GDPR

This page explains how Kipwise Inc. (“Kipwise”) meets the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss data protection act when you use Kipwise. It sits beside our Privacy Policy, Sub-processors list and Terms of Service.

Who is the controller

For the content and data your team puts into Kipwise (knowledge base pages, messages Kipwise Agent reads in Slack or Microsoft Teams, support conversations with your customers, requests and Tasks), you are the controller and Kipwise is your processor. We process that data only on your documented instructions: the Terms of Service, your settings and what you ask the agent to do. For website visitors, account holders and billing contacts, Kipwise is the controller. The Privacy Policy lists the purposes and legal bases for each.

Where your data lives

Kipwise has two regions on Amazon Web Services: US (us-east-1, N. Virginia) and EU (eu-central-1, Frankfurt, Germany). A workspace lives in exactly one region, and its content, Agent data, support desk, requests and Tasks, with their databases and file storage, stay there. Teams that sign up or install from kipwise.eu are placed in the EU region. Workspaces in the EU region have their own services, databases and keys. For Kipwise Agent in the EU, the AI model that writes the reply runs in the EU. Exceptions are listed on the Sub-processors page: web search for EU Agent workspaces and the AI answers feature of the knowledge base run in the United States, and Cloudflare, Stripe and some other providers operate globally.

Data processing agreement

A data processing agreement (DPA) is available to every customer that needs one. It covers the subject matter and duration, the nature and purpose of processing, the types of personal data and people, our duties as processor under Article 28, our security measures, the sub-processors on our list, help with data subject requests, breach notice and the return or deletion of data at the end. To get it, email dpo@kipwise.com with your company name and workspace address.

International transfers

Kipwise Inc. is in the United States. Where personal data moves from the EEA, the United Kingdom or Switzerland to a country that lacks an adequacy decision for it, including to Kipwise Inc. and to our US sub-processors, the transfer is covered by the European Commission’s Standard Contractual Clauses (Module Two, controller to processor, and Module Three, processor to sub-processor), with the UK addendum for the UK. Our sub-processors’ own data processing terms carry equivalent clauses. We add technical safeguards: encryption in transit, encrypted tokens, access control, and the regional design above.

Sub-processors

We use the providers on the Sub-processors page, each under a written agreement with data protection duties no less strict than ours. Tools you connect to Kipwise Agent, such as Gmail or Notion, are third parties you direct us to use, and are not our sub-processors. To be told by email when we add a sub-processor, write to dpo@kipwise.com.

Security

Data is encrypted in transit. Access tokens and approval records are encrypted at the application level with AES-256-GCM. Kipwise Agent acts with the access of the person who asked, and asks for approval before it writes to another system. Our infrastructure runs in AWS data centers that hold SOC 1, SOC 2 and ISO 27001 certifications. Databases are backed up, and backups expire after 7 days. If we become aware of a personal data breach affecting your data, we tell you without undue delay.

Retention and deletion

Retention periods are listed in the Privacy Policy under Retention and deletion. Examples: Agent memory facts 365 days (90 days on Slack Free and Lite and in Teams); approval records 7 days; support desk conversations 24 months after the last message; server logs 30 days. When you remove Kipwise Agent from Slack, workspace memory and the accounts shared in channels are deleted. We delete the rest of your data within 30 days of a request at the end of your use, and records can remain in backups for up to 7 days after that.

Your customers and your team: data subject rights

People have the rights to access, correct, delete, restrict, object to and port their data. If someone contacts us about data we hold for you, we pass the request to you, and we help you answer it. The tools to do so:

• Support desk: an admin can export everything held about one contact, and permanently delete it, including content, tickets, attachments and visitor details.
• Agent memory: anyone can ask the agent to forget a fact, and an admin can delete all saved memory or switch memory off.
• Knowledge base: admins and page owners can edit, delete and export pages.
• Any other data: email dpo@kipwise.com. We complete requests within 30 days.

AI and your data

Kipwise Agent sends the text it needs to answer to an AI model (Anthropic’s Claude) on Amazon Web Services Bedrock. Under AWS’s terms, that data is not used to train the underlying models. Kipwise does not train or fine-tune any model on customer data. Memory and approvals are explained in the Privacy Policy. Admins can turn memory off, and can limit which tools the agent uses.

Your responsibilities as controller

You decide what goes into Kipwise. You need a legal basis for it, and you must give the people involved the notices that the law requires, for example employees whose Slack messages memory reads, and customers who chat with your support desk. Do not put special categories of data into the Services unless you have the right to and the safeguards in place.

Data protection officer and complaints

Our Data Protection Officer is at dpo@kipwise.com. Kipwise Inc., 3 Germay Dr, 4 STE, Wilmington, DE 19804-1127, United States. You also have the right to complain to your data protection authority.

EU representative (GDPR Article 27)

Our representative in the European Union and European Economic Area under Article 27 of the GDPR is FatCouple OÜ, Telliskivi 60a/5, B-building, 10412 Tallinn, Estonia. Contact: dpo@kipwise.com. This representative covers the EU/EEA only.