Introduction
Kagu Limited operates Kagu, including the website at https://kagu.sh, related product surfaces, APIs, hosted infrastructure, documentation, and support channels. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service.
By accessing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, do not use the Service.
Definitions
For this Privacy Policy, the following definitions apply whether the terms appear in singular or plural form.
- Service means Kagu, including the website, application, API gateway, dashboards, documentation, and related services operated by Kagu Limited.
- Personal Data means information that identifies, relates to, describes, or could reasonably be linked to an individual.
- Usage Data means data collected automatically from the Service or its infrastructure, such as log entries, device data, request metadata, latency, status codes, and operational product events.
- Cookies means small files or local storage records used only where needed to authenticate sessions, preserve security state, remember product settings, or operate requested Service features.
- Customer Content means prompts, outputs, configuration values, policy rules, routing metadata, and other content that you or your systems submit to the Service.
- Data Controller means the entity that determines the purposes and means of processing Personal Data.
- Data Processor means an entity that processes Personal Data on behalf of a Data Controller.
- User means any individual who accesses or uses the Service, including account owners, workspace members, administrators, and visitors.
Information Collection and Use
We collect information to provide, secure, maintain, support, and improve the Service. The information we collect depends on how you interact with Kagu, the features you use, the plans or integrations you configure, and the information your systems send through the Service.
We may combine information collected through the Service with information you provide through support, sales, billing, or other communications, where permitted by law.
Types of Data Collected
Account and Contact Data
When you create an account, join an organization, contact us, or request support, we may collect information such as your name, email address, organization name, role, authentication identifiers, support messages, and communication preferences.
Request, Product, and Usage Data
Kagu is designed to help subscription apps understand and control AI usage. To operate the Service, we may collect request metadata and product telemetry such as timestamps, model identifiers, provider names, token counts, cost estimates, cache status, latency, routing decisions, policy results, API key identifiers, project identifiers, organization identifiers, status codes, error classes, and user or subscriber identifiers that you configure.
Depending on your configuration, Customer Content may include prompts, model responses, tool inputs, tool outputs, guardrail settings, policies, provider credentials, and integration metadata. You are responsible for ensuring that the information you submit to the Service is lawful and appropriate for your use case.
Billing Data
If you purchase a paid plan, we and our payment processors may collect billing details such as billing contact information, plan selection, invoices, transaction identifiers, tax information, payment status, and limited payment method details. We do not store complete payment card numbers on our own systems.
Device and Log Data
When you access the Service, our systems may automatically collect IP address, browser type, device type, operating system, timestamps, diagnostic logs, performance metrics, and crash or error data needed to operate and secure the Service.
Cookies and Local Storage
Kagu uses only essential cookies or local storage when needed to keep you signed in, protect sessions, remember product settings, or operate requested Service features.
- Essential cookies help authenticate users, protect sessions, prevent abuse, and route authenticated requests.
- Preference storage may remember organization context, project context, or settings you choose in the Service.
Use of Data
Kagu uses collected information for business and operational purposes, including to:
- Provide, operate, maintain, and improve the Service.
- Create and manage accounts, organizations, projects, API keys, policies, billing plans, and support requests.
- Process, route, meter, cache, summarize, and display AI request metadata and related usage information.
- Apply subscriber-aware controls, rate limits, budgets, policies, guardrails, and other configurations selected by you.
- Monitor performance, troubleshoot issues, prevent abuse, protect the security and integrity of the Service, and enforce agreements.
- Send operational notices, security alerts, billing notices, product updates, and support responses.
- Improve reliability, support capacity planning, prioritize product fixes, and maintain product quality.
- Comply with legal obligations and respond to lawful requests.
Retention of Data
We retain Personal Data and Usage Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
Retention periods may vary depending on the type of data, the plan or feature used, contractual commitments, security needs, billing and tax requirements, backup cycles, dispute resolution needs, and legal obligations. We may retain aggregated, anonymized, or de-identified information that does not reasonably identify you.
If you request deletion of data, we will take reasonable steps to delete or de-identify applicable information, subject to legal, security, backup, fraud prevention, accounting, and contractual requirements.
Transfer of Data
Your information may be processed and stored in the United States and other countries where Kagu, its infrastructure providers, and its service providers operate. These countries may have data protection laws that differ from the laws of your location.
Where required, we use appropriate safeguards for international transfers of Personal Data, such as contractual commitments, data processing agreements, and other mechanisms permitted by applicable law.
Disclosure of Data
Service Providers
We may share information with vendors, contractors, and service providers that perform services on our behalf, such as hosting, storage, authentication, billing, monitoring, customer support, communications, security, and infrastructure operations.
Business Transactions
If Kagu is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, your information may be transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards.
Legal Requirements
We may disclose information if we believe in good faith that doing so is necessary to comply with a legal obligation, respond to lawful requests, protect rights or property, prevent or investigate possible wrongdoing, protect user safety, prevent fraud or abuse, or defend against legal liability.
With Your Direction
We may disclose information when you instruct us to do so, such as when you configure integrations, invite workspace members, connect providers, export data, or authorize a third-party workflow.
Security of Data
We use administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include access controls, encryption in transit, logging, monitoring, least-privilege practices, backups, and vendor security review.
No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we work to protect the Service and respond to security issues responsibly.
GDPR Data Protection Rights
If you are located in the European Economic Area, United Kingdom, or another jurisdiction with similar data protection laws, you may have rights regarding your Personal Data.
Legal Bases for Processing
Depending on the context, we may process Personal Data based on one or more of the following legal bases:
- Performance of a contract, including providing the Service, maintaining accounts, processing payments, and supporting your use of Kagu.
- Legitimate interests, including securing, improving, measuring, and operating the Service, preventing abuse, communicating with users, and developing features.
- Consent, where required for certain communications or optional processing activities.
- Legal obligations, including tax, accounting, regulatory, and lawful request obligations.
Your Rights
Subject to applicable law and verification, you may request to access, correct, update, delete, restrict, or object to processing of your Personal Data. You may also have the right to portability and the right to withdraw consent where processing is based on consent.
To exercise these rights, contact us at hello@kagu.sh. You may also have the right to lodge a complaint with a data protection authority.
Service Providers
We may engage third-party companies and individuals to facilitate the Service, provide the Service on our behalf, perform Service-related services, or assist us in operating, monitoring, and supporting the Service.
These service providers may access information only as needed to perform work for us and are expected not to disclose or use it for other purposes, except as permitted by their agreements with us and applicable law.
CI/CD Tools
We may use continuous integration and deployment providers to host code repositories, build and test software, deploy infrastructure, monitor releases, and operate the Service.
These tools may process technical information such as commit metadata, build logs, deployment logs, environment names, incident data, diagnostic output, and limited account identifiers needed to manage access and operations.
Payments
Paid products and subscriptions may be processed by third-party payment processors. Payment processors may collect and process billing information, transaction data, fraud prevention data, and payment method details under their own terms and privacy policies.
We receive limited billing records from payment processors, such as plan, invoice, subscription, transaction, tax, and payment status information. We do not store complete payment card numbers on Kagu-controlled systems.
Links to Other Sites
The Service may contain links to websites, services, integrations, documentation, or resources that are not operated by Kagu. If you click a third-party link, you will be directed to that third party site or service.
We are not responsible for the content, privacy policies, or practices of third-party sites or services. We encourage you to review the privacy policy of every site and service you visit.
Children's Privacy
The Service is not directed to children under 13, and we do not knowingly collect Personal Data from children under 13. If you believe a child has provided us with Personal Data, contact us and we will take appropriate steps to delete the information.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make changes, we will revise the effective date above and may provide additional notice where required by law or where the changes are material.
Your continued use of the Service after a revised Privacy Policy becomes effective means you accept the updated policy to the extent permitted by law.
Contact Us
If you have questions about this Privacy Policy, privacy requests, or data protection matters, contact Kagu Limited at hello@kagu.sh.