Privacy Policy

1. Who we are

Kiavi AI, Inc. ("Kiavi AI", "we", "our", or "us") provides technical intelligence, computer vision, and compliance telemetry architectures for medical device instrumentation, automotive engineering units, and complex architectural structural frameworks. When operating within the European Economic Area (EEA), the United Kingdom, or Switzerland, Kiavi AI operates as the Data Controller under Regulation (EU) 2016/679 (GDPR) and the UK Data Protection Act 2018.

Our registered corporate headquarters and principal operating entities maintain centralized oversight of all algorithmic indexing, customer tenant telemetry, and validation datasets. Where client enterprise agreements govern industrial telemetry processed inside client-partitioned virtual private clusters, Kiavi AI operates exclusively under strict Data Processing Addenda (DPAs) as a Data Processor.

2. What personal data we collect

We collect personal data strictly when necessary to provision industrial software, license verification mechanisms, and authenticate research credentials. Data is captured directly from enterprise contacts, automated session handshakes, and identity federation integrations.

Categories of collected records

• Identity and Profile Information: Authorized user names, institutional email addresses, departmental roles, engineering or clinical specialization credentials, and enterprise tenant account IDs.
• Access and Network Telemetry: Static IP addresses, verified cryptographic token signatures, operating environment diagnostics, user agent strings, and system interaction logs.
• Communication Records: Engineering support inquiries, verification review logs, bug remediation tickets, and regulatory audit compliance trails submitted to Kiavi AI support pipelines.

Kiavi AI does not process special categories of personal data as defined under GDPR Article 9 (such as biometric identifiers, genetic information, or direct protected health information) through standard institutional telemetry channels. All diagnostic images uploaded into machine-learning audit workbenches are scrubbed through client-side redaction filters prior to ingestion.

3. How we use your data

Data acquired by Kiavi AI is used to power real-time validation pipelines, calibrate computational accuracy across our models, and safeguard institutional safety parameters. We maintain complete operational separation between raw telemetry and our generalized base models to ensure confidential engineering specifications remain segregated.

Specifically, we deploy system data to enforce security posture controls, automate ISO/IEC 27001 authentication routines, distribute system update notifications, and generate non-identifiable telemetry benchmarks regarding structural platform uptime and processing throughput.

4. Our legal basis for processing

In compliance with Article 6 of the General Data Protection Regulation (GDPR), every processing activity executed by Kiavi AI rests upon an explicit, verified lawful basis. We never retain or process industrial operator data without definitive legal justification.

• Contractual Necessity (Art. 6(1)(b)): Processing essential to provide platform access, authenticate authorized industrial operators, and fulfill contractual deliverables specified within enterprise licensing frameworks.
• Legal Obligation (Art. 6(1)(c)): Mandatory archival and logging activities required under statutory standards, export control enforcement, or regulatory compliance protocols including ISO 13485 and Medical Device Regulation (MDR).
• Legitimate Interests (Art. 6(1)(f)): Continuous protection of infrastructure against distributed threats, optimization of core computational models, and institutional audit verification, provided such interests do not override fundamental personal rights.

Where processing relies upon voluntary consent (Art. 6(1)(a)), such as participation in qualitative engineering research or analytics cookies, consent may be revoked instantaneously through our interface without incurring operational penalties.

5. Who we share your data with

Kiavi AI does not monetize, rent, or lease personal identifiers or telemetry records under any scenario. Data sharing is limited strictly to vetted sub-processors that supply foundational cloud compute, encrypted network transit, or authorized regulatory audit supervision.

All sub-processors undergo rigorous third-party SOC 2 Type II and ISO 27001 validation prior to engagement. These entities are legally bounded by comprehensive non-disclosure agreements and explicit Data Processing Agreements preventing unauthorized retention or cross-client inference.

6. International data transfer

Whenever personal data originating within the European Economic Area (EEA), Switzerland, or the United Kingdom is transferred to third countries, Kiavi AI incorporates appropriate transfer safeguards approved by the European Commission pursuant to GDPR Article 46.

These mechanisms include standard contractual clauses (SCCs), Supplementary Measures Audits (TIAs), and reliance on certified adequacy frameworks such as the EU-U.S. Data Privacy Framework. Customers can request executed copies of these transfer safeguards at any time.

7. How long we keep your data

We retain personal information only for the minimum duration required to fulfill original commercial purposes, maintain dispute resolution archives, and satisfy mandatory legal retention periods.

Upon termination of enterprise service agreements, authorized tenant records are queued for deletion. Operational backups are permanently purged within 30 days using NIST SP 800-88 Rev. 1 cryptographic erasure standards, accompanied by a verified destruction receipt.

8. Your rights

Under European data protection regulations and equivalent global frameworks, data subjects possess robust rights regarding how their personal records are stored and processed.

To exercise these rights, submit a signed request to hello@kiavi.ai. We respond to verified data subject inquiries within 30 calendar days at no charge. You also retain the right to lodge a formal complaint with your relevant National Supervisory Authority.

9. Cookies

Kiavi AI utilizes functional session cookies and aggregated analytics beacons to enable authentication state persistence, load balancing, and diagnostic performance tracking. Cookies never capture confidential engineering payload files.

Non-essential performance or measurement tracking is entirely opt-in. You may inspect, modify, or withdraw your cookie preferences at any point via our persistent Cookie Preferences Panel or through your client browser settings.

10. Changes to this policy

We periodically review and revise this Privacy Policy to mirror technological advancements, system enhancements, and evolving regulatory expectations. Material modifications will be announced via registered tenant admin alerts and a prominent banner notification on this portal.

Continued interaction with Kiavi AI services following the effective date of an amended statement constitutes acknowledgment of the revised provisions. Archival iterations of previous policy versions remain accessible upon formal request to our legal team.

11. How to contact us

For questions, legal notices, or compliance inquiries concerning Kiavi AI's privacy architecture or our data handling practices, our Data Protection Officer and global legal counsel are reachable through designated communication lines.

We confirm receipt of all privacy inquiries within two business days and commit to resolving compliance inquiries with comprehensive documentation within the statutory 30-day window.