kiwilink

Privacy Policy

Last updated November 4, 2026

This policy says what kiwilink collects, why, and what you can do about it.

What we collect

• Your account: your name and your email address. We confirm the address is yours with Google, or by sending a code to it.
• From Google, if you sign in with it: your name, your email address and whether Google has verified it. We use these only to sign you in and make your account, never for ads, and we do not get access to anything else in your Google account.
• Where you work: we read the company from your email's domain, such as acme.com from ana@acme.com. With a personal address, such as Gmail, we record no company unless you tell us where you work.
• Your passkeys: the public part only. The private key never leaves your device.
• Tools and spending: the accounts kiwilink makes or tracks for you, their plans and costs, your budget, and approvals.
• The API keys you add: the keys for services you use, such as GitHub or OpenAI, with the label you give each one. Stored encrypted.
• Your vault: passwords and API keys for tools kiwilink signs you up to, stored encrypted.
• Activity: a log of what you and your agents did in kiwilink, including each call an agent made through kiwilink: when, which account, the method and path, and the result. We do not keep the bodies of those calls. Basic server logs too.
• Usage and billing: how many calls your workspace makes and what plan it is on. If you pay, our payment provider handles your card, and we never see the full number.
• Mail, only if you connect a mailbox: kiwilink reads only a vendor's confirmation mail for a signup it started, and never shows it to an agent.

How we use it

To run kiwilink for you: signing you in, making the calls your agents ask for, signing you up to tools, keeping your vault, enforcing your budget and limits and showing your activity. We use your email and where you work to understand who uses kiwilink, to contact you about your account and about kiwilink, and to plan the product, including grouping people from the same company. We do not sell your personal information.

Your API keys

kiwilink stores the API keys you add encrypted, each under its own key. It uses a key only to make the calls your agents request, within the limits you set, and only for as long as you keep it in kiwilink. It never shows a key to an agent: your agents call the service through kiwilink, and kiwilink adds your key to that one call. When you remove a key, or close your workspace, kiwilink deletes it.

What agents see

Your connected agents see which tools and accounts you have, by label, the session keys they are given, your budget, and what the services they call send back. They never see the API keys you add, your passwords, your card numbers, your passkeys or your mail. The one exception is a tool kiwilink signs you up to that kiwilink cannot call for your agent: then your agent gets that tool's own API key, so it can use it.

Who we share it with

A service your agent calls through kiwilink gets that call, made with your key, and an id for your workspace that is different at each service and says nothing about who you are. Vendors you sign up with get what their signup needs, such as your email. Service providers we use to run kiwilink, such as hosting, database and email delivery, process data for us under their own security terms. We may share information if the law requires it, or to protect people or kiwilink from harm.

How long we keep it

As long as your account is open. An API key you remove is deleted at once. When you close an account at a vendor through kiwilink, its stored credentials are deleted. The log of calls is kept as long as your plan says: 30 days on Free, a year on Pro. Ask us to close your workspace or delete your kiwilink account and we will delete your data, including every key, except what we must keep by law.

Your choices

You can see and change your details in Settings, and ask us for a copy of your data, or to correct or delete it. Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA, and you can use them by contacting us.

Security

Secrets are encrypted at rest. Adding a key, spending, closing accounts and raising limits need a passkey, so an agent driving your browser cannot do them. No system is perfectly secure, and we will tell you if a breach affects your data.

Changes and contact

We will post changes here and update the date above. Questions or requests: write to signin@kiwilink.ai.