Privacy Policy
1. Who We Are
KUVEX Private Limited, a company incorporated in India (CIN U62013UT2026PTC022268) with its registered office at H.No. 6, Priyalok Colony, Phase 1, near Alka Dairy, Majra, Dehradun, Uttarakhand 248171, India ("KUVEX", "we", "us", "our"), operates Oronis, an autonomous AI software engineering tool available at oronis.kuvex.ai. This Privacy Policy applies to all users of our website and desktop application.
For privacy-related inquiries, contact: privacy@kuvex.ai
2. Data We Collect
2.1 Data you provide directly
- Account information: Email address, password (stored as a secure hash), name, and optional onboarding details such as company, role, country, product use case, and how you heard about us
- OAuth profile data: If you sign in with Google or GitHub, we receive your public profile name, email address, and avatar as provided by those services
- Support communications: Any information you provide when contacting our support team
2.2 Data collected automatically
- Usage data: Features used, commands issued, session duration, error logs
- Service usage records: For each piece of work the Oronis service processes for your account (such as a task, chat request, plan or review): the time, the type of work and the amount of processing used. These records do not contain your code or the content of your requests.
- Device data: Operating system, app version, general region (not precise location)
- Authentication data: Session tokens stored locally on your device
2.3 Code and content
When you use Oronis's AI features, code snippets and instructions you provide are transmitted to KUVEX-managed AI service providers to generate responses. This data is processed in transit and is not permanently stored by KUVEX beyond what is necessary to fulfill your request. We do not use your code to train AI models.
2.4 Payment data
Payment processing is handled entirely by Paddle, our merchant of record (Paddle.com Inc. for customers in the United States, Paddle.com Market Limited elsewhere). KUVEX does not receive or store your full payment card number, CVV, or banking credentials. From Paddle we receive your email address, your Paddle customer and subscription identifiers, your plan, subscription status, billing dates and amount, and the brand and last four digits of your card so you can recognise it in your account.
3. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Providing and operating the Service (authentication, subscription gating, download access) | Contract performance |
| Processing payments and managing subscriptions via Paddle | Contract performance |
| Sending transactional emails (account confirmation, billing receipts) | Contract performance |
| Diagnosing bugs and improving the Service | Legitimate interest |
| Preventing fraud and enforcing our Terms of Service | Legitimate interest |
| Using service usage records to apply the Fair Use Policy, check refund requests, and respond to payment disputes | Contract performance / Legitimate interest |
| Complying with legal obligations | Legal obligation |
| Sending product update emails (you may opt out at any time) | Legitimate interest / Consent |
4. Third-Party Services
We rely on the following trusted third-party services to operate Oronis:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication, user database, subscription status | Email, subscription status, session tokens |
| Paddle | Payment processing, subscription management, tax compliance | Email, billing details (handled by Paddle directly) |
| Optional OAuth sign-in | Public profile if you choose Google sign-in | |
| GitHub | Optional OAuth sign-in | Public profile if you choose GitHub sign-in |
| Managed AI subprocessors | Generating AI responses to your requests | Instructions and relevant task context submitted for processing |
Each of these providers maintains their own privacy policy. We encourage you to review them.
5. Data Retention
- Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
- Subscription data: Retained for 7 years as required for financial record-keeping compliance.
- Code/prompts sent to AI providers: Not retained by KUVEX beyond the request/response cycle.
- Support communications: Retained for 2 years.
- Usage logs: Aggregated and anonymized after 90 days.
- Service usage records: Kept with your subscription data, because they are the evidence for charges, refund decisions and payment disputes.
6. Cookies and Local Storage
Our website uses minimal cookies:
- Authentication session cookie: Set by Supabase to keep you logged in. Required for the Service to function. Expires when you log out or after 7 days of inactivity.
- No tracking or advertising cookies are set by KUVEX on our website.
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your account and associated personal data
- Portability: Request your data in a machine-readable format
- Objection: Object to processing based on legitimate interest
- Opt-out of marketing: Unsubscribe from marketing emails at any time via the unsubscribe link or by emailing us
To exercise any of these rights, email privacy@kuvex.ai. We will respond within 30 days.
8. Data Security
We implement industry-standard security measures including:
- HTTPS encryption for all data in transit
- Passwords stored as bcrypt hashes (never in plaintext)
- Authentication handled by Supabase with row-level security policies
- Payment data handled entirely by Paddle — we never touch your card details
No method of transmission over the internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
9. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. International Transfers
Your data may be processed in countries outside your jurisdiction, including by our third-party service providers (Supabase, Paddle, AI providers). We ensure appropriate safeguards are in place for such transfers in accordance with applicable data protection laws.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes by email or via a notice on our website. Continued use of the Service after such notice constitutes acceptance of the updated policy.
Privacy Contact
For any privacy-related questions, requests, or concerns: