Privacy Policy

Kuzy is a Mac and Windows AI coding assistant. This Privacy Policy explains what Kuzy collects when users use the website, dashboard, desktop app, billing flows, hosted gateway, and support channels.

Short version: local work is designed to stay local unless the user chooses to send it through the hosted gateway or a connected third-party tool. Kuzy does not sell personal data. Kuzy does not use private code or task content to train Kuzy-owned models.

The data controller for Kuzy is Kuzy, the trade name of the operator of kuzy.ai. Kuzy uses this trade name publicly while the business transitions legal entities. Where law, payment processing, regulator request, or data-subject verification requires the legal entity name, Kuzy will provide the applicable details through privacy@kuzy.ai or legal@kuzy.ai.

The same operator may act as an independent controller for account, billing, security, fraud prevention, product administration, and legal compliance, and as a processor for customer-controlled content submitted to hosted Kuzy services. The Data Processing Agreement explains the processor role.

Account and identity:

• Email address, display name, account ID, authentication provider IDs, and login timestamps.
• Plan, billing status, credit balance, usage allowance, and account settings.
• Support messages, legal requests, abuse reports, and related correspondence.

Desktop and hosted usage:

• App version, operating system, crash diagnostics, feature flags, and device-level diagnostics needed to keep the app working.
• Hosted gateway metadata such as model, token counts, timestamps, latency, request status, cost, and error codes.
• Tool-call metadata for hosted tasks, such as tool name, status, and timing. Full file contents or command payloads are not stored unless the user enables a debugging or history feature that clearly says it stores them.

Billing:

• Stripe customer ID, subscription ID, invoice IDs, amount, currency, billing address, tax information, and limited card metadata such as brand and last four digits.
• Kuzy does not receive or store full card numbers, CVCs, or bank credentials.

Website and dashboard:

• Session cookies, CSRF tokens, security logs, IP address, browser information, and request logs.
• Kuzy does not use advertising cookies or sell browsing data.

The following normally stays on the user's Mac or PC unless intentionally sent to a model provider, hosted gateway, support channel, or third-party integration:

• Local source files, project folders, generated diffs, and unsent prompts.
• Local terminal output, sandbox state, local memory, and local tool configuration.
• Provider API keys used in BYOK mode, which should be stored in the operating system keychain or local secure store.
• MCP server credentials and connected-tool secrets configured locally.

• Provide Kuzy: authenticate users, run hosted tasks, meter usage, route requests, sync account state, and provide support.
• Bill customers: process subscriptions, top-ups, invoices, tax, refunds, fraud checks, and chargeback handling.
• Secure the service: detect abuse, investigate incidents, prevent fraud, enforce rate limits, and protect users.
• Improve reliability: analyse aggregate performance, crash, and success metrics without training on private task content.
• Communicate: send receipts, security notices, legal notices, service updates, and support replies.
• Comply with law: respond to lawful requests, preserve records where required, and meet accounting/tax duties.

For UK/EU users, Kuzy relies on:

• Contract: account, app, hosted gateway, support.
• Legal obligation: billing, tax, accounting, legal requests.
• Legitimate interests: security, fraud prevention, abuse prevention, service reliability.
• Consent: optional diagnostics, marketing email, non-essential cookies if introduced.

Kuzy shares data only with vendors needed to operate Kuzy, comply with law, or fulfil user requests. Kuzy does not sell personal data.

• Stripe: payments, invoices, fraud, tax.
• Authentication providers: login and account security.
• Cloud hosting/CDN/security providers: hosting, routing, DDoS/WAF, logs.
• Email providers: transactional email.
• Model providers: inference when hosted models are used.
• Connected tools authorised by the user: MCP, Git, hosting, database, browser, or app actions.
• Authorities: legal compliance and safety reports where required or appropriate under law.

For business customers, Kuzy can provide current sub-processor details and reasonable security documentation through privacy@kuzy.ai. Kuzy requires service providers that process personal data for Kuzy to protect it under contractual confidentiality, security, and processing obligations.

When hosted models are used, task prompts, selected files, tool output, and other context needed for the request may be sent to model providers. Kuzy configures provider accounts to avoid training on customer content where the provider offers that control. Provider retention, abuse monitoring, and enterprise controls vary by provider and plan. BYOK mode is governed by the user's own provider account and settings.

Kuzy does not use private task content, private code, or private files to train Kuzy-owned models.

If Kuzy is used through an organisation, workspace owners or administrators may be able to manage seats, billing, security settings, connected providers, audit-related settings, and access to shared workspace resources. The organisation may control, export, restrict, or delete workspace content according to its agreement with Kuzy and internal policies.

Users should not put secrets, regulated data, customer personal data, or confidential third-party material into hosted tasks unless the organisation has approved that use and configured the relevant model provider, MCP server, and connected tools appropriately.

The marketing site is designed not to set advertising or analytics cookies. The dashboard uses strictly necessary cookies for login, CSRF protection, and security. Stripe may set cookies on Stripe-controlled domains during checkout or billing portal flows.

• Account data: while the account is active, then deleted or anonymised within 30 days after closure unless retention is required.
• Billing and tax records: generally 7 years, or longer if legally required.
• Hosted task metadata: 90 days, then aggregated or anonymised.
• Security logs: up to 12 months unless needed for investigation.
• Support/legal correspondence: up to 6 years where needed to establish or defend claims.
• Backups: encrypted rolling backups generally expire within 35 days.

Kuzy uses technical and organisational measures designed for a coding assistant that may handle sensitive source code: encryption in transit, encrypted storage, least-privilege access, access logging, review of production access, dependency scanning, and incident response procedures.

No internet service can be guaranteed secure. Users should use least-privilege API keys, avoid sending unnecessary secrets, keep local devices patched, and revoke connected credentials when access is no longer needed.

Depending on location, users may have rights to access, correct, delete, export, restrict, or object to processing of personal data, and to withdraw consent where processing is based on consent. California residents may also have rights under the CCPA/CPRA if the law applies to Kuzy. Kuzy does not sell personal data and does not share it for cross-context behavioural advertising.

Requests should be sent to privacy@kuzy.ai. Kuzy may need to verify identity before acting on a request.

Kuzy is not directed to children under 13 and is not intended for users under 16. Kuzy does not knowingly collect personal data from children under 13.

Kuzy may process data in the United Kingdom, United States, European Union, and other locations where vendors operate. Where required, Kuzy uses safeguards such as Standard Contractual Clauses, UK transfer mechanisms, vendor DPAs, encryption, and transfer-impact review.