Privacy Policy

Last updated: May 28, 2026

1. Who we are

Kwoat is operated by Kwoat Technologies, LLC, a limited liability company registered in the State of Delaware, United States. Our registered address is 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

Kwoat is an AI platform aggregator — a single interface that routes your prompts to third-party AI providers. We do not operate our own AI models.

For privacy-related questions or requests, contact us at privacy@kwoat.ai.

2. Information we collect

2.1 Information you provide

• Account information: name, email address, and password when you register, or profile information from Google or GitHub OAuth sign-in.
• Profile information: display name, phone number, country, and currency preference.
• Payment information: billing details processed by Stripe (international) or Flutterwave (African markets). We never store full card numbers or bank account details.
• Messages and content: prompts you send, files and images you upload, voice recordings when using voice features, and documents you generate.
• Communications: messages you send to support@kwoat.ai or privacy@kwoat.ai.

2.2 Information collected automatically

• Usage data: features used, models selected, tokens consumed, requests made, and timestamps.
• Device and browser information: IP address, browser type, operating system, and general geographic location (country level).
• Log data: server logs, error reports, and performance metrics.

2.3 Information from third parties

• OAuth providers: if you sign in with Google or GitHub, we receive your name, email address, and profile picture.
• Payment processors: Stripe and Flutterwave share transaction confirmation and payment status with us.

3. How we use your information

We use the information we collect to:

• Provide, operate, and improve the Service.
• Process payments and manage your wallet and subscription.
• Route your prompts to AI providers and return responses.
• Send transactional emails: receipts, renewal notices, usage alerts, and security notifications.
• Personalise your experience using conversation memory (if enabled).
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your conversation content to train AI models. We do not display advertising in Kwoat products.

4. How we share your information

4.1 AI model providers

When you send a message, your prompt and any attached files or images are transmitted to the AI provider selected for that request. Each provider processes your input under their own privacy policies:

• Anthropic (Claude): anthropic.com/privacy
• Google (Gemini): policies.google.com/privacy
• OpenAI (GPT): openai.com/policies/privacy-policy
• xAI (Grok): x.ai/privacy
• Mistral AI: mistral.ai/privacy

4.2 Infrastructure providers

We share data with the following providers, each receiving only the minimum necessary for their function:

• Supabase — database, authentication, and file storage
• Vercel — application hosting and edge compute
• Upstash — caching and rate limiting
• Resend — transactional email delivery
• Sentry — error monitoring (error messages and stack traces only — no message content)
• Daytona — cloud sandbox execution for agent missions
• fal.ai — video generation
• Vapi — voice processing
• Brave Search — web search results
• Stripe — payment processing (international)
• Flutterwave — payment processing (African markets)

4.3 Legal requirements

We may disclose your information if required by law, court order, or government authority, or when necessary to protect the rights, property, or safety of Kwoat, our users, or others.

4.4 Business transfers

If Kwoat Technologies, LLC is acquired or undergoes a change of control, your information may be transferred as part of that transaction. We will notify you by email before your information becomes subject to a different privacy policy.

5. Data storage and security

Your data is stored on Supabase infrastructure hosted on Amazon Web Services (AWS). We implement the following security measures:

• Encryption in transit (TLS) and at rest (AES-256)
• Row-level security on all database tables
• Access controls limiting team member access to user data
• Multi-factor authentication support for user accounts
• Continuous error monitoring via Sentry

No system is 100% secure. If you discover a security vulnerability, please report it to privacy@kwoat.ai.

6. Data retention

We retain your data for as long as your account is active. See our Data Retention Policy for full details. Key periods:

• Account and profile data: deleted within 30 days of account deletion.
• Conversation history: retained until you delete it or close your account.
• Payment and billing records: retained for 7 years as required by financial regulations.
• Usage records: retained for 24 months.
• Server logs: retained for 90 days.

7. Your rights

7.1 All users

• Access: request a copy of your personal data.
• Correction: update inaccurate data via your account settings.
• Deletion: delete your account from Settings → Data & Control → Delete account.
• Export: download all your conversation data as JSON from Settings → Data & Control → Export my data.
• Memory: disable or clear Kwoat's memory from Settings → Data & Control → Memory.

7.2 EEA, UK, and Switzerland (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under GDPR: restriction of processing, data portability, objection to processing, and withdrawal of consent. Our legal bases for processing are contract performance, legitimate interests, legal obligation, and consent where applicable. Contact privacy@kwoat.ai to exercise these rights. If unsatisfied with our response, you may lodge a complaint with your local data protection authority.

7.3 California residents (CCPA/CPRA)

California residents have the right to know what personal information is collected, request deletion, and opt out of sale. We do not sell personal information. Contact privacy@kwoat.ai to make a request.

7.4 Canadian users (PIPEDA)

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Law 25. Canadian users have the right to access their personal data, withdraw consent to its collection or use, and request correction or deletion. Contact privacy@kwoat.ai for any data-related request. We will respond within 30 days.

7.5 Australian users (Privacy Act)

We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). Australian users have the right to access and correct their personal information, and to make a complaint about how we handle it. Contact privacy@kwoat.ai to exercise these rights. If unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

7.6 Nigerian users (NDPA)

We comply with the Nigeria Data Protection Act (NDPA) 2023. Nigerian users have the right to access, correct, and delete their personal data. Contact privacy@kwoat.ai for any data-related request.

We will respond to all rights requests within 30 days.

8. Cookies

We use only the cookies necessary to operate the Service: authentication cookies to keep you signed in, and preference cookies to remember your settings. We do not use advertising cookies or cross-site tracking. See our Cookie Policy for full details.

9. Children's privacy

The Service is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, contact privacy@kwoat.ai and we will delete it promptly.

10. International data transfers

Kwoat Technologies, LLC is registered in Delaware, United States. If you access Kwoat from outside the United States, your data may be transferred to and processed in the United States or other countries where our infrastructure providers operate. We rely on standard contractual clauses and other appropriate safeguards where required by law.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and in-app notice at least 14 days before they take effect. Continued use of the Service after changes constitutes acceptance.

12. Contact us