Privacy Policy

1. Scope

This Privacy Policy applies to kitwork.io (the website, docs, and managed cloud platform) operated by the Kitwork team. It describes how we handle personal data when you:

• visit the Kitwork website or documentation;
• register for or use the managed Kitwork Platform (cloud hosting, dashboard);
• contact us via email or GitHub.

This policy does not govern the data processed inside your own tenants when you self-host the Engine. Your tenant data is entirely under your control and jurisdiction. See Section 5.

2. Data We Collect

We collect the minimum data necessary to operate the platform. Here is a full inventory:

2.1 · Account & Billing Data

2.2 · Platform Usage Data

2.3 · Website Visit Data

Kitwork.io does not use third-party analytics (no Google Analytics, no Mixpanel). We collect only basic server-side access logs (anonymized IP, path, response code) retained for 7 days for security monitoring.

2.4 · Data We Do Not Collect

3. How We Use Your Data

• Operate the platform — provision tenants, enforce plan limits, process payments.
• Authenticate you — verify identity at login via password hash or OAuth token exchange.
• Send transactional emails — billing receipts, password resets, security alerts. We do not send marketing emails without explicit opt-in.
• Prevent abuse — rate limiting, SSRF blocking, anomaly detection on managed instances.
• Improve the Engine — opt-in crash reports help diagnose VM bugs. Fully anonymized before storage.
• Comply with law — tax records, invoice retention as required by Vietnamese law.

We do not sell, rent, or trade your personal data with any third party for marketing purposes.

4. Storage & Security

Platform account data is stored on servers located in Vietnam. We apply the following controls:

• Encryption at rest — all databases are encrypted using AES-256.
• Encryption in transit — all connections use TLS 1.2+ (AutoSSL via ACME for your tenants too).
• Password hashing — bcrypt with cost factor ≥ 12; plaintext passwords are never stored or logged.
• Access control — production data access is restricted to authorized Kitwork personnel only, with audit logging.
• Zero-VM static serving — static assets are served straight from disk in Go, bypassing the VM entirely.

5. Tenant Data Sovereignty

Kitwork is built on a fundamental principle: your data stays yours. This is not just a policy statement — it is enforced by the architecture:

• Each tenant runs in its own isolated VM with a separate memory space, bytecode cache, and environment store.
• Per-tenant .env files are path-isolated and never cross tenant boundaries.
• Your PostgreSQL database connection string stays in your environment; Kitwork never connects to your database directly.
• SSE (Server-Sent Events) channels, logs, and telemetry run entirely within your host process — nothing is exfiltrated.
• JIT CSS, JIT icons, and all assets are served from your own disk or cache — no external CDN calls are made by the Engine.

On the managed cloud, your tenant files are stored in your allocated directory on our servers. You may export all tenant files and database dumps at any time via the dashboard and migrate to self-hosting with no lock-in.

6. Cookies & Client Storage

We use the minimum possible client-side storage:

We do not use tracking cookies, advertising cookies, or any third-party cookie scripts. No analytics SDK is loaded on kitwork.io.

7. Third-Party Services

We use a limited set of third-party services. Where they receive personal data, we have data processing agreements (DPAs) in place:

When you use outbound HTTP calls (fetch()) in your tenant code, those requests are made by your server and are subject to the third-party's own privacy policy. Kitwork enforces SSRF blocking to prevent abuse.

8. International Data Transfers

Platform account data is stored and processed in Vietnam. When you use GitHub or Google OAuth, authentication data briefly passes through their infrastructure (US / EU). We rely on their certified privacy frameworks (SCCs, Privacy Shield successors) for these transfers.

For enterprise customers requiring data residency in a specific region, contact support@kitwork.org to discuss options.

9. Data Retention & Deletion

• Active accounts — account data is retained for the life of the account plus 30 days after deletion.
• Request logs — anonymized access logs are deleted after 14 days.
• Billing records — retained for 5 years as required by Vietnamese tax law.
• Crash reports — anonymized, deleted after 90 days.
• Backups — platform backups cycle within 7 days; deleted accounts are purged from backups within that window.

To request account deletion, email support@kitwork.org or use the "Delete account" option in the dashboard. We will complete deletion within 7 business days.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your account and associated personal data.
• Portability — export your tenant files, configuration, and account data in machine-readable format.
• Restriction — request that we limit processing of your data while a dispute is resolved.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — opt out of any processing based on consent (e.g., crash reporting) at any time from your dashboard settings.

To exercise any of these rights, contact support@kitwork.org. We respond to all requests within 30 days.

11. Children's Privacy

Kitwork is a developer platform intended for users aged 16 and above. We do not knowingly collect personal data from children under 16. If you believe a minor has created an account, please contact us immediately at support@kitwork.org and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal obligations. Material changes will be posted on this page with an updated date and — for registered users — notified via email at least 14 days before taking effect.

Continued use of the platform after a change constitutes acceptance of the updated Policy.

13. Contact

For any privacy questions, data requests, or security disclosures:

• Email: support@kitwork.org
• GitHub: github.com/kitwork
• Founder: Huỳnh Nhân Quốc 🇻🇳