Privacy Policy

This policy explains what data Kyvernio collects, why, and what control you have over it. It covers the website kyvernio.com and the application at app.kyvernio.com (together, "Kyvernio").

1. Who we are

Kyvernio is operated by ATH Development, the trade name of Georgios Athanasopoulos, sole trader, VAT number EL160354270, Athens, Greece ("we", "us"). We are the data controller for the personal data described here. Contact: info@ath.dev.

2. What we collect

Account data

• Your name, email address and password (stored only as a one-way hash).
• Your company or agency name, the account type you chose, your team members and their roles.
• Your language preference and the date you accepted our Terms.

Technical and security data

• IP address, browser type, pages visited in the app and server logs, used to run, secure and fix the service.
• Cloudflare Turnstile on our login, registration and password-reset forms checks that a person, not a bot, is using the form. Cloudflare processes technical signals from your browser for this purpose only.

Data from accounts you connect

When you connect a Google account, Kyvernio receives the data that you authorise for the services you choose:

• Google Ads: account structure, campaigns, ad groups, ads and assets, keywords and search terms, budgets, bidding settings, performance and conversion data, policy and disapproval status.
• Google Analytics 4: traffic, engagement, conversion and revenue reports.
• Search Console: search queries, pages, clicks, impressions, indexing and sitemap status.
• Merchant Center: product data, product status and disapprovals, feed issues and product performance.
• Business Profile: locations, reviews and performance metrics such as calls and direction requests.

We also receive your Google account's email address and name to show which account is connected. Mostly this is business data about advertising and websites. It can include limited personal data, for example reviewer names in Business Profile.

3. How we use Google user data

We use data received from Google APIs only to provide and improve the features you use in Kyvernio:

• showing dashboards, trends and alerts for your accounts;
• explaining changes and answering your questions with the AI assistant;
• preparing suggestions, reports and campaign drafts;
• making changes in your Google accounts only when you approve them, or when you have switched on automatic actions within limits you set.

Kyvernio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not sell Google user data and do not use it for advertising, retargeting or credit decisions.
• We do not use Google user data to train general artificial intelligence or machine learning models.
• We only transfer Google user data to others when needed to provide Kyvernio's features (see section 5), to comply with law, or as part of a merger or acquisition with your notice.
• People at Kyvernio do not read your Google user data, except with your permission (for example a support request), for security reasons, to comply with the law, or in aggregated and anonymised form for internal operations.

4. AI processing

The AI assistant, reports and suggestions are generated with Anthropic's Claude models through Anthropic's commercial API. To answer a request, we send Anthropic the relevant part of your data (for example a campaign's figures). Anthropic processes it on our behalf to return the answer and, under its commercial terms, does not use API data to train its models. AI output can be wrong, which is why changes that affect your ad spend need your approval by default.

5. Who processes data for us

• Hetzner Online GmbH (Germany): servers and databases, located in the EU.
• Cloudflare, Inc.: network security, bot protection (Turnstile) and content delivery.
• Anthropic PBC (USA): AI processing as described in section 4.
• Our email delivery provider: account and notification emails.
• Stripe: payments, once paid plans are introduced. We never see or store your full card details.

Where data is transferred outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, such as the EU-US Data Privacy Framework.

6. Legal bases

• Contract: to create your account and provide the service you signed up for.
• Legitimate interests: to keep Kyvernio secure, prevent abuse and improve the service.
• Consent: for connecting third-party accounts, which you can withdraw at any time by disconnecting them.
• Legal obligation: for invoicing and tax records.

7. How long we keep data

• Account data: for as long as your account is open.
• Security log (sign-ins, failed attempts, IP address and browser, security changes): 12 months, then deleted automatically.
• Expired team invitations: deleted 30 days after they expire.
• Data from connected accounts: while the connection is active. When you disconnect an account, we delete its access keys immediately and its stored data within 30 days.
• When you close your Kyvernio account, we delete your data within 30 days, except invoices and records we must keep by law. Backups are overwritten within a further 30 days.

8. Security

Connections use HTTPS. Access keys for connected accounts are stored encrypted. Every user can protect sign-in with a code from an authenticator app, and account owners can require it for their whole team. Access to our systems is limited, and protected with two-factor authentication and key-based login. Every change Kyvernio makes in a connected account is logged.

When you choose a password, we check whether it appears in known data breaches using the Have I Been Pwned service. Your password is never sent: only the first 5 characters of its one-way hash leave our server.

In Settings > Profile you can download all data we hold about your user at any time.

9. Your rights

Under the GDPR you can ask to access, correct, delete or export your personal data, and to restrict or object to its processing. Write to info@ath.dev. You can also complain to the Hellenic Data Protection Authority (dpa.gr).

You can remove Kyvernio's access to your Google account at any time, from Kyvernio or from your Google Account permissions page.

10. Cookies

The website kyvernio.com sets no cookies. The application at app.kyvernio.com uses only the cookies it needs to work: one that keeps you logged in and one that protects forms against cross-site attacks. We do not use advertising or tracking cookies.

11. Children

Kyvernio is a business service and is not meant for anyone under 16.

12. Changes

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell account owners by email before it applies.