Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information. Your name, email address, and authentication details, handled through our identity provider, Clerk.
• Design content. The files, tokens, and designs you or your agents create in the Service, which belong to you.
• Payment information. Billing details processed by our payment providers, Stripe and Razorpay. We do not store full card numbers.
• Usage data. Device, operating system, application version, and product-interaction information collected from the desktop application to operate and improve the Service.

2. How we use information

We use personal information to provide and secure the Service, authenticate accounts, process payments, respond to support requests, send service communications, and comply with legal obligations. We do not sell your personal information, and we do not use your design content to train third-party models.

3. Legal bases for processing

Where the GDPR or UK GDPR applies, we process personal information on the bases of performance of a contract, our legitimate interests in operating and improving the Service, compliance with legal obligations, and, where required, your consent.

4. Sharing and subprocessors

We share personal information only with service providers who process it on our behalf under contract. Our current subprocessors are:

• Clerk — authentication and account management.
• Stripe — global payment processing.
• Razorpay — payment processing and UPI AutoPay for customers in India.
• Railway — cloud infrastructure, hosting, and data storage.

The current list, with each subprocessor's purpose and processing location, is maintained on our Subprocessors page at kiteways.design/subprocessors. We will give notice of material changes to this list as required by our data processing agreement.

5. International data transfers

The Service is offered internationally, and your information may be processed in countries other than your own. Where personal data is transferred out of the EEA, the UK, or India, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent transfer mechanism.

6. Data retention

We retain personal information for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, or reporting requirements. You may request deletion of your account and associated data at any time.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the EEA and UK have rights under the GDPR; California residents under the CCPA/CPRA; and residents of India under the Digital Personal Data Protection Act. To exercise any right, contact us at the address below.

8. Security

We protect personal information with encryption in transit and at rest, access controls, and support for single sign-on and multi-factor authentication on every account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Cookies

The Kiteways Design application is a desktop application and does not rely on browser cookies to function. Our website at kiteways.design uses strictly necessary cookies and, with your consent where required, analytics cookies to understand usage; you can control non-essential cookies through the cookie banner or your browser settings. Within the application, we use equivalent local storage strictly to keep you signed in and remember your preferences.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service.