Privacy Policy

Kiyo is operated by CTRL Studio UG (haftungsbeschränkt), Bremer Straße 31, 48155 Münster, Germany. You can reach us at info@ctrl-app.studio.

This policy covers the Kiyo website, Kiyo Account, the web chat, checkout, billing, and Kiyo conversations through supported messaging channels.

Last updated: 18 August 2026.

We process the data needed to operate Kiyo: phone number, channel identifier, display handle, account identifier, email address, login provider, session data, timezone, country selection, consent records, and technical request data.

We store conversation data such as messages, generated replies, delivery status, timestamps, thread identifiers, selected channel, and limited metadata needed for routing, support, security, and reliability.

We store profile and memory data when it helps Kiyo behave consistently. This can include goals, preferences, quiet hours, daily message limits, reminders, onboarding state, behavior patterns, safety notes, and short factual memory items from the conversation.

If you send voice messages or audio, we may process the audio file, technical audio metadata, and the resulting transcript. Unsupported or failed audio processing may still create limited operational records.

If you connect CTRL Habits or CTRL Focus, we process your consent records and the connected data needed for that integration, such as compact rollups, profile context, activity events, and connection status.

For billing, we process plan selection, checkout status, subscription status, invoice references, billing customer identifiers, subscription identifiers, and billing portal links. Payment card details are handled by our payment processor and are not stored by Kiyo.

If product analytics are enabled, we process product-use events such as page views, form steps, account actions, checkout steps, offer-code status, payment status, message counts, retention signals, browser session identifiers, referrer host, viewport size, and timestamps. We do not include message text, payment card details, or raw phone numbers in client analytics by default.

We process your data to provide Kiyo, create and maintain your account, route messages, generate replies, remember context, schedule reminders, manage connected apps, process payments, prevent abuse, secure the service, and respond to support or legal requests.

We use analytics to understand conversion, reliability, retention, checkout friction, abuse signals, and where users drop off across the website, account, checkout, messaging, and billing flow.

We rely on contract performance and pre-contractual steps for account, messaging, reply, reminder, integration, and billing functions. We rely on legitimate interests for proportionate security, abuse prevention, service quality assurance, reliability, support, and identifier-free measurement of how our own pages and signup questionnaire are used. We rely on legal obligations where they apply and on consent for analytics that stores or reads identifiers on your device, and for other processing that requires it.

Kiyo is not intended for medical, therapeutic, legal, financial, or emergency support. Do not send health data or other highly sensitive information. If a future feature needs special categories of personal data, we will ask separately for explicit consent or identify another applicable legal basis before enabling it.

Kiyo uses AI model providers to understand messages, plan replies, write replies, process voice transcripts, and decide whether follow-up messages should be sent. Depending on the live configuration, relevant content may be processed by those providers.

The data sent to AI providers can include your current message, recent conversation context, profile context, memory items, connected-app context, action results, and technical metadata needed to generate a response. We send only the context needed for the task.

Customer content is not used to train general-purpose models for us. Your Kiyo Account includes an Improve Kiyo setting. Turning it off excludes your content from optional product improvement beyond the limited quality assurance needed to operate, secure, and maintain the service.

AI providers can process data outside Germany or the EEA. We use contractual safeguards, business accounts, restricted retention settings, and data processing terms appropriate to the service and transfer.

If you use Kiyo through WhatsApp, the messaging providers involved in delivery process message and connection data under their own terms.

If you use other messaging channels where available, the related providers process message, account, and delivery data under their own terms.

Messaging providers control their apps, transport, device sync, account metadata, backups, and retention. Review the privacy terms of the channel you use before sending highly sensitive content.

We do not read your private contacts, your general message history, or unrelated chats.

You can optionally connect your Google Calendar to Kiyo. Access happens through the Google Calendar API with the permissions you approve on the Google consent screen: free/busy availability, and, if granted, events on your primary calendar including titles, times, locations, and attendee counts, plus the ability to create new events.

Kiyo uses this access only to answer your scheduling questions, suggest realistic open time slots, ground plans and check-ins in your actual availability and upcoming events, and create a calendar event when you explicitly confirm its title and time in the conversation. Kiyo never edits, moves, or deletes existing events, never invites attendees, and only touches your primary calendar.

We store your Google OAuth tokens encrypted (AES-256-GCM) together with connection and consent records. Calendar contents are fetched live when needed and are not synced into a persistent copy on our servers. Event details that appear in a conversation follow your selected chat retention period. To generate a reply, relevant calendar context may be processed by the AI providers described in the AI Processing section.

Google Calendar data is never sold, never used for advertising, never shared with data brokers, and never used to train general-purpose AI models. You can disconnect Google Calendar at any time in the conversation or from Kiyo Account; disconnecting revokes and deletes the stored tokens. Deleting your Kiyo data removes the stored credentials as well.

Kiyo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Kiyo infrastructure is hosted on servers operated for us at Hetzner in Germany. We use database, server, and operational infrastructure under our control as far as reasonably possible.

We use a payment processor for checkout, payment confirmation, subscriptions, invoices, billing portal access, fraud prevention, and payment compliance.

We use product and reliability analytics where enabled. Kiyo analytics use pseudonymous identifiers where possible and are designed to avoid message content by default. Content capture is disabled unless explicitly enabled for a controlled operational reason.

We use CTRL Account infrastructure for account sessions, phone login, social login, and token-based access.

We may use infrastructure, account, messaging, AI, payment, analytics, and related subprocessors as needed to provide the service.

We do not sell personal data. We do not share personal data with advertising networks or data brokers.

A limited number of authorized founders can review individual conversations for service quality and reliability. These accesses use named accounts, are logged automatically, and are governed by internal purpose and confidentiality rules. Direct identifiers remain masked where they are not needed.

Support team access to individual conversations is time-limited, requires a recorded support, security, incident, or reliability reason, and is logged. Conversation content is not available to staff for personal curiosity, marketing, or unrelated purposes.

When you visit the website, our servers may process IP address, request path, timestamp, referrer, browser information, device information, and security signals.

Kiyo may use cookies, session storage, and local storage for authentication, consent choices, pending account linking, checkout state, and core product functionality.

If you allow product analytics, we store a pseudonymous browser identifier and session identifier in local or session storage so we can understand product use, reliability, conversion, retention, and abuse signals.

Without that permission we still count how far visitors get through the signup questionnaire, the login, and the web chat, because a flow we cannot see is one we cannot fix. That counting writes nothing to your device, and the only thing it reads from your device is an opt-out marker if you set one yourself. It records the step reached, whether an attempt succeeded or failed and with which error code, which sign-in method was used, how many messages or conversations were on screen, and how long a typed message was, tied to a random identifier that exists only while the page is open and is gone after a reload. It never records message text, and it carries no address of the page you came from, no campaign parameters, no IP address, and nothing that links it to your phone number, your conversations, or your account.

Your own privacy choices are deliberately left out of that counting. Requesting deletion of your data, clearing your memory, and changing your privacy settings are recorded only if you allowed analytics.

You can decline analytics. Essential storage for login, security, checkout, and account features may still be used. The website does not rely on advertising cookies.

Kiyo Account lets you adjust privacy and account settings where available. You can choose chat retention of 30, 90, or 365 days, turn memory off, clear memory, turn Improve Kiyo off, manage timezone, quiet hours, daily limits, connected apps, billing, and linked account methods.

Turning memory off disables active memory use and deactivates stored memory items. Clearing memory deletes stored memory items. Chat content is minimized after the selected period, unless legal hold or another lawful retention reason applies.

Connected apps are optional. You can connect or disconnect CTRL Habits and CTRL Focus from Kiyo Account when your CTRL Account is linked.

You can decline website analytics from the consent prompt. Declining stops the stored identifiers and everything tied to them; the identifier-free counting described in section 8 continues, and you can object to it at any time. If you previously allowed analytics, clearing site data resets that choice.

Active message content, sent delivery content, conversation titles, inbound routing records, and AI request and response text follow your selected chat retention period of 30, 90, or 365 days. The default is 30 days.

Your selected chat retention setting controls how long message content, sent delivery content, conversation titles, and AI request and response text are kept in active form. Older content is minimized after the selected period.

Your phone or channel identifier and core account profile remain while your Kiyo account is active because they route messages and protect account access. Memory items remain until you clear memory or delete your Kiyo data. Turning memory off stops active use and deactivates existing items.

Administrative access records are retained for security and accountability. Analytics and operational event records are kept only as long as needed for product measurement, reliability, security, fraud prevention, billing reconciliation, or legal defense, then deleted or aggregated.

Billing and tax records may be retained for statutory periods. Security, audit, fraud-prevention, and legal records may be retained where necessary.

If you request deletion through Kiyo Account or by email, we delete or anonymize Kiyo service data unless retention is legally required or needed for claims, security, fraud prevention, billing, or compliance.

Deletion from active systems does not control copies retained independently by a messaging channel on your device, in channel backups, or under that channel provider's terms.

Some processors and AI model providers may process data outside Germany, the EEA, or the United Kingdom. Where required, we rely on adequacy decisions, standard contractual clauses, data processing agreements, transfer frameworks, or other lawful transfer mechanisms.

Because Kiyo is a messaging and AI service, do not send content you are not comfortable having processed by the channel provider and the AI providers needed to answer you.

Under GDPR, you may request access, correction, deletion, restriction, objection, and data portability, and you may withdraw consent at any time with future effect.

For privacy requests, contact info@ctrl-app.studio. You also have the right to complain to a supervisory authority, including the data protection authority responsible for your place of residence, workplace, or the alleged infringement.

Email: info@ctrl-app.studio

Postal address: CTRL Studio UG (haftungsbeschränkt), Bremer Straße 31, 48155 Münster, Germany