Privacy Policy

Last updated 2026-04-26 · Effective from 2026-04-26

1. Introduction

This Privacy Policy explains how Kiseki ("we", "us") collects, uses, stores, and shares Personal Data when you use the Kiseki SaaS platform.

Kiseki is operated by MATRIXVISTA - FZCO (United Arab Emirates). For legal correspondence, contact legal@thekiseki.app.

This Policy applies to:

• Customers: businesses subscribing to Kiseki (you create an account at app.thekiseki.app);
• End-users: prospects / leads / contacts of Customers, whose data Customers process via Kiseki;
• Visitors: anyone visiting thekiseki.app or related domains.

2. Data We Collect

2.1. From Customers (account holders)

• Identity: name, email, phone, business name, billing address;
• Payment: handled by our Merchant of Record — Kiseki receives only transaction confirmations, not full card data;
• Usage: features used, login history, IP addresses, browser/device info;
• Content: ad creative, brand assets, business specs, integrations configured.

2.2. From End-users (Customer's prospects), processed on Customer's behalf

• Identity: name, social media profile, contact info shared by prospect with Customer;
• Conversations: DM exchanges between AI agents and prospect;
• Engagement: clicks, opens, ad impressions, conversion events.

Customer is the Data Controller for End-user data; Kiseki is the Data Processor.

2.3. From Visitors (thekiseki.app marketing site)

• Cookies (analytics, preferences, marketing — see Cookie Policy);
• IP address, device type;
• Pages viewed, referral source;
• Sign-up form submissions (waitlist, contact).

3. How We Use Data

3.1. For Customer service delivery

• Operate the Service (authentication, billing, feature delivery);
• Run AI agents on Customer's behalf (advertising, prospect engagement, analytics);
• Provide support, communications, notifications.

3.2. For platform improvement

• Aggregate, anonymized analytics (NOT individual Customer behavior);
• Bug detection, security monitoring;
• Product research (no PII used in research without consent).

3.3. For marketing

Customers and Visitors only, never End-users:

• Newsletter (opt-in only);
• Product updates (related to your subscription tier);
• Customer success outreach.

3.4. For legal / compliance

• Tax filings (via Merchant of Record);
• Fraud detection, abuse prevention;
• Regulatory requests (with proper legal basis).

4. Legal Bases (GDPR Art. 6)

We process Personal Data under one or more bases:

• Contract: providing the Service you signed up for (Art. 6(1)(b));
• Legitimate interest: platform security, analytics, improvement (Art. 6(1)(f));
• Consent: marketing communications, optional features (Art. 6(1)(a));
• Legal obligation: tax records, regulatory compliance (Art. 6(1)(c)).

5. Sharing Data

5.1. We share data with the following categories of recipients, in each case under contractual obligations of confidentiality and data protection:

• Sub-processors: a small set of vetted vendors providing cloud infrastructure, AI inference, transactional email, payments / Merchant of Record, video hosting, and similar service-delivery functions. The canonical sub-processors list is provided to active Customers under the Data Processing Agreement (request via legal@thekiseki.app);
• Customer's authorized integrations: third-party platforms (such as advertising platforms, messaging platforms, payment processors) that the Customer connects to their account via OAuth or equivalent mechanisms;
• Legal / regulatory authorities: when required by law or court order;
• Business successors: in case of merger, acquisition, or asset sale (notice provided).

5.2. We do not sell Personal Data.

5.3. We do not share End-user data across Customer accounts (multi-tenant isolation enforced).

6. International Transfers

Data may be transferred to and processed in jurisdictions outside your country, including the European Union and the United States.

Legal basis for transfers from EU/UK:

• Standard Contractual Clauses (SCCs) in sub-processor DPAs, with Module 2 (Controller to Processor) and Module 3 (Processor to Sub-Processor) as applicable;
• Adequacy decisions where applicable;
• UK Addendum to SCCs for transfers from the United Kingdom;
• Encryption in transit (TLS 1.3) and at rest (AES-256).

The full list of transfer destinations and the relevant transfer mechanism for each is provided to active Customers under the Data Processing Agreement.

7. Data Retention

Data type	Retention period
Customer account data (active)	While account active + 90 days post-termination
Customer account data (archived)	7 years post-termination (tax / legal compliance)
End-user prospect conversations	90 days after Customer terminates, then deleted
Ad creative & campaign data	12 months for analytics, then aggregated / anonymized
Payment transaction records	7 years (handled by MoR per their policy)
Marketing newsletter subscribers	Until unsubscribe
Cookies	Per cookie category (see Cookie Policy)
Security logs	12 months
Backups (encrypted)	90 days rolling

8. Your Rights

Under GDPR Art. 13–22 and similar regimes, you have the right to:

• Access your data (request copy via privacy@thekiseki.app);
• Rectify inaccurate data;
• Erase ("right to be forgotten") — with exceptions for legal obligations;
• Restrict processing in certain circumstances;
• Data portability (export in machine-readable format);
• Object to processing based on legitimate interest;
• Withdraw consent for consent-based processing;
• Complain to your supervisory authority (EU: your national DPA; UK: ICO).

To exercise these rights, contact privacy@thekiseki.app. We respond within 30 days.

9. Security

We implement technical and organizational measures including:

• Encryption at rest and in transit (TLS 1.3, AES-256);
• Access controls (least privilege, MFA for admin access);
• Audit logs of access to Customer data;
• Regular vulnerability scanning;
• Incident response procedures;
• Data breach notification within 72 hours per GDPR Art. 33.

No system is 100% secure. We continuously improve our security posture.

10. Children's Privacy

Kiseki is a B2B service for businesses. We do not knowingly collect data from anyone under 18 (or the applicable age of majority). If we discover such data, we delete it.

11. California Residents (CCPA / CPRA)

California residents have additional rights including:

• Right to know what Personal Data is collected;
• Right to delete (with exceptions);
• Right to opt-out of "sale" or "sharing" — Kiseki does not sell or share Personal Data for cross-context behavioral advertising.

12. UAE-Specific Notice

As a UAE-based company, Kiseki complies with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection. UAE residents have similar rights to access, correct, and erase Personal Data.

13. Changes to This Policy

We may update this Policy periodically. Material changes notified via email and 30 days' notice. Continued use after updates constitutes acceptance.

14. Contact

• Privacy questions: privacy@thekiseki.app
• Data subject rights: privacy@thekiseki.app
• Security / breach notifications: security@thekiseki.app
• Legal correspondence: legal@thekiseki.app

Kiseki is operated by MATRIXVISTA - FZCO (United Arab Emirates). Postal address available on request via legal@thekiseki.app.