsoft account.

Apps you connect (MCP) and API keys. On paid plans you can let an outside tool read and update your tasks and projects. It acts as you, within the permissions you grant, and only on what you can already see; you can revoke it from My account → Integrations (API keys or Connected apps).

Limited Use of Google user data

The only Google user data Kibo receives is the name and email address of your Google account, used to sign you in. Kibo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not use it to train or improve AI/ML models, we do not sell it, and we share it only with the subprocessors strictly necessary to run the Service (see §5).

4. How we use your data (purpose of use)

We use the data above only to:

• Provide and operate the Service and the features you enable (projects, tasks, forms, documents and automations; the Outlook integration if you switch it on).
• Build a private, per-user memory that improves the relevance of the assistant's responses to you.
• Secure the Service, prevent abuse, and meet legal obligations.

5. AI processing and subprocessors

Kibo is an AI assistant: to generate responses and perform actions, the content you send and the relevant connected-service data are transmitted to third-party AI model providers (currently Google Cloud Vertex AI) for processing (inference). We also use cloud hosting providers to run the Service.

• Our subprocessors are currently Google, Microsoft and Stripe.
• These providers act as subprocessors, bound by data-processing agreements, and may process your data only to provide the service to us — never for their own purposes.
• Our AI model providers do not use your data to train their models, and we do not permit such use.
• We do not share your data with advertisers, data brokers, or unrelated third parties.
• Payments are handled by our payment provider (Stripe), acting as merchant of record: your card details are entered on their pages and never reach Kibo. Kibo keeps the invoice references it needs to show your billing history.
• Microsoft (Microsoft Graph) processes the Outlook data described in §3 only if you connect your account.

6. Data storage and security

• In transit: all traffic between you and Kibo, and between Kibo and external services, is encrypted with TLS (HTTPS).
• At rest: your connected-account credentials and OAuth tokens are encrypted at the application level using AES-256-GCM. Other stored data is protected by strict access controls, so that only parties with the appropriate authorization can access it.
• Technical logs and backups: the services write technical logs (requests, errors, system operations) in which email addresses are masked and IP addresses truncated; they never contain the text of chats, documents or forms. They are kept for 14 days on the server and up to 90 days in an off-site copy. A backup of the database is taken every day and kept for 7 days on the server and 30 days in the off-site copy, in the same region.
• We apply industry-standard security control measures. No method is perfectly secure, but we work to protect your data appropriately.

7. Data isolation and human access

• Isolation: Kibo is multi-tenant. Your data is logically isolated and accessible only to your account (and, on organization plans, the organization you belong to) and the AI assistant acting on your behalf.
• No routine human access: no member of our staff accesses your content except when you explicitly request support, to investigate a security incident, or where required by law.

8. Data retention and deletion

• You can disconnect any integration at any time; new data stops being accessed immediately.
• You can delete conversations, indexed documents, and your account from within the Service.
• Conversation debug data is kept for a limited, configurable period.
• On an account-deletion request, we permanently remove your associated data within 30 days, subject to legal retention obligations. Contact [email protected].

9. International and cross-border data transfers

Your personal data is stored and processed mainly on servers located in Japan, on the hosting infrastructure of Sakura Internet Inc., where our platform resides.

• EU/EEA & UK: the transfer and processing of data in Japan take place in compliance with the GDPR, under the adequacy decision adopted by the European Commission, which recognises that Japan offers a level of personal-data protection equivalent to that of the European Union.
• Other third countries: for structural needs tied to delivering the Service (such as AI model providers or network services like CDNs that optimise performance), some data may be transferred to or transit through other countries, such as the United States. In those cases we make sure the providers offer adequate safeguards under Chapter V of the GDPR (for example Standard Contractual Clauses or certification under the Data Privacy Framework).
• For users in Japan (APPI): by using the Service you consent to the provision of your personal data to third parties located outside Japan (our AI and network subprocessors), including the United States. The data-protection frameworks of these countries may differ from Japan's; we require these recipients to maintain protection measures consistent with the APPI and will provide further information on request.

10. Your rights

EU/EEA & UK — GDPR

You have the right to access, correct, export (portability), delete, and restrict or object to the processing of your personal data, and to withdraw consent at any time. You may lodge a complaint with your supervisory authority. Contact [email protected].

California — CCPA/CPRA

You have the right to know what personal information we collect and how it is used, to request deletion, to correct it, and to opt out of the "sale" or "sharing" of personal information — we do not sell or share your personal information. You will not be discriminated against for exercising these rights.

Japan — APPI

The personal-information-handling business operator is Kibo. You may request disclosure, correction, addition, deletion, suspension of use, or suspension of third-party provision of your retained personal data. The purpose of use is set out in §4; cross-border transfers in §9; security control measures in §6. To exercise your rights or raise a complaint, contact [email protected].

11. Cookies and tracking

We use only strictly necessary cookies / local storage for the Service to function (e.g., authentication, session, security, and your preferences such as language). We do not use advertising or cross-site tracking cookies, so no cookie-consent banner is required.

For usage statistics we use our own privacy-first, cookieless analytics: it does not set cookies, does not track you across other websites, and does not store data that identifies you. You can control cookies through your browser settings.

Country detection on the public site. To show the price list in the currency of your country, the public website looks up the country of your IP address through Radar, a lookup service operated by us. Radar anonymises the address and answers with the country only; no city, no provider, and the address is not kept. The website holds the address-to-country answer in memory for at most twelve hours to avoid repeating the lookup, and never writes it to disk. The result is a default: you can pick another currency on the pricing page, and inside the Service only the country your organization declares is used, with no lookup at all.

12. Children's privacy

The Service is not intended for individuals under the age of 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will communicate material changes through the Service or by email.

14. Contact

• Privacy: [email protected]
• Support: [email protected]