Privacy

What we collect

Kin collects what it needs to connect your AI apps to your services under the rules you set:

• Your account. Your name and email address, how you sign in, your security settings, the version of the terms you agreed to, and your sessions.
• Your setup. The services and AI apps you connect, the keys or sign-in tokens Kin uses to reach your services, the tool descriptions those services publish, and your profiles, permissions and other settings.
• What your AI apps send and get back. The searches, arguments and results that pass through Kin between your AI apps and your services.
• Activity. A record of what your AI apps do through Kin, such as which AI app ran which action, the outcome and when, and any feedback on it.
• Requests and decisions. Each request that waited for an answer, such as an approval, with who answered, when and how.
• Features you use. What a feature needs, such as a linked phone, a paired computer, shared tasks, bug reports and notes your AI apps send, and saved workflows.
• Payments. Your plan and subscription details. Our payment provider handles your card details.
• Messages to us. What you write when you email us or use support chat.
• Technical data. Logs of requests to our servers, such as network address, browser and device details, and timing.
• Analytics. How people find and use Kin, as Product analytics describes.
• Help improve Kin. If your workspace shares it, data about how you use Kin, as Help improve Kin describes.

What Kin holds describes how Kin handles each of these today.

How long content stays. Kin keeps what your AI apps send and get back only as long as it needs to deliver it, such as while an action waits for your approval, unless your workspace keeps Activity details. Activity details are a workspace setting, chosen by its owners and admins, that keeps what AI apps sent and, if chosen, what came back, for the person the AI app acted for.

Workspaces. A workspace's owners and admins choose some of its settings, including how long some kinds of data are kept, and can place a legal hold that keeps data until it is released. Owners, admins and auditors can see records of how the workspace is used, as the app shows them.

The directory. If you or an AI app you connect shares a custom server, Explore lists it by its host name and public tool descriptions, without naming you. You can keep all of your connections out of the directory in settings.

Google user data

When you connect a Google service (Gmail, Gmail (send only), Google Calendar, Google Drive, Google Drive (files you pick), Google Docs, Google Sheets, Google Contacts or Google Tasks), Kin asks Google only for the access that service's actions need, and only when you add it.

What we access. Gmail: your messages, drafts and labels. Gmail (send only): sending the messages you or your AI app write, with no access to read your mail. Google Calendar: your calendars, events, and free and busy times. Google Drive: your files' names, details, sharing and text, read only, and the folders and shared files Kin creates. Google Drive (files you pick): only the files you pick in Google's file picker and the files your AI apps create through it, with their names, details and text, and the folders and files Kin creates; never the rest of your Drive. Google Docs and Google Sheets: Google's permission covers viewing and editing your documents and spreadsheets; Kin opens only the ones you or your AI app name. Google Contacts: your contacts, read only. Google Tasks: your task lists and tasks. From every Google connection: the account's email address and Google's id for it.

How we use it. Only to run an action that an AI app you connected asks for, when your permissions for that connection allow it, and to return the result to that AI app. Changes ask you first unless you choose otherwise.

Google's file picker. When you choose Add files on a Google Drive (files you pick) connection, your browser loads Google's sign-in and file picker from Google, and Google shows you your Drive in its own window. Your browser gets a short-lived Google token that can reach only the files you pick. It stays in your browser and is never sent to Kin. Google then lets that connection open the files you picked, and Kin lists them on the connection's page. Nothing from Google's file picker loads until you choose Add files.

What we store. The account's email address and Google's id for it, and the access and refresh tokens Google issues, encrypted. Content normally passes through without being retained. These exceptions are kept encrypted: the full version of a trimmed result, with access expiring after ten minutes; the arguments of an action waiting for approval, cleared when you decide or with access expiring after one hour; the result of an approved action, with access expiring one hour after the action ends; the inputs and step results of a workflow you published, for the 15 minutes a run lasts; and notes an AI app keeps in a scratchpad you turned on, until they are cleared or expire. Expired copies are cleared by periodic cleanup. If your workspace keeps Activity details and you agree in the app, Kin also keeps, for you only, links to the items your AI apps work with, with their titles and a short excerpt, and, when your workspace keeps more, what your AI apps send to your own Google account and what comes back. It is deleted when you turn this off, remove the Google connection or leave the workspace, or when your workspace's period for Activity details ends, unless a legal hold keeps it. Backup copies are separate, as described under How long we keep it.

Who receives it. Only the AI app you connected that ran the action, and you, if you keep Activity details. What that app does with the result is governed by its own terms and settings. On the way, it passes through our hosting and network security providers, which handle it only to deliver and protect it. We do not sell Google user data, use it for advertising, or use it to create, train or improve any AI or machine learning model. People at Kin do not read it unless you explicitly agree that we may view specific data for support, it is needed to investigate abuse or keep the service secure, or the law requires it.

How to remove it. Remove the connection in Kin. That deletes its tokens, and anything Activity details kept from it, at once, and when no other Kin connection uses the same Google account, Kin also asks Google to revoke its access. You can remove Kin's access yourself at any time at https://myaccount.google.com/connections.

Kin's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Its use of information received from Google Workspace APIs also adheres to the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy).

How we use it

We use your data to run Kin, which means connecting your AI apps to your services, applying your permissions, asking for your approval, ranking actions for a search and showing you your activity. We also use it to bill for paid plans, send account email, answer you when you write to us, keep the service and your account secure, prevent abuse, improve Kin through the analytics and the Help improve Kin setting described below, and meet legal obligations. Some features, such as ranking actions for a search, use AI models run by us or by our service providers.

We don't sell your data.

Help improve Kin

Help improve Kin is a setting that lets a workspace share data about how it uses Kin, such as the searches and actions its AI apps run and how approvals go. We use shared data to improve Kin, such as how it ranks actions for a search, how AI apps use its actions and how approvals work, and we may use it to train and evaluate the AI models and ranking that Kin uses.

On Free plans, it may be on by default where the law allows. On paid plans, it is off unless an owner or admin turns it on. Owners and admins can turn it off for the workspace at any time in Settings, and anyone can turn it off for their own use. Turning it off stops sharing from then on. Data already shared is kept for a limited time, including after sharing is turned off or an account is deleted, and improvements already made with it remain.

Shared data never includes passwords, keys or other secrets, Google user data, or data from a connected service whose terms forbid this use.

Who else handles it

Service providers. We use service providers to run Kin, in categories such as hosting and infrastructure, network and security, content delivery and storage, databases, AI processing (including AI model providers), payments, email, notifications, analytics, support and partner referrals. They process data on our behalf to provide their services to us, under terms that limit their use of it. Some, such as our payment provider, also use it for their own legal and fraud-prevention duties.

We may add or replace service providers. The current list, with what each one does, is on our Subprocessors page. When it changes, we update that page and its date, and we give business customers notice of changes where their contract requires it. A new or replaced service provider in these categories changes that list, not this policy.

Services you choose. The AI apps and services you connect, and the accounts you sign in with, receive what they need to do what you or your AI apps ask, under their own terms.

Legal requirements. We disclose data when the law requires it.

Where it is processed

Kin and its service providers store and process data in the United States and in other countries where they operate, such as at the network location nearest you.

How long we keep it

We keep data while we need it for the purposes above, to meet legal obligations and resolve disputes, or for as long as your workspace's settings say:

• Your account and setup, until you remove them or delete your account.
• Activity, requests and Activity details, for the period your plan and your workspace's settings set.
• Content in transit, only as long as Kin needs it to deliver it.
• Logs and backups, for a limited time, after which they expire.
• Data shared through Help improve Kin, for a limited time.
• Data under a legal hold, until the hold is released.

What Kin holds and your workspace's data settings show the current periods. Removing a connection deletes its credential. Deleting your account removes the account and workspaces you own from our live database. The benefit and audit records described below remain. Backup copies are separate and are not erased immediately by account deletion. Service providers keep what they already hold under their own retention terms.

Kin keeps creator-benefit and partner commission reconciliation records, and the audit history of complimentary Pro grants, after an account or workspace is deleted. These records can identify creators, customers they referred, and people who received complimentary Pro. They can include account and workspace IDs, partner IDs and codes, a hash of a creator's email address, payment references, amounts and dates, and operator details and notes. These records currently have no automatic deletion period.

Product analytics

We use analytics to see how people find and use Kin, such as how many visitors sign up and go on to connect a tool, and to find and fix errors.

For every visitor, without asking, we collect basic usage: the pages you open, the site and campaign that referred you, your browser, operating system and device type, milestones such as signing up or connecting a service, and error reports. For an account, we also collect how its AI apps use Kin, such as which tools and services they call, whether the calls work and how long they take, but not what they send or receive. These basics store nothing in your browser. We limit what we share with our analytics provider to what it needs for this.

Three more things run only if you choose Allow for the current notice and recording scope, wherever you are: session recordings, short surveys, and an id kept in your browser so tests of new designs stay consistent. Choosing No thanks, or leaving the question unanswered, keeps these three off. The basic analytics above do not depend on Allow.

What a recording can show. How you move through our pages. On public pages it hides the text and everything you type. On signed-in pages it shows only Kin's own interface, such as navigation and buttons, never what you type or what your connected services hold. It can still show a page's layout, such as how many items a list has. Some pages, such as those for sign-in security or authorizing an AI app, are never recorded.

Your versioned choice. This notice is 2026-10-21.3; its recording scope is reviewed-controls-v1. This browser keeps your choice, those two versions and the time you chose, for up to 180 days. It records an analytics choice, not permission to access a connected account or run an action. An expired, earlier or unversioned Allow does not cover this scope, so optional analytics stays off until you choose Allow for the current version.

You can change your answer at any time under Privacy choices at the bottom of our public pages, or in settings. Turning optional analytics off stops it in this browser and removes its id. It does not delete what was already collected. Your choice applies to the browser you make it in.

If your browser sends Global Privacy Control or Do Not Track, it sends nothing to our analytics provider, and we do not ask. We still count visits and sign-ups from it in aggregate, and milestones and AI app calls Kin records for your account, errors on our servers and feedback you choose to send still go to our analytics provider.

Feedback. Send feedback in the app sends what you choose, when you choose Send: the topic, your message, the page you sent it from and, if you allowed recordings and that page was recorded, a link to its recording. We keep feedback to improve Kin. To have yours deleted, write to privacy@kinlab.ai.

Cookies

We use the cookies and browser storage Kin needs to work and stay secure, such as for signing in, limiting abuse and remembering your privacy choice, and, if you choose Allow, for optional analytics. Our service providers can set their own cookies for security, and our support provider does when you open support chat. If you sign in with another account or use Google's file picker, that service uses its own cookies under its own terms. If you arrive through a partner's referral link, Kin remembers that partner in a cookie for 60 days, and with your workspace, so the partner is credited if you subscribe. A browser that sends Do Not Track or Global Privacy Control is never credited to a partner.

Your privacy rights

The Free plan is available worldwide and paid plans only in the United States for now, so you may be using Kin from anywhere. Wherever you live, you can use the rights below. Kin Computing, Inc. answers every request.

Write to privacy@kinlab.ai for any of them, and for any other question about your data. We answer within 30 days. So that nobody else can get or change your data, we act on a request only when it comes from, or is confirmed from, the email address on your account.

• Find out what we hold. Your connections, permissions and activity are in the app. Write to us and we will tell you what else we hold about you.
• Get a copy. Write to us and we will email you a copy of your account's data, leaving out password hashes, keys and sign-in tokens. Where your workspace offers it, you can also export your own Activity in the app.
• Correct it. Write to us to correct your name, your email address or anything else we hold about you that is wrong.
• Delete it. In the app, open Settings › Account, choose Delete account, type your email to confirm, and choose Delete my account. That removes your account and workspaces you own from our live database, and ends paid subscriptions for those workspaces immediately. The records described under How long we keep it remain, as does data under a legal hold until it is released. Backup copies are separate and are not erased immediately by account deletion, and service providers keep what they already hold. You can also ask us by email to delete your account. To remove a single connection, open it and choose Remove.
• Say no to optional analytics. Session recordings, surveys and an id kept in your browser run only if you choose Allow. Choose No thanks when we ask, or change your answer at any time under Privacy choices at the bottom of our public pages or under Privacy in Settings › Account.
• Stop sharing for Help improve Kin. Turn it off in Settings at any time, as Help improve Kin describes.
• Global Privacy Control and Do Not Track. We honor both, as Product analytics describes.
• Object to anything else. To object to any other use of your data, write to us. We will stop it where we can, or tell you why we cannot.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, meaning ads aimed at you based on what you do on other companies' sites and apps. The partner referral cookie described under Cookies is used only to credit the partner whose link you followed, not to show you ads.

Changes to this policy

When this policy changes, the new version will be posted on this page. Changes to the service providers we use are made on the Subprocessors page, as Who else handles it describes. A change to optional recording scope requires a new Allow before that scope can run. We keep this notice version and earlier ones available so you can review what a choice covered.